Arista ACE Specialist - WAN Routing cheat sheet

Underlay vs overlay: the underlay provides IP reachability (physical links, ISP, MPLS); the overlay builds tunnels (VXLAN, IPsec, GRE) over that reachability to carry tenant traffic.

SD-WAN control plane is separated from the data plane: a controller distributes policy and topology, while edge devices forward traffic directly, often without hairpinning through a hub.

Hub-and-spoke vs full mesh: hub-and-spoke forces inter-branch traffic through a hub; dynamic full mesh lets branch edges build direct tunnels when policy permits.

Transport independence: an edge can attach to multiple WAN transports (broadband, LTE/5G, MPLS, dedicated internet) and select per-flow transport based on policy.

Overlay tunnel types: IPsec for encryption over untrusted internet, GRE for simple encapsulation, VXLAN for L2/L3 segmentation with a VNI identifying the segment.

Zero-touch provisioning relies on a bootstrap mechanism (DHCP, cloud redirect, or USB) so an edge can authenticate to the controller and pull its configuration without manual setup.

Failure-domain rule: control-plane loss should not stop forwarding - edges keep existing tunnels and cached policy if the controller is unreachable.

MTU budget: overlay headers (IPsec/GRE/VXLAN) reduce usable payload, so underlay MTU must exceed overlay MTU by the encapsulation overhead to avoid fragmentation.

Longest-prefix match wins before any other comparison: a /24 route is preferred over a /16 regardless of protocol or metric.

Administrative distance breaks ties between sources for the same prefix: connected is most trusted, then static, then eBGP, then an IGP such as OSPF, then iBGP.

eBGP prefers the highest LOCAL_PREF, then the shortest AS_PATH, then lowest origin type (IGP < EGP < incomplete), then lowest MED.

iBGP requires either a full mesh, route reflectors, or confederation because it does not re-advertise routes learned from one peer to another by default.

OSPF uses cost = reference bandwidth / interface bandwidth; lower cost is preferred, and all areas must touch area 0 through an ABAC or virtual link.

Path selection in SD-WAN overlays adds policy criteria beyond IGP metrics: per-application SLA (latency, jitter, loss), preferred transport, and active/standby or active/active failover.

BFD provides sub-second failure detection independent of routing protocol timers; it accelerates convergence when an underlay path degrades.

Route summarization reduces table size but hides more-specific reachability; a summary is only advertised when at least one component route is present (unless unconditionally configured).

Overlay tunnels are identified by endpoint pair and transport; each edge maintains tunnel state per remote edge per transport path.

Encapsulation overhead example: IPsec tunnel mode adds roughly 50-70 bytes depending on cipher and mode, so plan overlay MTU accordingly.

VXLAN uses a 24-bit VNI, giving about 16 million segments; the outer header is UDP port 4789 by default.

Tunnel establishment typically uses a control protocol for key exchange and peer discovery, then a data plane that encrypts and forwards; keys rotate on a configured interval.

Dynamic path selection: when the primary transport violates the SLA for a flow, traffic is moved to a secondary transport and can return when the primary recovers.

NAT traversal: when an edge sits behind NAT, the overlay uses the controller or a relay to learn the public endpoint, and keepalives maintain the mapping.

Overlay segmentation: VRFs or VNIs isolate tenant routing tables so overlapping address space can coexist across segments.

Tunnel scaling: full-mesh tunnel count grows as n(n-1)/2, so large deployments use hubs, route reflectors, or hub-and-spoke overlays to bound state.

Policy is evaluated top-down; the first matching rule wins, so order rules from most specific to most general.

Match criteria commonly include application ID, source/destination prefix, DSCP, user/group, and transport; action sets include permit, deny, steer to transport, or apply QoS.

SLA-based steering compares measured latency, jitter, and loss against a threshold profile; a flow is moved only when the active path fails the profile.

DSCP marking carries intent across the WAN; map application classes to DSCP at the edge and honor those markings in the underlay QoS policy.

Direct internet access steers trusted SaaS traffic locally at the branch instead of backhauling to a hub, reducing latency and hub load.

Breakout vs backhaul is a policy decision: security-inspected traffic may still need to traverse a security stack, while low-risk traffic can break out locally.

Failover modes: active/standby keeps one path hot, active/active load-shares; per-flow vs per-packet steering affects reordering risk and must match application tolerance.

Policy simulation or dry-run tooling lets you validate rule order and match counts before committing changes to production edges.

Troubleshooting order: verify underlay reachability (ping/traceroute), then tunnel state, then routing table, then policy match, then application performance.

Key health signals: tunnel up/down, BFD state, per-path latency/jitter/loss, control-plane connectivity, and CPU/memory on edges.

Flow-level telemetry (IPFIX or equivalent) shows which policy action and transport a flow used, which is the fastest way to confirm steering behavior.

Log correlation: controller events, edge syslog, and flow records share timestamps; align clocks with NTP before correlating.

Common overlay failure causes: MTU/fragmentation, NAT mapping expiry, mismatched keys or certificates, and asymmetric underlay routing.

Packet capture points: at the LAN interface, the WAN interface pre-encapsulation, and post-encapsulation; comparing them isolates where a drop occurs.

Change safety: stage policy on a pilot edge, verify flow behavior and SLA metrics, then roll out; keep a rollback configuration ready.

SLA violation alarms should be tied to the measurement window and threshold; a single spike differs from sustained degradation and warrants different responses.