Cisco SD-WAN service VPNs, OSPF and BGP at the site

Three kinds of VPN

In Cisco SD-WAN, "VPN" means a separate routing table, not a remote access client. Each edge router has:

• VPN 0, the transport VPN: holds the WAN interfaces (MPLS, broadband, LTE) and their TLOCs. Control connections and tunnels start here.
• VPN 512, the management VPN: an optional out-of-band management interface, kept away from user traffic.
• Service VPNs (other numbers, such as 1, 10 or 20): the LAN side, where users, servers and routing protocols live.

On IOS XE cEdge routers each VPN is a VRF (VPN 0 maps to the global table, VPN 512 to the management VRF). OMP advertises each service VPN's routes with a label, so traffic from VPN 10 at one branch only ever reaches VPN 10 elsewhere. This gives end-to-end segmentation without separate circuits. See SD-WAN security and segmentation for the security side.

Creating a service VPN

In practice you build service VPNs with feature templates or configuration groups in the Manager. Underneath, on a cEdge, the result looks like an ordinary VRF:

vrf definition 10
 rd 1:10
 address-family ipv4
 exit-address-family
interface GigabitEthernet3
 description Staff LAN
 vrf forwarding 10
 ip address 10.10.1.1 255.255.255.0

Connected and static routes in a service VPN are advertised into OMP by default, so a simple branch with one LAN subnet needs no routing protocol at all.

OSPF at the site

Larger sites have a core switch or firewall behind the edge. Running OSPF in the service VPN lets the edge learn those internal subnets. Two directions need thought:

1. Site to overlay: OSPF routes learnt by the edge are advertised into OMP. Check which OSPF route types your release advertises by default; external routes usually need enabling.
2. Overlay to site: routes from other sites arrive through OMP. Redistribute OMP into OSPF so the core switch learns them, or simply originate a default route towards the site.

router ospf 10 vrf 10
 router-id 10.255.0.21
 network 10.10.1.0 0.0.0.255 area 0
 redistribute omp

OSPF can also run in VPN 0 to learn transport routes from a provider, but most designs keep the transport side to static or BGP routes.

BGP and loop prevention

BGP suits data centres and sites with their own routing domain. The edge peers with the data centre core in the service VPN, advertises overlay routes to it and learns data centre prefixes back. BGP is also common in VPN 0 towards an MPLS provider.

When a site has two edges, or both OMP and an old MPLS path during migration, mutual redistribution can create routing loops. Cisco SD-WAN uses tags such as the site of origin and OMP's own preference rules to stop routes coming back in. Plan redistribution carefully, filter what you advertise, and test failover before going live. Routing protocols covers the general behaviour of OSPF and BGP.

Real-world example: a hospital keeps systems apart

A hospital trust connected three hospitals and twelve clinics with Cisco SD-WAN. It used VPN 10 for clinical systems, VPN 20 for administration, VPN 30 for building management and VPN 40 for guest Wi-Fi. The main data centre ran BGP with its firewalls in each service VPN, while hospitals ran OSPF to their core switches with OMP redistributed into OSPF. Because the VPNs were separate end to end, a ransomware outbreak on a contractor's laptop on the building management network could not reach clinical systems; firewalls allowed only the few flows that genuinely crossed VPNs.