SD-WAN

Underlay vs overlay separation, intelligent path selection, WAN optimization, and SD-WAN vendor landscape (Cisco Viptela, VMware, Palo Alto).

Overview

Overview SD-WAN (Software-Defined Wide Area Network) decouples network control from physical hardware, enabling centralized management and intelligent traffic routing across multiple WAN transport links (MPLS, broadband internet, LTE/5G). It emerged as enterprises sought to reduce expensive MPLS costs while maintaining application performance and security.

Traditional WAN relied on static routing with MPLS circuits providing guaranteed QoS but at high cost and with slow provisioning lead times (weeks to months). SD-WAN introduces a software overlay that monitors all available transport links in real time and routes application traffic based on policy, measured performance metrics (latency, jitter, packet loss), and application identity.

The architecture separates the underlay (physical transport connections — MPLS, internet, LTE) from the overlay (encrypted tunnels forming a virtual network across all underlay paths). The SD-WAN controller (control plane) pushes policies to edge devices. Edge devices (vEdge, vSmart in Viptela) make local forwarding decisions based on current link quality measurements.

Key capabilities include application-aware routing (recognizing Salesforce, Office 365, Zoom by deep packet inspection), zero-touch provisioning (devices phone home to controller and self-configure), centralized security policy, and direct cloud breakout (sending cloud-destined traffic directly to internet rather than backhauling to data center).

In cloud/SRE contexts, SD-WAN is often the connectivity method used by enterprise branch offices connecting to AWS or Azure via public internet tunnels, with SD-WAN handling failover between MPLS and broadband automatically. Understanding SD-WAN topology is essential when designing hybrid cloud architectures.

Key concepts

Underlay vs Overlay
The underlay is the physical transport: MPLS circuits, broadband internet, LTE/5G. The overlay is the SD-WAN virtual network: encrypted IPsec tunnels built on top of all underlay transports. SD-WAN devices maintain tunnels over every underlay path simultaneously and measure quality on each. Application traffic is steered to the best-performing overlay path dynamically.
Application-Aware Routing
SD-WAN identifies application flows using DPI (Deep Packet Inspection), recognizing thousands of applications by signature (e.g., Zoom, Salesforce, Microsoft Teams). Policies define which applications use which paths. For example, real-time voice/video goes via MPLS if available, while bulk backup traffic uses cheaper broadband.
Zero-Touch Provisioning (ZTP)
SD-WAN edge devices ship to branch offices and self-configure by calling home to a cloud-hosted controller. The controller authenticates the device and pushes the site-specific configuration. This eliminates truck rolls and enables branch deployment without on-site networking expertise.
vSmart Controller
In Cisco Viptela architecture, the vSmart controller is the control plane, distributing routing and policy information to vEdge routers using OMP (Overlay Management Protocol). The vBond orchestrator handles ZTP and facilitates NAT traversal between edge devices. The vManage NMS provides centralized configuration and monitoring.

When to use it

  • Designing hybrid cloud connectivity for enterprise branch offices
  • Replacing expensive MPLS circuits with broadband internet plus SD-WAN
  • Implementing application-aware routing to optimize SaaS application performance
  • Building redundant WAN paths with automatic failover between MPLS and internet
  • Evaluating vendor solutions (Cisco Viptela, VMware SD-WAN, Palo Alto Prisma) for procurement

Interview questions

  • How does SD-WAN handle link failover, and what is the difference between active-active and active-passive WAN configurations?

Sign up free to read the full topic

More Networking topics

Start free on Cariara · Coding problems · System design studio