Course contents

Unit 6: OMP and service routingLesson 6.1 (1 of 1 in this unit)26 of 27 in the Cisco SD-WAN course

OMP purpose, peers and exchanges

What OMP carries, who peers with whom, and the life of one prefix from a branch LAN to a remote branch, with the commands that show each step.

Intermediate · 14 min read

You'll learn to explain what OMP carries and who it runs between, follow one prefix from a branch LAN to a remote branch, and use the show commands that prove each step.

Technical definition

OMP (Overlay Management Protocol) is the routing protocol of the Cisco SD-WAN control plane. Each WAN Edge router has an OMP session with the SD-WAN Controller (formerly vSmart), over its secure control connection, and sends it the prefixes, transport locators and services it has. The Controller applies policy and sends the results to the other routers.

BR-02 cannot reach BR-01's LAN

A user behind BR-02 cannot reach 10.10.1.0/24, the corporate LAN (VPN 10) behind BR-01. Both routers show healthy control connections. The prefix has to travel from BR-01 to the Controller, through any policy, to BR-02, and be resolved to a working tunnel, and it can fail at any of those steps. OMP is the protocol that carries it, so this lesson is also the map for finding where such a route stops.

Who speaks OMP

How BR-02 learns a prefix that BR-01 owns
How BR-02 learns a prefix that BR-01 ownsBR-01 has the LAN prefix 172.16.1.0/24 behind it. It sends an OMP route advertisement to the Controller with its TLOC, the system IP 10.255.2.1 with a colour and encapsulation. The Controller applies any control policy and sends the route to BR-02 over its own OMP session. BR-02 now knows the prefix and the TLOC to use for the tunnel.BR-01172.16.1.0/24 behind itCTRL-01OMP, applies policyBR-02learns the prefix1 advertise2 reflectAdvertisement carriesprefix, TLOC 10.255.2.1 colour, labelBR-02 installs the routenext hop is the TLOC, not an interface IPCheck with show sdwan omp routes on the edge.

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Edges do not peer with each other for routes. Each edge has an OMP session to the Controller, which acts like a route reflector, so a missing prefix usually stops at one of the two sessions.

OMP runs inside the secure DTLS or TLS control connection between a WAN Edge and a Controller. Edges peer with the Controller only; where there are several Controllers, each edge peers with more than one, and the Controllers peer with each other. The Controller is not a router for user traffic. It collects advertisements, applies control policy, and sends the result on: the same job a route reflector does in BGP, which is why the BGP iBGP lesson's full-mesh problem has no counterpart here.

Who speaks OMP
Who speaks OMPEdges and Controllers.OMPEdgeto ControllerControllerto ControllerEdge to Edgenot used for OMP

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Edges do not peer with each other.

What OMP carries

What OMP carries
What OMP carriesRoute type; What it says; Example. OMP route (vRoute): A prefix in one service VPN, which TLOC to reach it through, and a label that tells the far router which VPN the packet belongs to 10.10.1.0/24 in VPN 10, via BR-01's mpls TLOC TLOC route: A transport locator and its attributes: addresses, ports, preference, weight, encapsulation (10.255.2.1, biz-internet, ipsec) Service route: A service available at a site, such as a firewall, so traffic can be sent through it A firewall service in VPN 10 at HUB-01Route typeWhat it saysExampleOMP route (vRoute)A prefix in one service VPN, whichTLOC to reach it through, and a labelthat tells the far router which VPNthe packet belongs to10.10.1.0/24 in VPN 10, via BR-01'smpls TLOCTLOC routeA transport locator and itsattributes: addresses, ports,preference, weight, encapsulation(10.255.2.1, biz-internet, ipsec)Service routeA service available at a site, suchas a firewall, so traffic can be sentthrough itA firewall service in VPN 10 atHUB-01

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

An OMP route needs a TLOC route to be useful: the route says "go via this TLOC", and the TLOC route says how to reach it. Which route sources an edge advertises (connected, static, OSPF, BGP and so on) is part of its configuration, so a prefix that is not advertised is often a settings problem, not a fault.

