SD-WAN routing logic

In this guide, we have recommended to configure SD-WAN as a default route. Let us see why it helps making the configuration generic and what alternatives you may want to consider.

The SD-WAN / SD-Branch Reference Architecture for MSSPs describes the interaction between SD-WAN and the traditional routing subsystem. Let us recap the two main rules that apply by default:

1. SD-WAN Rules are matched only if the best route to the destination points to SD-WAN.
2. SD-WAN Member is selected only if it has a valid route to the destination (not necessarily the best route).

Both these rules can be disabled by using advanced options in SD-WAN rules:

• Rule #1 is controlled by the advanced option default (corresponding to CLI set default enable)
• Rule #2 is controlled by the advanced option gateway (corresponding to CLI set gateway enable)

According to rule #2, by default, SD-WAN rules select a member only if there is a valid route to destination via that member. For Edge-to-Hub and Edge-to-Edge traffic, this valid route will normally be learned via BGP. However, for Edge-to-Internet traffic, no specific route is learned. Hence, for example, in order for the RIA rule to work as desired in our examples, it is required to have a default gateway via T_MPLS overlay. Otherwise the traffic destined to the Internet would never be backhauled via T_MPLS.

Configuring SD-WAN to act as a default route eliminates the need to adjust the routing configuration when your SD-WAN rules change. It ensures that there always be a valid route to any destination via any SD-WAN member that is selected by the SD-WAN rules. Thus, SD-WAN rules become fully responsible for traffic steering, in accordance with the Five-Pillar Design Approach.

It is worth noting a few alternatives to this approach:

• Using the default route via underlay
• Disabling route check in SD-WAN rules
• Excluding Traffic from SD-WAN