Fortinet white logo
Fortinet white logo

SD-WAN / SD-Branch Architecture for MSSPs

Transport groups

Transport groups

Consider an SD-WAN topology where the SD-WAN sites have a mixture of Internet and MPLS connections:

  • The Internet and the MPLS transports are physically separate from each other. We often call them segregated transports.

  • All the Internet connections, on the other hand, are naturally interconnected by the public Internet, even if they are of different types (for example, a broadband Internet connection, a backup LTE connection, and so on). Hence, we often call them interconnected transports.

We can make the following observation: a Spoke cannot build an ADVPN shortcut across two segregated transports, but it can do so across the interconnected transports. For example, a Spoke cannot build an ADVPN shortcut from its Internet WAN link to another Spoke's MPLS WAN link or the reverse. But it can easily build an ADVPN shortcut from its broadband Internet link to another Spoke's LTE link.

Note

In the Additional topics section, we discuss other differences between segregated and interconnected transports.

To express this distinction, ADVPN 2.0 introduces a concept of a transport group. Each set of interconnected transports forms a separate transport group. When a user configures an SD-WAN/ADVPN 2.0 Member, it specifies its transport group ID, so that any two members corresponding to segregated transports will be assigned to different transport groups. This information is exchanged as part of the Discovery process, allowing the originating Spoke to compare its local values with those of the remote Spoke. The Path Selection mechanism will never attempt to build a shortcut between members belonging to different transport groups.

Following is an example of the transport group assignment. Note that all the Internet overlays belong to transport group 1, while all the MPLS overlays belong to transport group 2:

Transport groups

Transport groups

Consider an SD-WAN topology where the SD-WAN sites have a mixture of Internet and MPLS connections:

  • The Internet and the MPLS transports are physically separate from each other. We often call them segregated transports.

  • All the Internet connections, on the other hand, are naturally interconnected by the public Internet, even if they are of different types (for example, a broadband Internet connection, a backup LTE connection, and so on). Hence, we often call them interconnected transports.

We can make the following observation: a Spoke cannot build an ADVPN shortcut across two segregated transports, but it can do so across the interconnected transports. For example, a Spoke cannot build an ADVPN shortcut from its Internet WAN link to another Spoke's MPLS WAN link or the reverse. But it can easily build an ADVPN shortcut from its broadband Internet link to another Spoke's LTE link.

Note

In the Additional topics section, we discuss other differences between segregated and interconnected transports.

To express this distinction, ADVPN 2.0 introduces a concept of a transport group. Each set of interconnected transports forms a separate transport group. When a user configures an SD-WAN/ADVPN 2.0 Member, it specifies its transport group ID, so that any two members corresponding to segregated transports will be assigned to different transport groups. This information is exchanged as part of the Discovery process, allowing the originating Spoke to compare its local values with those of the remote Spoke. The Path Selection mechanism will never attempt to build a shortcut between members belonging to different transport groups.

Following is an example of the transport group assignment. Note that all the Internet overlays belong to transport group 1, while all the MPLS overlays belong to transport group 2: