Learning Objectives

• Understand what SD-WAN is and the problems it solves
• Explain the overlay/underlay architecture with VXLAN
• Compare SD-WAN to traditional MPLS VPN connectivity

Why SD-WAN?

For decades, enterprise WAN architecture was simple: every branch office connects to the data center via a carrier MPLS VPN circuit. The traffic backhauls through the data center for internet access, security inspection, and policy enforcement. This model is reliable, but it is expensive and inflexible. MPLS circuits cost 5-10x more than broadband internet access for the same bandwidth. Adding a new branch takes weeks or months. And all traffic tromboning through a central data center adds latency.

SD-WAN (Software-Defined WAN) replaces this model with an overlay architecture. The enterprise can use any transport — MPLS, broadband, LTE/5G — and the SD-WAN controller dynamically steers traffic across the available transports based on application requirements, link quality, and cost. A voice call goes over MPLS for low jitter, while a cloud backup travels over cheap broadband.

Overlay and Underlay

The SD-WAN architecture separates the network into two layers:

Underlay — The physical or logical transport网络: MPLS circuits, broadband connections, LTE modems. The underlay provides connectivity between SD-WAN edge devices. It does not participate in SD-WAN routing or policy decisions. The carrier network simply forwards IP packets between sites.

Overlay — The virtual network built on top of the underlay. SD-WAN edge devices (at each branch, data center, and cloud) form secure tunnels to each other. The most common tunneling protocol is VXLAN (Virtual Extensible LAN) — originally developed for data center network virtualization and later adopted by SD-WAN solutions.

VXLAN in SD-WAN

VXLAN encapsulates Layer 2 Ethernet frames inside UDP packets, creating a Layer 2 overlay across any IP underlay. Each overlay network is identified by a 24-bit VXLAN Network Identifier (VNI), supporting up to 16 million segments.

The SD-WAN edge device encrypts the VXLAN tunnel (typically with IPsec or DTLS) before sending it over the underlay. This provides transport-independent security — whether the traffic goes over MPLS or the public internet, the data is encrypted end-to-end.

Topology: SD-WAN Overlay/Underlay

Application-Aware Routing

SD-WAN's killer feature is application-aware routing. The controller monitors the quality of each underlay path — latency, jitter, packet loss — and maps applications to the best path. Configuration is policy-driven: "Voice traffic must have under 50 ms latency and under 10 ms jitter; use MPLS primary and broadband failover." "Office 365 traffic can use broadband; route to nearest SaaS POP."

If the primary path degrades (or fails), the SD-WAN edge switches traffic to the best alternative path in sub-second time — no routing protocol convergence needed. This is called forward error correction (FEC) and packet duplication for loss-sensitive traffic, with the ability to retransmit across different paths.

SD-WAN vs MPLS VPN

SD-WAN does not necessarily replace MPLS VPNs — it complements them. Most enterprises deploy a hybrid WAN: MPLS for critical real-time traffic and broadband/LTE for everything else. The SD-WAN overlay ties them together, providing unified policy, zero-touch provisioning, and application-aware routing across all transports. The cost savings are substantial: enterprises typically reduce WAN costs by 40-60% by shifting traffic from expensive MPLS to broadband circuits.

Key Takeaways

• SD-WAN creates a secure overlay across any underlay transport (MPLS, broadband, LTE)
• VXLAN encapsulation creates the overlay; IPsec/DTLS provides transport-independent encryption
• Application-aware routing dynamically steers traffic based on real-time path quality
• Zero-touch provisioning lets the controller configure new branch edges automatically
• SD-WAN typically reduces WAN costs by 40-60% by offloading non-critical traffic to broadband
• Hybrid WAN (MPLS + broadband) remains the most common deployment model