TLOC components and transport reachability

One router, two doors onto the WAN

BR-01 is a branch with two WAN links: an MPLS circuit and a business internet line. After it is onboarded, the Controller lists two TLOCs for BR-01, although the router has one system IP, 10.255.2.1. That difference between one router and two TLOCs is what this lesson explains, because service-route next hops and data tunnels refer to transport identities rather than only to router names. This lesson uses one IPsec encapsulation on each of two configured transport interfaces.

Gi1 is the internet-facing port, addressed 203.0.113.10/30. Gi2 is the MPLS-facing port, addressed 172.16.1.2/30. Both belong to BR-01, whose system IP is 10.255.2.1. The colour distinguishes the attachments; IPsec identifies the encapsulation used in this lab.

The three parts of a TLOC

So BR-01's two TLOCs are (10.255.2.1, mpls, ipsec) and (10.255.2.1, biz-internet, ipsec). Each one also carries attributes that other routers need: local/private and mapped/public endpoint addresses and ports, preference, weight and encryption information. Here private/public are field names: without NAT, their values can be the same. Public IP in a display does not prove an address is globally routable. These ride inside the TLOC route that the router advertises.

The tuple identifies the TLOC; endpoint attributes describe how to reach it. A changed NAT mapping need not change the system-IP/colour/encapsulation tuple, but peers still need the updated mapping and a permitted path. A colour change does change the tuple. The two-TLOC count is this lab’s assumption, not a universal count of physical cables: additional encapsulations and specialised transport designs need their own accounting.

From interface to tunnel

1. Two transport interfaces, two TLOCs. With one IPsec encapsulation per enabled transport here, the two tuples are (10.255.2.1, mpls, ipsec) and (10.255.2.1, biz-internet, ipsec).
2. BR-01 advertises them. It sends both TLOC routes to CTRL-01 over its secure control connection. TLOC routes are OMP routes, covered in a later lesson.
3. The Controller distributes them. HUB-01 learns BR-01's TLOCs and BR-01 learns HUB-01's, subject to any control policy.
4. Tunnels form between TLOC pairs. Eligible, reachable endpoint pairs can build IPsec tunnels, with BFD (Bidirectional Forwarding Detection) monitoring those data paths. A learned TLOC alone does not guarantee a working tunnel. The Controller is not in this path.

Colours

A colour is one of a fixed set of names. They fall into two groups, and the group decides which of a router's addresses other routers use to reach it.

A colour is only a label. It does not describe an IP subnet, and the fabric does not check that a transport called mpls really is MPLS. Choose colours that match how the transport behaves (is it behind NAT?) and that your policies can use, such as preferring mpls for voice.

Endpoint selection also has same-site and carrier-setting cases; colour alone is not a complete NAT design. For this lesson, the branch and hub have different site IDs and no NAT on the shown transports. Verify actual private/public fields and the BFD destination rather than guessing from the word public.

What restrict changes

Without restrict, colour mismatch alone does not exclude a candidate pair. Reachability, encapsulation, topology and other policy still apply. Adding restrict to a tunnel interface limits that TLOC to tunnels with TLOCs of the same colour. It is the usual way to keep a private MPLS transport from carrying tunnels to an internet-only site's TLOCs, and to stop a pointless number of tunnels from forming.

The solid paths join matching colours. The left diagram’s dashed paths are additional mixed-colour candidates; on the right they are excluded by MPLS restrict. The circles represent TLOC endpoints, not extra routers. These are eligibility diagrams, not measured tunnel states.

The settings that define a TLOC

The system IP and site ID belong to the router; the tunnel interface lines give each transport its colour and encapsulation. Changing or removing the transport’s SD-WAN configuration disrupts its TLOC and dependent paths; do not use removal as a live troubleshooting shortcut. In a Manager-managed deployment, change the approved template/configuration group rather than assuming direct CLI edits will persist.

Checking what the fabric sees

BR-01#show sdwan omp tlocs
TLOC                                  PUBLIC IP      PUBLIC PORT  PREF  WEIGHT  STATUS
10.255.2.1   mpls          ipsec     172.16.1.2     12346        0     1       C,Red,R
10.255.2.1   biz-internet  ipsec     203.0.113.10   12346        0     1       C,Red,R
10.255.1.1   mpls          ipsec     172.16.1.1     12346        0     1       C,I,R
10.255.1.1   biz-internet  ipsec     198.51.100.20  12346        0     1       C,I,R

BR-01#show sdwan bfd sessions
SYSTEM IP    SITE  STATE  SOURCE COLOR  REMOTE COLOR  SOURCE IP     DST PUBLIC IP  PORT   ENCAP  MULT  INTERVAL  UPTIME
10.255.1.1   10    up     mpls          mpls          172.16.1.2    172.16.1.1     12346  ipsec  7     1000      2:01:10:05
10.255.1.1   10    up     biz-internet  biz-internet  203.0.113.10  198.51.100.20  12346  ipsec  7     1000      2:01:10:02

What has to be true before a tunnel comes up

1. The transport interface works. It is up, has an address and a route to the remote transport address in VPN 0. Without this, nothing above it can work.
2. The router has control connections. Normal TLOC advertisement uses OMP over Controller connections. During control loss, previously learned information may be retained according to release and graceful-restart settings; inspect current state instead of assuming immediate deletion.
3. The remote TLOC is known and allowed. The colours are compatible (restrict), and no control policy hides the TLOC from this router.
4. IPsec and BFD come up. NAT, a firewall or an MTU problem on the transport can block the tunnel packets even when everything else looks right.
5. The TLOC is resolved when a route needs it. A route whose next hop is a TLOC with no working tunnel is shown as unresolved and is not used.

Mistakes that cost an afternoon

• Treating the system IP as an interface address and looking for it in the underlay routing table. It is a fabric identity, not a transport address.
• Reading a colour as a property of the link. Two branches that call the same kind of line by different colours will not reach each other if restrict is set.
• Treating a product of TLOC counts as a measured tunnel count. It is only a candidate-pair upper bound in this simple two-site model; reachability, policy, restrict and deployment features can reduce it.
• Changing a colour on a live router without a plan: it is a different TLOC, so tunnels and any policy naming the old colour change with it.

Verify identity before changing policy

Record both tuples and the two same-colour BFD sessions. In an isolated lab with an approved fault, compare the same remote tuple before and after restoring a missing endpoint route or the specific filtering rule that was changed. Keep restrict and unrelated security rules in place. Recovery is evidence only after BFD returns and the intended service route and a permitted application work in both directions.

If a mapping or transport endpoint changes, recheck the advertised address/port and observed BFD destination. If a colour changes, the old and new tuples are different identities; review policy references and return the approved configuration through Manager. Do not remove tunnel configuration or clear every control peer simply to refresh the display.

Technical references: Cisco IOS XE 17.x TLOC guide and Cisco Catalyst SD-WAN design guide. The figures, configurations and output are authored teaching examples, not device captures.

Test yourself on TLOCs