SD-WAN Architecture: Components, Planes, and Topologies
Understand SD-WAN architecture through its edge, underlay, overlay, management and forwarding functions, and the hub-and-spoke, mesh, and hybrid models.
By Mark Poulton
SD-WAN Architecture: Components, Planes, and Topologies
SD-WAN architecture describes how edge devices, underlying connections, management and control functions, and traffic policies work together. A useful architecture view distinguishes the physical or service transports from the logical overlay and the functions that decide and forward traffic. Product labels and component boundaries differ, so treat the terms below as a vocabulary, not a universal reference design.
For the introductory definition and a concise explanation of overlay and underlay, start with SD-WAN: How It Works and When It Fits.
What are the main components of SD-WAN architecture?
| Component or function | Role in the architecture |
|---|---|
| Underlay | The available transport connections, such as internet access, private WAN services, or cellular links. They carry the traffic used by the overlay. |
| Overlay | Logical connectivity and policy across the underlay. Tunnels may be used between edges, depending on the implementation. |
| SD-WAN edge | A physical or virtual function at a branch, data centre, or cloud location that connects local traffic to the managed WAN and applies configured policy. |
| Management and orchestration | Interfaces and services used to configure, distribute, and monitor policies and network state. Their placement and responsibilities vary. |
| Control functions | Coordinate routes, policy, and path decisions. They may be centralised, distributed, or combined with management functions. |
| Data plane | Forwards packets at the edge according to installed routes and policies. The forwarding path is distinct from the management interface, even when products package functions together. |
Do not infer a product's physical layout from a term such as “controller” or “orchestrator”. Confirm which functions it performs, where they run, what happens if they are unreachable, and how configuration reaches the forwarding edges.
How do overlay and underlay relate?
The underlay is the set of connections available to carry traffic. The overlay applies logical connectivity and policy across those transports. SD-WAN can use multiple underlay types, but it cannot remove their limitations: local capacity, provider reach, last-mile conditions, and failure dependencies remain relevant.
An edge identifies traffic and applies the configured path and forwarding behaviour. Management and control functions distribute policy and provide operational visibility; the data plane forwards traffic. The relationship is logical and functional, not necessarily a set of separate appliances.
Which SD-WAN topology should an organisation use?
Topology describes how locations connect. The appropriate model depends on traffic flows, application needs, security boundaries, and operational constraints.
| Model | How sites connect | Main consideration |
|---|---|---|
| Hub-and-spoke | Branch traffic passes through one or more hub locations. | Centralises paths and policy, but hub capacity and availability matter for traffic that traverses it. |
| Full mesh | Sites can communicate over direct logical paths. | Can reduce reliance on a central transit point, while increasing the number of relationships and policies to manage. |
| Hybrid | Uses hubs for some traffic and direct paths for selected site or application flows. | Supports different traffic needs, but path selection and security policy must remain understandable. |
These are architectural patterns, not a ranking. A design may combine them or use different patterns for different flows. For how to translate application and site requirements into a specific design, continue to SD-WAN design considerations. Security placement and responsibilities are covered in SD-WAN security.
Cloud-hosted control or management functions and cloud connectivity options are not required to follow one universal pattern. Cloud-delivered SD-WAN examines cloud-native service models separately.