What OMP carries
What OMP carriesThree kinds of route.OMP routesPrefixes and where to find themTLOC routesTunnel endpointsService routesServices such as firewalls

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Each has a job.

The life of one prefix

The life of one prefix
The life of one prefixLearned at a site, advertised, selected and installed.Local routeat the edgeAdvertiseto ControllerControllersends to peersInstallat remote edge

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Each step can be checked.
  1. BR-01 has the prefix. 10.10.1.0/24 is in BR-01's VPN 10 routing table: connected, static or learned from the LAN.
  2. BR-01 advertises it. An OMP route goes to CTRL-01: prefix, VPN 10, and BR-01's TLOC as the way to reach it.
  3. The Controller applies policy. Any control policy can accept, reject or change the route, and decides which sites receive it.
  4. The Controller sends it to BR-02. BR-02 receives the same prefix with BR-01's TLOC as the next hop.
  5. BR-02 resolves the next hop. The route is installed only if the TLOC is usable: a tunnel to it must be up (BFD).
  6. Traffic flows directly. Packets for 10.10.1.0/24 go from BR-02 to BR-01 in an IPsec tunnel. The Controller is not on the path.

Commands that prove each step

Work in order, from the origin outwards. A missing item tells you which step failed.

  1. The route is local. On BR-01, the prefix is in the VPN 10 routing table.
  2. OMP is up. On BR-01 and BR-02, the Controller peer is up.
  3. The Controller has it. On CTRL-01, the prefix is received from BR-01.
  4. BR-02 receives it. On BR-02, the prefix appears in the OMP table, with BR-01's TLOC as next hop.
  5. It is resolved and installed. The status shows the route is usable, and a BFD session exists to that TLOC.
show ip route vrf 10 10.10.1.0 255.255.255.0

On BR-01: is the prefix in the VPN 10 table? On IOS XE SD-WAN, service VPN 10 is a VRF with that number.

Example output written for this lesson, simplified; real output has more fields and a different layout
BR-02#show sdwan omp peers
PEER         TYPE    DOMAIN  OVERLAY  SITE  STATE  UPTIME       R/I/S
10.255.0.11  vsmart  1       1        1     up     0:03:41:12   5/2/3
BR-02's one OMP peer is the Controller (type vsmart, the older name of the SD-WAN Controller) and it is up. R/I/S is the number of routes received, installed and sent on this session.
Example output written for this lesson, simplified; real output has more fields and a different layout
BR-02#show sdwan omp routes 10.10.1.0/24
VPN  PREFIX         FROM PEER    PATH ID  LABEL  STATUS  TYPE       TLOC IP      COLOR         ENCAP  PREF
10   10.10.1.0/24   10.255.0.11  66       1002   C,I,R   installed  10.255.2.1   mpls          ipsec  -
10   10.10.1.0/24   10.255.0.11  68       1002   C,I,R   installed  10.255.2.1   biz-internet  ipsec  -
Two paths to the same prefix, one through each of BR-01's TLOCs, both chosen (C), installed (I) and resolved (R). The label (1002) is how BR-01 knows the packet belongs to VPN 10 when it arrives. A status with U instead of R would mean the TLOC is unresolved: no working tunnel to it.
show sdwan bfd sessions

On BR-02: is there a session to BR-01's system IP, 10.255.2.1, on the colours the route uses?

When both routes are installed with equal preference, BR-02 can share traffic across them, up to the router's equal-cost limit. That is the starting point for the path-choice lessons later in the course.

