Course contents

Unit 1: WAN and SD-WAN fundamentalsLesson 1.3 (3 of 7 in this unit)3 of 27 in the Cisco SD-WAN course

SD-WAN: overlay, centralized policy and transport independence

What SD-WAN is: an encrypted overlay over any transport, central policy for every edge, and what it does not change.

Intermediate · 10 min read

You'll learn to define SD-WAN, tell the overlay from the underlay, explain what centralised policy and transport independence mean, and say what SD-WAN does not change.

Technical definition

SD-WAN (software-defined wide area network) is a WAN design in which edge routers build an encrypted overlay of tunnels across whatever transports are available, and a central set of controllers distributes the routes and the policy that the edges follow. Routing and policy decisions are made centrally and carried out at each site.

Two networks, one on top of the other

An SD-WAN has two layers. The underlay is the set of real circuits and routers that move packets between sites: MPLS, broadband, DIA, cellular. The overlay is a second network built on top, made of encrypted tunnels between the SD-WAN edge routers. Applications run across the overlay. The underlay only has to carry the tunnel packets from one edge to another.

Underlay and overlay
Underlay and overlayThe underlay is the physical transport. The overlay is the encrypted network built across it.UnderlayInternet, MPLS, LTEProvides IP reachabilityOverlayEncrypted tunnelsManaged by SD-WANcarries

On small screens, swipe sideways or focus the diagram and use the arrow keys.

SD-WAN manages the overlay and uses whatever underlay is available.

Overlays are not new. IPsec site-to-site VPNs and GRE tunnels are overlays too. What SD-WAN adds is that the overlay is built, routed and controlled automatically from a small set of central components, instead of being configured tunnel by tunnel.

Two networks, one on top of the other
Two networks, one on top of the otherLayer; What lives there; Who runs it. Overlay: Tunnels between edges, the user routes, the policy The enterprise, through the SD-WAN controllers Underlay: The provider circuits and their routing The providers, plus your own simple routing on the edge's transport sideLayerWhat lives thereWho runs itOverlayTunnels between edges, the userroutes, the policyThe enterprise, through the SD-WANcontrollersUnderlayThe provider circuits and theirroutingThe providers, plus your own simplerouting on the edge's transport side

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.
One overlay running over several transports
One overlay running over several transportsThe underlay is the set of ordinary transports, MPLS and the internet, that carry packets between sites. The overlay is a set of encrypted tunnels between the WAN Edge devices BR-01 and HUB-01, built over whichever transports are available. Applications see one network, and the overlay decides which transport to use for each flow.Overlay: encrypted tunnels between WAN EdgesBR-0110.255.2.1HUB-0110.255.1.1tunnel over MPLStunnel over internetUnderlay: the transportsMPLS circuit · broadband internet · 4G or 5GApplications see one network. The overlay picks the transport.

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Because the overlay does not depend on the transport, any circuit can be added or removed without redesigning the network.

Idea 1: transport independence

Because the tunnels run over any IP path, the overlay does not care what the circuit is. An edge with one MPLS line and one internet line forms tunnels across both, and the network sees two ways to reach the same site. The edge needs only an IP address on each transport and a route to the other edges' transport addresses.

Idea 1: transport independence
Idea 1: transport independenceThe overlay works over any transport that gives IP reachability.One overlayMPLSprivate circuitBroadbandpublic internetLTEmobile backup

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The branch can use several at once.
  • A new site can start with whatever circuit is ready first, then add another later, without redesigning anything.
  • An internet circuit stops being only a backup. It can carry real site-to-site traffic, encrypted in the tunnel.
  • Moving a site from one provider to another changes the underlay and leaves the overlay design in place.

Independence has limits. The overlay cannot make a poor circuit good, and it cannot bypass a provider that blocks the tunnel ports. It gives the edge a choice of paths and a way to tell the good ones from the bad ones.

