SD-WAN Underlay Assessment: Comprehensive Pre-Deployment Guide

Deploying Software-Defined Wide Area Networking (SD-WAN) promises dynamic traffic management, cost savings, and enhanced application performance. However, its success hinges on a solid foundation: the underlay network. This physical infrastructure of links, routers, and carriers forms the backbone over which SD-WAN’s virtual overlay operates. Skipping a comprehensive underlay evaluation can lead to bottlenecks, outages, and suboptimal ROI. In this guide, we explore why and how to rigorously assess your underlay before SD-WAN goes live, drawing on industry best practices to future-proof your network.

Understanding the Underlay-Overlay Dynamic

The underlay network consists of traditional WAN components such as MPLS circuits, broadband internet, LTE/5G, and direct peering links. It handles raw packet transport without awareness of SD-WAN policies. The overlay, powered by SD-WAN controllers, virtualizes tunnels atop this underlay, enabling intelligent path selection based on real-time metrics like jitter, loss, and delay.

A weak underlay undermines overlay intelligence. For instance, if internet links suffer high packet loss, SD-WAN cannot magically compensate; it merely reroutes around known issues. According to Cisco’s documentation, underlay measurement tools like UMTS trace exact tunnel paths hop-by-hop, revealing hidden impairments invisible to standard pings.

• Key Components: Routers, switches, ISP circuits, and physical media (fiber, copper, wireless).
• Common Pitfalls: Oversubscribed links, asymmetric routing, or unmonitored peering points.
• Benefits of Assessment: Identifies capacity gaps early, validates SLA compliance, and baselines performance.

Step-by-Step Underlay Capacity Planning

Begin with bandwidth forecasting. Estimate peak usage per site using application profiles—VoIP demands low latency (<150ms), while video conferencing needs 4-8Mbps per stream. Tools like iPerf or Spirent TestCenter simulate traffic loads to measure throughput.

Account for oversubscription ratios; consumer broadband often hits 4:1 contention. Cisco SD-WAN’s gateway tracking probes next-hops every 10 seconds via ARP, ensuring routes stay viable. Plan for 20-30% headroom to handle bursts.

Measuring Latency and Jitter Precisely

Latency—the round-trip time for packets—directly impacts user experience. SD-WAN thrives on sub-100ms latencies for cloud apps. Use active monitoring with UDP probes to capture one-way delay, as TCP handshakes mask issues.

Jitter, or delay variation, disrupts real-time apps like UCaaS. Thresholds: <30ms for voice, <20ms for video. Broadcom’s AppNeta recommends Layer 7 emulation to mimic user paths, correlating underlay jitter with app response times.

1. Deploy agents at branches and hubs for bidirectional tests.
2. Run 24/7 probes at 1-5 second intervals.
3. Analyze histograms for 95th percentile values.

ThousandEyes integration in Cisco IOS XE (17.6+) provides hop-level visibility, pinpointing ISP handoffs causing spikes.

Packet Loss Detection and Mitigation Strategies

Even 1% loss cascades into TCP retransmits, inflating effective latency by 200-500ms. Assess via sustained high-volume tests; short bursts hide intermittent drops. Fortinet’s SD-WAN service monitors underlay quality with SLA probes.

Mitigate by diversifying paths: dual ISPs per site reduce single-provider failure risk. Enable FEC (Forward Error Correction) on lossy links, though it trades bandwidth for reliability.

• Thresholds: <0.1% for voice/video, <1% for general data.
• Tools: OWAMP/TWAMP for precise loss measurement.

Evaluating Network Reliability and Failover

Downtime costs enterprises $5,600/minute per Gartner. Test failover times—SD-WAN should switch paths in <500ms. Simulate cuts with cable pulls or ACL blocks.

Cisco’s UMTS event-driven monitoring triggers traces on flaps, graphing exact paths. Peering exchanges cut latency by bypassing public internet, ideal for South African firms per Amastelek insights.

Leveraging Advanced Monitoring Tools

Modern SD-WAN demands proactive observability. Cisco SD-WAN Manager configures UMTS intervals for delay/loss collection across all hops. On-demand NETCONF actions probe live paths graphically.

Broadcom advocates AI/ML for anomaly detection in edge telemetry, while Kentik stresses regular testing post-deployment. Combine passive NetFlow with active synthetics for full visibility.

Common Underlay Challenges and Fixes

Asymmetric paths confuse stateful firewalls; enforce symmetric routing via BGP communities. MTU mismatches fragment packets—standardize at 1500 bytes. IPv6 readiness gaps hinder dual-stack overlays.

For hybrid MPLS/Internet, weight paths by SLA: gold for MPLS, bronze for broadband.

Pre-Deployment Testing Checklist

• Site surveys for physical connectivity options.
• ISP SLA validation with speed tests.
• End-to-end path validation to clouds/SaaS.
• Security posture: firewall rules, BGP security.
• Scalability sims for 2x traffic growth.

Post-Assessment Deployment Tips

Baseline metrics pre-go-live, then monitor deltas. Automate alerts for 10% deviation. Schedule quarterly re-assessments as apps evolve.

FAQs

What is an underlay network in SD-WAN?

The physical WAN infrastructure carrying SD-WAN overlay tunnels, including circuits and routers.

Why assess underlay before SD-WAN?

To uncover capacity, performance, and reliability issues that could sabotage overlay benefits.

Best tools for underlay monitoring?

Cisco UMTS, ThousandEyes, AppNeta, and OWAMP/TWAMP probes.

How often to test underlay?

Continuously during deployment, then daily/weekly with alerts.

Can SD-WAN fix bad underlay?

No—SD-WAN optimizes around flaws but cannot create bandwidth or eliminate physics.