SD-WAN Overlay
SD-WAN Overlay
The SD-WAN overlay is the logical network built on top of the physical underlay. It typically uses tunnels such as VXLAN, IPsec, or GRE to create a virtual mesh between edge devices. You must understand how overlay tunnels are established, how they carry traffic, and how they provide segmentation and security. Arista’s SD-WAN uses VXLAN for overlay encapsulation, with IPsec for encryption when needed. The overlay enables any-to-any connectivity and simplifies policy enforcement.
Key concepts include tunnel endpoints (VTEPs), VNI (VXLAN Network Identifier) for segmentation, and the role of the controller in distributing tunnel keys and policies. Traps often involve confusion between VXLAN and VLAN, or misunderstanding that VXLAN provides Layer 2 over Layer 3, while SD-WAN overlay is often Layer 3. Another trap is assuming overlay tunnels are always encrypted; encryption is optional and depends on configuration. Also, be clear on how overlay tunnels are established: they are dynamically created between edges based on policy, not manually configured in a full mesh.
Worked example / rule of thumb: In a VXLAN overlay, each edge device acts as a VTEP and uses a VNI to identify the segment. Traffic between VTEPs is encapsulated in UDP (port 4789). Remember that the overlay is independent of the underlay IP network; underlay just needs to route packets between VTEP IPs.
Key points:
- Overlay tunnels (VXLAN, IPsec, GRE) provide virtual connectivity over any underlay.
- VXLAN uses VNI for segmentation and VTEPs as tunnel endpoints.
- Overlay tunnels are dynamically established based on policy.
- Encryption is optional and configured separately.
- The overlay is independent of underlay routing; underlay must provide IP reachability between VTEPs.