network · deep · draft

SD-WAN underlay/overlay

Vendor banner: Cisco Catalyst SD-WAN only. An enterprise WAN overlay that separates transport underlay (VPN 0) from service VPNs, with centralized OMP control, TLOC-colored tunnels, and BFD-aware path selection — not a claim that every vendor’s SD-WAN behaves identically.

In one sentence. Classical WANs couple MPLS/DIA circuit choice tightly to routing and policy; adding Internet transports, cloud on-ramps, and app-aware path selection without an overlay control plane is operationally heavy.

Why it exists

Vendor banner: this page teaches Cisco Catalyst SD-WAN as documented in the Design Guide and OMP/TLOC configuration guides. It does not invent multi-vendor equivalence. The pattern integrates routing, security, centralized policy, and orchestration across transports with clear control vs data plane separation — replacing ad-hoc dual-CE MPLS-only designs when Internet/DIA and cloud on-ramps matter. Cross-link campus fabrics on `/architectures/evpn-vxlan/` and segmentation placement on `/architectures/zero-trust-placement/` when WAN handoff meets fabric policy.

Visual walkthrough

Walkthrough

Control plane over VPN 0

WAN Edge reaches Validator/Controller/Manager over the VPN 0 underlay. Service VPNs do not replace transport reachability.

Step 1 / 3

Vendor banner: Cisco Catalyst SD-WAN roles — Manager (management), Controller (OMP RR / keys), Validator (orchestration). WAN Edge is the site data plane.

Walkthrough

Site-to-site overlay over colored TLOCs

Branch LAN → WAN Edge → IPsec over a TLOC color → remote Edge → DC LAN. TLOC = system-IP + color + encapsulation.

Step 1 / 3

Each transport attachment is a TLOC: system IP + color (e.g. MPLS vs Internet) + encapsulation (IPsec or GRE). OMP uses TLOCs as next hops.

Walkthrough

Transport color failure → alternate TLOC

When one colored transport fails, overlay can move to another TLOC if policy/SLA allows. VPN 0 and BFD health matter.

Step 1 / 3

Steady state: dual colors (MPLS + Internet) with IPsec overlays. Policy may prefer MPLS for the service VPN flow.

Control vs data plane

Control plane

SD-WAN Manager (management), Controllers (OMP route reflection, crypto key reflection for IKE-less data-plane orchestration), and Validator (orchestration / initial auth, NAT traversal assist). WAN Edges hold permanent DTLS/TLS to Controllers; OMP carries prefixes, TLOC next-hops, keys, and policy. Controllers act like BGP route reflectors for the overlay. Cross-vendor OMP equivalents are unknown here.

Data plane

IPsec (or GRE) tunnels between WAN Edges over each transport TLOC. BFD over tunnels measures loss/latency/jitter and detects path failure. Service VPNs carry user traffic; VPN 0 is the transport VPN for underlay reachability to controllers/validators and outer tunnel endpoints; VPN 512 is OOB management (not carried in OMP). Same site-id peers default to no IPsec between them.

Request / packet path

North–south

Branch LAN (service VPN) → local WAN Edge → IPsec overlay over a selected TLOC color → remote WAN Edge → DC/LAN or cloud on-ramp. Underlay VPN 0 must independently reach controllers and tunnel endpoints — service VPN routes do not replace that.

East–west

Site-to-site user traffic stays in service VPNs over the overlay. Path choice follows centralized policy/SLA across colored transports (MPLS, Internet, LTE, etc.). Dual Edges at a site raise availability; single Edge failure isolates that site unless redesigned.

Scaling & math

Design Guide covers architecture and redundancy; max sites, tunnels, and OMP route scale are release- and deployment-model-specific — unknown as a universal table here. OMP configure docs discuss paths-advertised-per-prefix limits and TLOC counts per device — cite those knobs as product capability, not a capacity guarantee for every customer fabric. Transport bandwidth oversubscription is circuit/ISP planning, not an SD-WAN constant.

When it breaks

One colored transport fails; sites may keep forwarding on remaining TLOCs if policy allows.
Cause. MPLS, Internet, or LTE underlay path loss for one color.
Mitigation. Design multi-color TLOCs and SLA/policy failover; verify BFD detects the dead path.
Site offline for overlay user traffic (unless dual Edges).
Cause. Single WAN Edge failure or isolation at the site.
Mitigation. Dual WAN Edges where site availability requires it; treat Edge as a change domain.
New OMP learning impacted; existing data-plane behavior depends on timers/state.
Cause. All Controllers unreachable from WAN Edges.
Mitigation. Redundant Controllers; monitor DTLS/TLS and OMP health separately from forwarding. Exact hold behavior is release-specific → known unknown detail.
Bring-up / orchestration and new device join impaired more than steady-state forwarding.
Cause. Validator unavailable during onboarding or re-orchestration.
Mitigation. Plan Validator redundancy for join/rejoin windows; do not confuse with data-plane TLOC health.
Control connections and tunnel outer reachability fail even if LAN looks healthy.
Cause. VPN 0 underlay routing failure toward controllers, validators, or remote TLOC endpoints.
Mitigation. Troubleshoot VPN 0 independently of service VPNs; restore underlay before chasing OMP policy.

