ExtremeCloud SD-WAN key terms

The physical or provider transport (MPLS, internet, LTE) that carries encrypted tunnels between sites. Its paths, latency, and packet loss determine what the overlay can deliver, so SD-WAN monitoring usually reports underlay health per WAN link.

An encrypted logical path built between SD-WAN devices across the underlay, carrying site-to-site traffic independent of the physical provider. Tunnels are established automatically during provisioning and are the unit that policies and path selection act on.

A design where branch sites connect only to central hub devices, and spoke-to-spoke traffic transits a hub. It simplifies policy and security enforcement but adds latency and hub bandwidth cost compared with direct branch paths.

A design in which sites build tunnels directly with one another, so branch-to-branch traffic does not hairpin through a data center. Full mesh scales poorly; partial or dynamic mesh is common in SD-WAN deployments.

A site, usually a data center or regional aggregation point, that concentrates connectivity for spokes and often hosts shared services and security inspection. Hub capacity and redundancy are common design constraints in SD-WAN architectures.

A branch or edge site that connects into the SD-WAN fabric, typically through one or more local WAN links. Spokes usually depend on hubs or direct mesh tunnels for reachability to other sites and centralized services.

A single physical or logical uplink at a site, such as a broadband circuit or an MPLS port, with its own addressing, bandwidth, and SLA characteristics. SD-WAN devices monitor each link separately to steer traffic.

The standard suite used to encrypt and authenticate SD-WAN overlay tunnels, providing confidentiality and integrity for traffic crossing untrusted transports. Tunnel parameters such as proposals and keys must match on both peers for the tunnel to come up.

Techniques that let IPsec tunnels establish and stay up when devices sit behind NAT, typically by encapsulating ESP in UDP. Without it, tunnels between internet-connected branches frequently fail to negotiate.

A deployment method where a new device contacts a cloud or on-premises controller, authenticates, and downloads its configuration without manual CLI setup. It reduces branch rollout time and errors but depends on working DHCP, DNS, and outbound internet access.

The management component that stores device and policy configuration, orchestrates tunnel setup, and pushes changes to appliances. Its reachability and certificate trust are prerequisites for devices to be provisioned or updated.

The layer that coordinates configuration and policy across controllers and devices, presenting a single management view. In hierarchical SD-WAN designs it distributes intent downward rather than requiring per-device configuration.

A reusable template of site settings, interface roles, and tunnel parameters applied to devices during provisioning. Profiles keep branch rollouts consistent and let later changes be applied to many devices at once.

A stored set of device or interface settings applied to one or more appliances, often with variables for site-specific values. Templates reduce drift but must be re-applied or reconciled when devices are changed locally.

The divergence between the intended configuration held by the management system and what is actually running on a device, often caused by local CLI edits. Drift can silently break policies or tunnels, so audits and re-synchronization are routine operational tasks.

Preparing and validating a device, including firmware and basic connectivity, before it is shipped or installed at a site. Staging shortens on-site time but adds logistics and requires the staged configuration to match the final site.

The process of moving devices to a newer software release, ideally coordinated so tunnels and policies remain compatible during the transition. Upgrades should be scheduled with rollback plans and checked against release notes for behavior changes.

A design in which redundant devices, links, or controllers keep service running when one component fails. Failover behavior, including how quickly tunnels and sessions recover, is a key thing to verify during testing.

A first-hop redundancy protocol in which routers share a virtual IP and one assumes the master role. In SD-WAN it is often used to give LAN hosts a resilient default gateway across redundant appliances.

A logical network segment, defined by policy, that groups sites and applications with shared reachability and treatment. Overlays let one physical fabric carry separate voice, guest, and corporate topologies with different paths and security.

An isolated logical partition of the SD-WAN fabric, separating traffic such as guest or PCI zones from corporate traffic. Segmentation limits reachability and blast radius but requires consistent VLAN-to-segment mapping at each site.

A rule set that matches traffic by criteria such as application, source, or destination and applies an action like steering, prioritization, or drop. Policies are evaluated in order, so precedence and shadowing must be checked when troubleshooting.

Classifying flows by signature, address, or port so policies can treat each application differently. Accurate identification matters because misclassified traffic receives the wrong path or priority, which is a frequent support case.

Directing flows onto a chosen WAN link or tunnel based on policy and current path quality. Steering decisions may be static per application or change dynamically when SLA thresholds are breached.

Continuously measuring candidate paths and moving eligible traffic to the one that best meets policy requirements such as latency or loss. It improves resilience on internet links but only works for traffic the policy marks as movable.

A defined threshold for path quality, such as maximum latency, jitter, or loss, that a link must meet to carry a given class of traffic. Policies reference SLAs to decide when traffic should move to another path.

Active probing of each WAN link, often with synthetic packets to peers or controllers, to measure delay, jitter, and loss. These metrics feed path selection and dashboards, so probe misconfiguration produces misleading health data.

Classification, queuing, and shaping of traffic so latency-sensitive applications are protected during congestion. On SD-WAN devices QoS must be applied consistently on LAN and WAN interfaces and aligned with provider markings.

A method such as OSPF or BGP by which devices learn and advertise reachable networks. SD-WAN devices typically peer with the LAN and may redistribute overlay prefixes, so route exchange is central to site reachability.

A path-vector routing protocol widely used to exchange routes between SD-WAN edges, hubs, and service providers. Attributes such as local preference and AS path control selection, and misconfigured peering is a common outage cause.

A link-state interior gateway protocol commonly used inside a site or between an SD-WAN appliance and the LAN core. Areas and metric costs determine which path traffic takes before it enters the overlay.

A manually configured path to a destination network, used when dynamic routing is unnecessary or as a backup. Static routes do not adapt to failures unless tracked, so they are a frequent cause of black-holing after a link goes down.

Injecting routes learned from one protocol into another, for example placing overlay prefixes into OSPF or LAN routes into BGP. Without filtering it can create loops or leak unintended networks, so it needs explicit control.

Advertising a single aggregate prefix instead of many specific ones to reduce table size and instability. It must be planned so that less-specific summaries do not black-hole traffic when a component site fails.

The address range assigned to a site's overlay interfaces, which other sites reach through tunnels rather than the underlay. These prefixes are typically redistributed into LAN routing so local hosts can reach remote sites.

Translation of addresses or ports at a boundary, often used to allow many LAN hosts to share one WAN address. It complicates tunnel negotiation and inbound access, so placement relative to the SD-WAN device must be deliberate.

Recording traffic on an interface for offline analysis of headers and payloads. It is the decisive tool when logs and counters disagree, for example to prove whether traffic is leaving on the expected WAN link.

A standard protocol for shipping device event messages to a central collector. Centralized logs help correlate tunnel flaps or policy changes across sites, but clock synchronization is needed for accurate ordering.

The protocol that synchronizes device clocks to a reference time source. Consistent time is essential for correlating logs and alarms across controllers and appliances during incident analysis.

The structured process of isolating a fault by layer, from physical link and underlay reachability through tunnel state to policy and routing. Comparing what the management system reports with on-device counters usually reveals where reality diverges.