SD-WAN Fundamentals and Solution Architecture
What this domain covers
The SD-WAN Fundamentals and Solution Architecture domain tests whether you can explain why an SD-WAN overlay exists, how ExtremeCloud SD-WAN separates management, control, and data planes, and where its components sit. Expect questions on sites, WAN links, overlay tunnels, application-aware path selection, and high availability.
Core architecture
- Orchestrator (management plane): cloud-hosted, multi-tenant portal that holds configuration, pushes policies, and collects telemetry. It is not normally in the forwarding path.
- SD-WAN Edge (data plane): physical or virtual appliance at a branch or data center. It terminates WAN links, builds overlay tunnels, applies QoS, and forwards traffic.
- Optional gateway: provides aggregation or cloud breakout for sites; traffic does not have to traverse a gateway unless the design requires it.
- Underlay vs overlay: the underlay is the carrier network (MPLS, broadband, LTE/5G). The overlay is the encrypted tunnel mesh over those links. Routing chooses an underlay next hop; SD-WAN policy chooses which overlay path an application uses.
- Topology: hub-and-spoke, full mesh, or partial mesh. A site can have multiple edges for HA and multiple WAN links per edge.
Application intent
Applications and application groups are matched by policy. A business intent assigns a performance objective and a path preference. Dynamic WAN Selection continuously measures latency, jitter, loss, and throughput per path, then steers each flow to the path that meets the objective. QoS classes protect real-time traffic; FEC and packet duplication mitigate loss on broadband.
Worked example
A retailer has 40 branches, each with MPLS and broadband. Voice and POS must prefer MPLS but fail over to broadband; guest Wi-Fi must use broadband only. Design: one edge per branch, one at the data center, tunnels over both links. Application workflow 1 matches voice/POS, prefers MPLS, permits broadband fallback when MPLS latency exceeds the threshold. Workflow 2 matches guest, selects broadband, and applies a low-priority QoS class. The orchestrator stores policy and telemetry; edges forward traffic. No cloud gateway is required because branch-to-data-center traffic can traverse the overlay directly.
Traps
Do not say the orchestrator forwards packets. Do not confuse a WAN link with an overlay tunnel. Do not assume SD-WAN is only IPsec VPN; path selection and QoS are the differentiators. Watch for designs that ignore return path or link asymmetry.