SD-WAN Concepts

SD-WAN (Software-Defined Wide Area Network) is an architectural approach to WAN design that uses software-defined networking (SDN) principles to manage connectivity between branch offices, data centers, and cloud resources. Traditional WANs rely on dedicated MPLS circuits from a single carrier, with static routing and manual configuration. This model is expensive, inflexible, and poorly suited to cloud-centric traffic patterns. SD-WAN addresses these limitations by:

SD-WAN separates the WAN architecture into two planes:

While SD-WAN implementations vary, common defaults include:

# Configure a transport interface on an edge device
vpn 0
 interface ge0/0
   ip address 10.1.1.1/24
   tunnel-interface
    encapsulation ipsec
    color public-internet
    allow-service all
   exit
  exit

# Define a policy for voice traffic
policy
  voice-traffic
    match application voice
    action accept
     set
      sla-class gold
      preferred-color mpls
     exit
    exit

SD-WAN uses per-flow load balancing based on policies. For example:

When a link degrades beyond SLA thresholds, the edge device dynamically moves flows to another link without dropping sessions (if stateful inspection is maintained). This is called forward error correction (FEC) or packet duplication for critical flows.

SD-WAN edge devices can be shipped to a branch with just power and internet connectivity. On first boot, the device contacts the controller (via a pre-configured URL or DHCP option) and downloads its configuration. This eliminates the need for on-site IT staff during deployment.

SD-WAN often includes:

| Feature | Traditional WAN | SD-WAN | |---------|----------------|--------| | Transport | Single MPLS circuit | Multiple links (MPLS, broadband, LTE) | | Routing | Static or BGP | Dynamic, policy-based, application-aware | | Provisioning | Manual CLI per device | Centralized, automated via controller | | Cost | High per Mbps | Lower cost using broadband | | Resilience | Active/passive failover | Active/active with load balancing | | Cloud Optimization | Poor (hairpin through data center) | Direct cloud access from branch |

Major vendors include: Cisco (Viptela, Meraki), VMware (Velocloud), Fortinet, Silver Peak (Aruba), Versa Networks, and Palo Alto Networks (CloudGenix). The exam does not require vendor-specific knowledge but may test general concepts that apply across implementations.

show omp routes
show ipsec tunnels
show app-route statistics
show sdwan policy

SD-WAN edges continuously probe each tunnel using synthetic traffic (e.g., ICMP echo, UDP jitter). The probes measure:

These measurements are reported to the controller and used to enforce SLA policies.

If the controller fails, the edges continue to forward traffic using the last known policies and routing tables. They cannot receive new policies or topology updates until the controller is restored. However, local link failover decisions (based on SLA monitoring) still function because edges monitor links independently.

SD-WAN optimizes cloud access by:

Despite claims, SD-WAN does not always replace MPLS. Many enterprises keep a low-bandwidth MPLS link for critical voice and real-time traffic while using broadband for bulk data. SD-WAN provides the intelligence to use both efficiently.

A national retailer had 500 stores each connected via a single MPLS circuit (T1 or Ethernet) back to the data center. As the company adopted cloud-based POS systems and Office 365, the MPLS links became congested, and backhauling internet traffic caused poor performance. They deployed SD-WAN (VMware Velocloud) with dual WAN links at each store: a primary MPLS (10 Mbps) and a secondary broadband (50 Mbps). Policies were set to route real-time credit card processing over MPLS (low latency) and bulk inventory sync over broadband. Direct Internet Breakout (DIB) was enabled for Office 365, allowing branch users to access the cloud directly. The result: 40% cost savings by reducing MPLS bandwidth, improved Office 365 performance, and centralized management via the cloud-based orchestrator. A common misconfiguration was setting the SLA thresholds too low (e.g., 10ms latency), causing constant flapping between links. Best practice is to set thresholds based on business tolerance, typically 100-150ms latency and 1-2% loss.

A multinational company with data centers in NY, London, and Singapore was migrating workloads to AWS and Azure. Traditional MPLS was expensive and slow to provision for cloud connectivity. They deployed Cisco SD-WAN with virtual edges in each cloud VPC. The SD-WAN controller (vManage) was hosted in AWS. Policies directed traffic between data centers and cloud VPCs over encrypted tunnels, with dynamic failover. For example, traffic from London to AWS Ireland used the lowest-latency path (MPLS or broadband). The controller provided a single dashboard for monitoring all sites and cloud endpoints. A challenge was integrating with existing BGP routing from the MPLS provider; they used route redistribution between OMP and BGP. The key takeaway: SD-WAN enables a 'cloud-first' WAN where branches connect directly to cloud providers without backhauling through a data center.

A hospital network needed to connect clinics while ensuring HIPAA compliance and high availability for telemedicine. They used Fortinet SD-WAN with built-in Next-Generation Firewall (NGFW) and IPS. Each clinic had dual 4G LTE and broadband links. Policies ensured that all patient data (EHR) was encrypted end-to-end and routed over the most reliable link (LTE). Telemedicine video traffic was duplicated across both links for zero packet loss. The SD-WAN controller provided compliance reports showing encryption status and link utilization. A frequent problem was that LTE data caps were exceeded because backup traffic was not prioritized; they implemented policy to send large file transfers only over broadband. This scenario highlights how SD-WAN can enforce security policies while optimizing for application needs.