Idea 2: centralised control and policy

In a traditional WAN every router works out its own routes and carries its own policy. In SD-WAN the edges report what they have to central controllers. The controllers decide what each edge should hear and send it back, along with policy such as which traffic may reach which site, or which path an application should prefer.

Idea 2: central control
Idea 2: central controlThe administrator sets policy once and the controllers distribute it.Administratordefines policyManager and ControllerdistributeEdgesapply it

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Devices follow the policy, they do not each need a manual change.
  1. Each edge connects to the controllers and reports its routes and its transport details.
  2. The controllers apply the administrator's intent to what they have learned, and send each edge the routes and policy that edge should use.
  3. The edges build tunnels directly to each other and forward user traffic between themselves. The controllers are not in the data path.

The last point is easy to miss. The controllers hold the plan, but the user traffic flows from edge to edge. That keeps the controllers off the path of every packet and lets one small set of them serve many sites.

Idea 3: path choice by measured quality

Edges send small probe packets through each tunnel and measure loss, delay and jitter. A policy can then say that voice needs a path inside certain limits and send it over whichever tunnel meets them. Where a traditional router sees an interface that is up, an SD-WAN edge sees a tunnel that is performing well or badly. A later lesson in this course covers how that works.

Idea 3: measured quality
Idea 3: measured qualityEdges measure each path and use the result in decisions.Probeeach tunnelMeasureloss, latency, jitterCompareto the SLAChoosea compliant path

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Choice follows measurement, not just the routing table.

What a branch looks like with SD-WAN

Take BR-01 in the course lab, with system IP 10.255.2.1. It has an MPLS circuit and a business internet line. The edge forms tunnels across both to HUB-01 and, where policy allows, directly to other branches. The Controller (formerly vSmart) tells it which prefixes sit behind which sites, and the Manager (formerly vManage) is where the administrator defines the configuration and policy for the whole fabric. Lab names and site IDs here are examples, not requirements.

What SD-WAN does not change

What stays the same
What stays the sameSD-WAN changes how the WAN is run, not the basics.CircuitsStill need to be ordered and monitoredAddressingSites still need a planLAN routingStill runs at each site

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Underlay problems stay underlay problems.
  • It does not remove the underlay. You still buy circuits, and still need working IP connectivity on every transport.
  • It does not remove routing. The edge still connects to the LAN with ordinary routing such as OSPF or BGP, and the overlay has its own routing protocol on top.
  • It does not guarantee quality. It can steer around a bad path, but if every path is bad, the user still has a bad experience.
  • It does not do security on its own. Encryption of the tunnels is built in; firewalling and inspection are separate features you enable and design.

Mistakes when first meeting SD-WAN

  • Saying SD-WAN is the internet replacing MPLS. It is a way of using any transport together. Whether MPLS stays is a business decision.
  • Thinking the controller carries user traffic. It carries control information only.
  • Mixing up overlay and underlay addresses. The tunnel endpoints use underlay addresses; the user prefixes live in the overlay.

Test yourself on the SD-WAN idea

Predict · scenario 1

Which description best fits the overlay in an SD-WAN?

Predict · scenario 2

A branch gains a second line from a different provider. What does transport independence mean for the design?

Predict · scenario 3

In a working SD-WAN, where does user traffic between two branches normally flow?

Predict · scenario 4

An engineer says SD-WAN means the provider circuits no longer matter. What is the best correction?

FAQ

Does SD-WAN replace MPLS?
It can, but it does not have to. SD-WAN treats MPLS as one more transport. Some networks keep MPLS for voice or for sites with no good internet, and add internet circuits beside it. Others retire MPLS. The design allows both.
Is the overlay encrypted?
In Cisco SD-WAN the data plane tunnels between edges are normally IPsec, so traffic crossing any transport is encrypted. Check how your release is configured, because encapsulation is a setting.
If the controllers fail, does the network stop?
Not at once. Edges keep the routes and policy they already hold for a time and continue to forward traffic over existing tunnels. New changes, new sites and some recovery behaviour need the controllers. How long an edge keeps going depends on settings in your release.