Misconceptions

“All SD-WAN products share this exact Manager/Controller/Validator/OMP model.” — This page is Cisco Catalyst SD-WAN scoped; other vendors differ.
“Service VPN routes replace VPN 0 underlay reachability.” — Design Guide: VPN 0 must route control and outer tunnel endpoints independently.
“Same site-id Edges always build IPsec to each other.” — Default: no IPsec between WAN Edges sharing site-id.

Reference expression

Primary: Cisco Catalyst SD-WAN Design Guide (HTML/PDF), OMP overview, Configure OMP, TLOC chapter. review: draft. When to choose: multi-transport WAN with centralized policy and cloud on-ramps under Cisco Catalyst SD-WAN. When not: single-site LAN with no WAN overlay need; pure CE–PE MPLS L3VPN with no overlay control plane; assuming identical behavior across non-Cisco SD-WAN products.

Standards & sources

cisco-sdwan-design-guide · Architecture, VPN 0/512, BFD, planesPrimary source, retrieved 2026-09-20. Cisco Catalyst SD-WAN Design Guide Cisco Catalyst SD-WAN Design Guide — Architecture, VPN 0/512, BFD, planes
cisco-sdwan-design-guide-pdf · Design Guide PDF companionPrimary source, retrieved 2026-09-20. Cisco Catalyst SD-WAN Design Guide (PDF)Cisco Catalyst SD-WAN Design Guide (PDF) — Design Guide PDF companion
cisco-sdwan-omp · OMP overlay control planePrimary source, retrieved 2026-09-20. Overlay Management Protocol (Cisco Catalyst SD-WAN Routing Configuration Guide)Overlay Management Protocol (Cisco Catalyst SD-WAN Routing Configuration Guide) — OMP overlay control plane
cisco-sdwan-tloc · TLOC system-IP + color + encapsulationPrimary source, retrieved 2026-09-20. TLOC (Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, 17.x)TLOC (Cisco Catalyst SD-WAN Systems and Interfaces Configuration Guide, 17.x) — TLOC system-IP + color + encapsulation
cisco-sdwan-configure-omp · OMP path/TLOC advertisement optionsPrimary source, retrieved 2026-09-20. Configure OMP (Cisco Catalyst SD-WAN Routing Configuration Guide)Configure OMP (Cisco Catalyst SD-WAN Routing Configuration Guide) — OMP path/TLOC advertisement options

Known unknowns

Exact Controller hold / data-plane persistence timers when all Controllers are unreachable are release-specific.
Max sites, tunnels, and OMP route scale tables are deployment-model-specific — not tabulated as universal here.
Non-Cisco SD-WAN control/data-plane models are out of scope on this page.

Check yourself

What is VPN 0 used for in Cisco Catalyst SD-WAN?
- Only user LAN prefixes in OMP
- Transport underlay: WAN interfaces, DTLS/TLS to control components, tunnel outer reachability
- OOB management carried in OMP
- Only LTE APN credentials
Answer: Transport underlay: WAN interfaces, DTLS/TLS to control components, tunnel outer reachability. Design Guide: VPN 0 is the transport VPN.
A TLOC is uniquely identified by which triple?
- VLAN + VRF + STP priority
- System IP + color + encapsulation
- ASN + community + MED only
- MAC + VNI + ESI
Answer: System IP + color + encapsulation. TLOC chapter: system-IP, color, encapsulation.
What protocol carries overlay prefixes and TLOC next-hops to Controllers?
- STP
- OMP
- VXLAN alone without control plane
- DNS anycast
Answer: OMP. OMP is the overlay control plane.
When is this pattern a poor fit?
- Multi-transport WAN needing centralized policy under Catalyst SD-WAN
- Single-site LAN with no WAN overlay need, or assuming multi-vendor identical behavior
- Cloud on-ramp with dual colors
- Branch dual-Edge HA designs
Answer: Single-site LAN with no WAN overlay need, or assuming multi-vendor identical behavior. When-not: no WAN overlay need; no cross-vendor equivalence from Cisco CVD alone.
VPN 512 is…
- The default service VPN for all user traffic
- OOB management not carried in OMP
- The only color for Internet TLOCs
- A VXLAN VNI
Answer: OOB management not carried in OMP. Design Guide: VPN 512 OOB management.
BFD over tunnels is primarily used to…
- Replace OMP entirely
- Measure loss/latency/jitter and detect path failure for overlay tunnels
- Assign system IP addresses
- Terminate VXLAN on spines
Answer: Measure loss/latency/jitter and detect path failure for overlay tunnels. Design Guide: BFD over tunnels for path quality/failure.
Default behavior for WAN Edges sharing the same site-id?
- Mandatory full-mesh IPsec between them
- No IPsec between them by default
- They become Controllers
- They disable VPN 0
Answer: No IPsec between them by default. Design Guide: same site-id peers default no IPsec.
Where should you go for non-Cisco SD-WAN product internals?
- Assume identical to this page
- Cite that vendor’s primary docs — unknown/out of scope here
- Invent a generic SD-WAN UML
- Use only STP textbooks
Answer: Cite that vendor’s primary docs — unknown/out of scope here. Vendor banner: Cisco-scoped; other products need their own sources.