Where a missing prefix stops

Where a missing prefix stops
Where a missing prefix stopsAt the source, the Controller or the receiver.Missing prefixSourcenot redistributedControllerpolicy removed itReceiverno tunnel to TLOC

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Check each step.
Where a missing prefix stops
Where a missing prefix stopsThe prefix is missing at; The step that failed; Typical causes. BR-01's VPN 10 table: It was never learned locally LAN interface down or in the wrong VPN, missing route, wrong VLAN mapping The Controller: BR-01 did not advertise it, or OMP is down Route source not enabled for OMP, OMP session down, a control policy applied to BR-01's updates BR-02's OMP table: The Controller did not send it A control policy that excludes BR-02's site, BR-02 not in VPN 10 BR-02's routing table, though in the OMP table: Received but not installed Unresolved TLOC (no tunnel), a better route from another sourceThe prefix is missingatThe step that failedTypical causesBR-01's VPN 10 tableIt was never learned locallyLAN interface down or in the wrongVPN, missing route, wrong VLANmappingThe ControllerBR-01 did not advertise it, or OMP isdownRoute source not enabled for OMP, OMPsession down, a control policyapplied to BR-01's updatesBR-02's OMP tableThe Controller did not send itA control policy that excludesBR-02's site, BR-02 not in VPN 10BR-02's routing table,though in the OMP tableReceived but not installedUnresolved TLOC (no tunnel), a betterroute from another source

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

One Controller lost is different from all peers lost

Suppose BR-02 loses its session to CTRL-01. Check the complete OMP peer list before concluding that route exchange has stopped. If another expected Controller remains up and supplies the required routes, control information can still arrive through it. Check the actual prefix and policy rather than treating a second peer as proof that every service works.

When all Controller sessions are lost, OMP graceful restart can keep previously learned information temporarily while control recovers. It does not create new reachability or repair a failed data tunnel. The retention timer is not a promise that an application will work for that duration: tunnel/key state, the selected service route and the return path still matter. Do not reboot an isolated edge as a casual test; cached state can be lost.

show sdwan omp peers show sdwan omp summary show sdwan bfd sessions show ip route vrf 10 10.10.1.0 255.255.255.0

Read-only IOS XE Catalyst SD-WAN 17.x-style checks on BR-02: inspect every expected OMP peer, OMP/graceful-restart state, the relevant data tunnel and the VPN 10 route. Verify exact fields and timers on the selected release.

Record this baseline in an isolated lab, compare it during an approved fault, then restore the known fault and confirm OMP synchronization, the service route and a permitted application flow in both directions. Do not shut down a shared Controller for this exercise. Technical basis: Cisco Catalyst SD-WAN design guide and IOS XE OMP timer reference.

Common misreadings

  • Concluding the Controller is in the data path because the route comes from it. It only passes the route; packets go edge to edge.
  • Checking only that OMP is up. A healthy session says nothing about which routes cross it.
  • Looking for the missing prefix in the underlay routing table. Overlay routes live in the service VPN's table, not VPN 0.
  • Forgetting policy. A control policy can drop or change a route at the Controller, so an advertised prefix may never arrive.

Test yourself on OMP

Predict · scenario 1

Which devices form OMP sessions with each other?

Predict · scenario 2

BR-02's OMP table has 10.10.1.0/24 with status U. What does that mean?

Predict · scenario 3

A packet from BR-02's LAN to 10.10.1.5 is forwarded. Which path does it take?

Predict · scenario 4

BR-01's OMP session is up, but 10.10.1.0/24 is absent from BR-02's OMP table. BR-01 has the prefix in VPN 10. Which is the most useful next check?

Predict · scenario 5

BR-02 loses CTRL-01, but its OMP session to CTRL-02 remains up. Does this prove all route updates have stopped?

FAQ

Do WAN Edge routers run OMP with each other?
No. Each edge peers only with the Controller, which passes routes between edges, a little like a BGP route reflector. The edges build IPsec tunnels directly to each other for user traffic, but they do not exchange OMP routes directly.
Does user traffic go through the Controller?
No. The Controller only handles control information. Once a route is installed, packets go directly from one WAN Edge to the other through an IPsec tunnel.
What happens to forwarding if the Controller goes down?
First check the other OMP peers. A remaining healthy Controller can continue exchanging routes, subject to the topology and policy. If all Controller sessions are lost, enabled OMP graceful restart can temporarily retain learned information. That is not a guaranteed outage window: forwarding still needs working tunnels, valid keys, service routes and policy. Check the effective timers and peer state for your release; restore control before retained state expires.