Course contents

Unit 3: Underlay, overlay and TLOCLesson 3.3 (3 of 7 in this unit)16 of 27 in the Cisco SD-WAN course

Colour semantics and public/private transport design

Public and private colours, which address peers use for each, how to choose colours for a site, and how colour and restrict interact.

Intermediate · 10 min read

You'll learn to choose a colour for each transport in a small design, predict which address other WAN Edges will use to reach it, and explain how colour choices affect tunnel formation and policy.

Technical definition

Colour (transport colour) is a label chosen from a fixed list and applied to a tunnel interface. It names the transport, tells the fabric whether the transport is private or public, and gives policy a name to refer to. It is one of the three parts of a TLOC.

A colour is a promise about the address

The previous lesson, on TLOC components, introduced colour as one of the three parts of a TLOC. This lesson looks at the design side: why the list of colours is split into two groups, and how to pick one for each link at a site.

What a colour means
What a colour meansA colour describes the kind of transport and how it is reached.Public colourReached through NATInternet-likePrivate colourDirect addressesMPLS-likeor

On small screens, swipe sideways or focus the diagram and use the arrow keys.

It does not describe the speed.

The important idea is that a colour tells other routers which of your addresses to use. A transport such as MPLS is private: the provider routes between sites, no address translation is expected, and peers can use the interface address directly. An internet connection is public: the address on the interface is often private and translated by the ISP or a firewall, so peers must use the address as it appears on the outside. Choosing the wrong group makes peers aim at an address that cannot be reached.

Public and private groups

Public and private groups
Public and private groupsGroup; Colours (examples); Peers try first; Fits. Private: mpls, metro-ethernet, private1 to private6 The interface's private address Carrier networks with no NAT in the path, between sites on the same provider Public: biz-internet, public-internet, lte, 3g, default, custom1 to custom3 The public address after NAT Internet circuits and mobile links, where NAT is likelyGroupColours (examples)Peers try firstFitsPrivatempls, metro-ethernet,private1 to private6The interface's privateaddressCarrier networks with noNAT in the path, betweensites on the sameproviderPublicbiz-internet,public-internet, lte, 3g,default, custom1 tocustom3The public address afterNATInternet circuits andmobile links, where NATis likely

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

If a router has both groups, a peer with a matching group uses the private address and others use the public one. The exact rules for mixed cases, including routers behind the same NAT, are in the NAT lesson and the configuration guide for your release.

Colour groups
Colour groupsColours fall into public and private groups.Publicdefault, biz-internet, public-internet, lte, 3g, gold, silver and othersPrivatempls, metro-ethernet, private1 to private6

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The group affects connections between TLOCs.

Choosing colours for a site

BR-01 has an MPLS circuit and a business internet line. HUB-01 has the same two. A sensible design uses mpls and biz-internet at both ends. The table shows the questions to ask for each link.

Choosing colours
Choosing coloursChoose by transport, not by provider.Identifyeach transportNameconsistentlyDocumentthe planApplyto templates

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The same transport uses the same colour at every site.
Choosing colours for a site
Choosing colours for a siteQuestion; Why it matters. Is NAT likely between this interface and the rest of the network?: If yes, choose a public colour so peers use the translated address Do two sites share this provider network?: If yes, a private colour lets them connect using interface addresses Will a policy need to name this link?: Give it a colour that no other link on the router shares Should it only connect to the same kind of transport?: If yes, add restrict, so only matching colours form tunnels Is the same transport named differently at other sites?: Use one name per kind of transport across the network, so colours matchQuestionWhy it mattersIs NAT likely between thisinterface and the rest ofthe network?If yes, choose a public colour so peers use the translated addressDo two sites share thisprovider network?If yes, a private colour lets them connect using interface addressesWill a policy need to namethis link?Give it a colour that no other link on the router sharesShould it only connect tothe same kind of transport?If yes, add restrict, so only matching colours form tunnelsIs the same transport nameddifferently at other sites?Use one name per kind of transport across the network, so colours match

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Each item on the left, with what it means on the right.

Colour names are conventions inside your organisation. The fabric does not inspect the link, so a link labelled mpls that is really an internet VPN behind NAT will cause tunnel problems that the label does not reveal.

Colour and restrict together

By default a TLOC can form tunnels with TLOCs of any colour. Restrict limits it to the same colour. In practice, a hub with a private MPLS link and a public internet link often sets restrict on the MPLS side so that internet-only branches do not try to reach it over a transport they do not share. The effect on tunnel counts is worked through in the TLOC lesson.

Restrict
RestrictThe restrict option limits tunnels to TLOCs of the same colour.Without restrictTunnels to other coloursare allowedWith restrictSame colour onlyvs

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Use it to keep MPLS separate from the internet.
sdwan interface GigabitEthernet1 tunnel-interface encapsulation ipsec color biz-internet exit exit interface GigabitEthernet2 tunnel-interface encapsulation ipsec color mpls restrict exit exit

Fragment of an IOS XE SD-WAN configuration for BR-01, shortened: allowed services and other transport settings are left out. The colour is set under the tunnel interface. Most networks set it through a Manager template or configuration group.

Example output written for this lesson, simplified; real output has more fields and a different layout
BR-01#show sdwan control local-properties
system-ip          10.255.2.1
site-id            101
...
INTERFACE        COLOR         PRIVATE IP    PUBLIC IP      STATE
GigabitEthernet1 biz-internet  203.0.113.10  203.0.113.10   up
GigabitEthernet2 mpls          172.16.1.2    172.16.1.2     up
Each tunnel interface is listed with its colour, its private address and the public address the fabric knows for it. On a transport with NAT in the path, the two addresses would differ, and the public one is what public-colour peers aim at. The lines marked with dots stand for fields left out here.

Where colour choices go wrong

  • Putting a private colour on an internet link behind NAT. Peers then try the private address, which is not reachable from outside.
  • Using different names for the same kind of transport at different sites, then setting restrict. The colours no longer match, so the tunnels do not form.
  • Giving both internet links on one router the same colour and then writing a policy that needs to prefer one of them.
  • Changing a colour on a working router. It is a different TLOC, so tunnels and policies that name the old colour change with it.

Learn more: TLOC Components and Transport ReachabilityNAT Traversal, DNS and Firewall DependenciesApplication-Aware Routing

Test yourself on colours

Predict · scenario 1

A branch has an internet line whose interface address is private, translated by the ISP. Which colour group suits it?

Predict · scenario 2

Which statement about colours is correct?

Predict · scenario 3

BR-01 uses mpls with restrict. Another branch calls its MPLS-like circuit private1. Both set restrict. What is the likely result between them?

FAQ

Can I invent my own colour names?
No. Colours come from a fixed list in the software. The list includes generic names (custom1 to custom3, and private1 to private6) so that you can label transports that do not fit the named ones. Check your release for the full list.
Does the colour change how the traffic is carried?
Not by itself. The colour does not add bandwidth or priority. What it changes is whether peers connect to the private or the public address, whether restrict applies, and what policies can match.
Should two internet links from different ISPs have different colours?
Often yes, if policy needs to tell them apart, for example to prefer one for a business application. Two links with the same colour on one router are treated as the same kind of transport, which makes it harder to steer traffic between them.