Understanding SD-WAN Overlay and Underlay Networks

Understanding SD-WAN Overlay and Underlay Networks

SD-WAN has changed the way organizations manage their wide area networks. At the heart of this technology are two concepts that every network professional should understand clearly — the overlay network and the underlay network. If you are new to SD-WAN or planning to build your skills in this area, exploring a structured sd wan course from PyNetLabs can help you get a strong grip on both concepts from the ground up.

These two layers work together, but they serve completely different purposes. Confusing them or ignoring one over the other leads to poor network design decisions. This article explains both in simple terms with real context.

What is the Underlay Network

The underlay network is the physical foundation of any SD-WAN deployment. It includes the actual routers, switches, cables, fiber links, MPLS circuits, broadband connections, and LTE or 5G links that carry data from one point to another. Think of the underlay as the roads on which traffic physically travels.

When a company connects its branch offices to the data center, the underlay is made up of the actual internet service provider connections and transport links. These connections could be MPLS, broadband, or a mix of both. The underlay does not have intelligence about application traffic. It simply provides the raw connectivity between sites.

The quality of the underlay directly affects how well the overlay performs. If the underlay has high latency or packet loss, the SD-WAN overlay has to work harder to compensate. This is why organizations often use multiple underlay transports to add redundancy and improve performance.

What is the Overlay Network

The overlay network sits on top of the underlay. It is a virtual network created by SD-WAN software that builds secure tunnels between SD-WAN edge devices. These tunnels are usually built using protocols like IPsec or GRE. The overlay does not depend on the physical path. It simply uses the underlay as its transport.

What makes the overlay powerful is its intelligence. The SD-WAN controller can measure the health of each underlay path and dynamically choose the best path for each type of traffic. For example, a real-time video call might be routed over a low-latency broadband link, while bulk file transfers go over a cheaper MPLS link. The overlay handles all of this automatically based on policies you define.

A simple way to visualize this: the underlay is the physical highway system, and the overlay is the GPS navigation that picks the best route at any given time.

How Overlay and Underlay Work Together

The overlay depends entirely on the underlay for actual data transport. Without a working underlay, the overlay tunnels cannot be established. However, the overlay gives SD-WAN its defining characteristics — centralized management, application awareness, and dynamic path selection.

In a typical SD-WAN setup, each branch has an SD-WAN edge device. This device connects to the underlay transports available at that site, such as broadband and MPLS. Over these transports, it builds encrypted overlay tunnels to the hub site or data center. The SD-WAN controller monitors the performance of these tunnels in real time and steers application traffic across the most suitable path.