highlights and lowlights of the daily business of network engineers

Download als PDF File

Purpose

This note describes the conceptual structure of overlay/underlay, the available network topology models, VPN isolation, routing protocols, and CPE deployment modes in Huawei SD-WAN.

Overlay vs. Underlay

Underlay Network

The underlay network is the physical network infrastructure on which the overlay is built.

• Consists of physical devices: switches, routers, firewalls, load balancers
• Responsible for IP connectivity between sites (L2 or L3)
• Underlay routing protocols: OSPF, IS-IS within an AS; BGP between ASes
• MPLS-based networks also belong to the underlay
• WAN types in underlay: MPLS, Internet, LTE/5G

Limitations of traditional underlay networks:

• Hardware-based forwarding strongly tied to transmission paths
• Configuration changes required when services change
• No security guarantee for Internet-based communication
• No on-demand network slicing
• Complex multi-path forwarding

Overlay Network

The overlay network is a logical network built on top of the underlay.

• Devices are connected via logical links, independent of the physical path
• Tunnels are established between overlay endpoints (e.g., IPsec or GRE over IPsec)
• The tunnel encapsulates the original IP packet with a new IP header + tunnel header
• The overlay network is transparent to the underlay

SD-WAN EVPN

EVPN (Ethernet VPN) is the core control-plane technology of the SD-WAN overlay.

• Extension of BGP for distributing MAC and IP routing information on the control plane (not the data plane)
• Resolves the limitations of DSVPN, which depended on VPN instances for tunnel establishment
• NHRP protocol is no longer required
• BGP peer relationships are based on endpoints, not links
• Edge sites only need to establish IBGP peer relationships with their RRs — no full-mesh between all edges
• Keys are distributed centrally (no per-tunnel IKE negotiation required)
• Control node and data node are decoupled: routing policies control the topology

Sites and the RR Concept

Site Types

Samuel Heinrich

Senior Network Engineer at Selution AG (Switzerland)

Arbeitet in Raum Basel (Switzerland) als Senior Network Engineer mit über 15 Jahren Erfahrung im Bereich Netzwerk