An overlay network is a logical network built on top of one or more underlay transports – internet, MPLS, or LTE – using tunnels like IPsec and VXLAN. It abstracts sites and clouds into one addressable fabric, independent of the circuits carrying traffic beneath it.
Key takeaways
- Overlay tunnels abstract traffic from whatever underlay transport carries it.
- IPsec encrypts overlay traffic; VXLAN carries the plain-text overlay instead.
- SD-WAN builds overlay topologies with MP-BGP, not manual per-site routing.
- Full mesh, hub-and-spoke, and regional mesh are common overlay topologies.
- Overlay IP addressing is set once at Director setup and can’t change later.
On this page: Why it mattersHow it worksOverlay network topologiesOverlay Networks & VersaFAQ
Why are overlay networks important?
Enterprises rarely control the physical network end to end. Branches reach headquarters and the cloud over a mix of broadband, MPLS, and LTE circuits from different providers, each with its own addressing and trust level. An overlay network solves that fragmentation by building one logical, consistently addressable fabric across every site, regardless of which underlay circuit carries the packets. Tunnels run over any reachable IP path, so adding a site or switching providers does not force a routing redesign.
Overlays also decouple security from transport. Encrypted tunnels protect data end to end, so traffic crossing the public internet gets the same protection as traffic on a private MPLS circuit, without trusting the carrier. For SD-WAN specifically, the overlay is what makes application-aware steering possible: without a stable logical fabric on top of constantly changing physical links, path selection and policy enforcement have nowhere consistent to attach.
What is an overlay network?
An overlay network is a set of logical tunnels layered on top of one or more physical underlay transports. SD-WAN typically builds two overlays between every pair of sites: an encrypted overlay using IPsec, and a plain-text overlay using VXLAN, chosen per flow depending on whether encryption is needed. Data follows the encrypted overlay by default, though administrators can define clear-text transport per WAN interface – useful on an already-secured circuit such as an MPLS Layer 3 VPN – or dynamically, through a policy that disables encryption for traffic already encrypted, such as HTTPS.
Overlay routes are exchanged through MP-BGP, using community strings and import/export policies to build the desired topology. Because the overlay is purely logical, its IP addressing is independent of the underlay: addresses are chosen once, from a pool sized for the deployment, and stay routable regardless of which physical circuit is active underneath.
Overlay network topologies
The shape of an overlay, not the physical wiring underneath it, determines how sites actually communicate with one another. Full mesh connects every branch directly to every other branch over overlay tunnels, avoiding a central transit point; it suits voice traffic and distributed security architectures where a hub would add delay. Hub-and-spoke routes spoke traffic through a hub, in variants ranging from spoke-to-hub-only (spokes never talk to each other) to spoke-to-spoke through a hub, spoke-to-spoke direct within a spoke group, and a mixed partial-mesh design. Regional mesh (spoke-hub-hub-spoke) groups branches by region, using any topology within a region and routing inter-region traffic through regional hubs. Multi-VRF (multitenancy) overlays keep separate organizations logically isolated on shared infrastructure using distinct VRFs.
All of these use the same mechanism – MP-BGP communities and import/export policies – so a deployment can mix topologies by branch or region without re-cabling anything physical.
Overlay Networks & Versa
Versa’s SD-WAN fabric is overlay-based: branches and hubs connect to a Controller node, which anchors the control and management plane, and topologies are built through Director Workflows using MP-BGP communities rather than manual per-site configuration. The SD-WAN overlay networks article covers the encrypted-IPsec and plain-text-VXLAN tunnel pair Versa builds by default, and how to choose encrypted or clear-text transport per WAN interface or per SD-WAN policy. The consolidated SD-WAN design guide and the Versa SD-WAN design guide cover the supported topologies – full mesh, hub-and-spoke variants, regional mesh, and multi-VRF – with SLA monitoring and scaling guidance for large deployments. Overlay IP addressing is configured once during initial Director setup and cannot be changed afterward, so choosing the method and a subnet large enough for the deployment is a first-day decision. Because routes and topology are workflow-driven, reshaping a deployment is a policy change, not a re-cabling exercise.
Frequently asked questions
What is the difference between an overlay network and an underlay network?
The underlay is the physical or provider transport – internet, MPLS, LTE – that carries packets. The overlay is the logical network of tunnels built on top of it. Overlay traffic reaches its destination as long as one underlay circuit provides reachability.
Is overlay network traffic always encrypted?
Not necessarily. SD-WAN overlays typically build both an encrypted IPsec tunnel and a plain-text VXLAN tunnel. Data follows the encrypted tunnel by default, but administrators can permit clear-text transport on secured circuits like MPLS, or disable encryption for already-encrypted traffic such as HTTPS.
What topologies can an SD-WAN overlay use?
Versa’s SD-WAN overlay supports full mesh, several hub-and-spoke variants (spoke-to-hub-only, spoke-to-spoke through a hub, spoke-to-spoke direct), regional mesh (spoke-hub-hub-spoke), and multi-VRF multitenancy. All are built with MP-BGP communities and import policies, configured through Director Workflows rather than manual routing changes.
Can overlay IP addressing be changed after deployment?
No. The overlay IP addressing method and address pool are configured once during initial Versa Director setup and cannot be modified afterward. Administrators must choose the right method and allocate a subnet large enough for the deployment’s expected size from the start.
How does traffic reach the correct overlay tunnel?
Overlay routes are exchanged between Controller nodes and branches using MP-BGP, with community strings and import/export policies determining which topology routes take. The next hop for a remote prefix is the reachable branch, hub, or Controller loopback interface over the overlay tunnel.
More on Overlay Networks
If you want to learn more, these are sources we trust.
| NIST: Computer Security Resource Center Glossary |
|---|
| A searchable glossary of security terms, for cross-checking how tunnel and encryption terms are formally defined. |
Related terms
If you’re reading about overlay networks, these are worth looking at next.
| Underlay Network | SD-WAN | Path |
|---|---|---|
| The physical transport – MPLS or the internet – that overlay tunnels run across; shared or disjoint per tenant. | The approach that builds encrypted overlay tunnels across WAN links and steers traffic across them by application. | The end-to-end route between two branches over a pair of access circuits – the underlay path a tunnel takes. |