What is an Underlay Network?

An underlay network is the physical or provider-supplied transport – an MPLS circuit, a broadband internet link, or LTE/5G – that carries the encrypted tunnels of an SD-WAN overlay. The underlay delivers packets; the overlay abstracts it into one logical fabric that policy and applications operate on.

Key takeaways

• The underlay carries packets; the overlay builds a logical fabric on top.
• Common underlay transports are MPLS, broadband internet, and LTE/5G.
• Sites can share one underlay or run separate, disjointed underlays.
• SD-WAN Gateways bridge branches whose underlays don’t connect.
• Encryption on a WAN link often depends on whether the underlay is trusted.

On this page: Why it matters · How it works · Types · Underlay networks & Versa · FAQ

Why is the underlay network important?

Every SD-WAN deployment depends on the underlay it runs across, so design decisions start there. The choice – a shared transport or several disjointed ones – determines how much redundancy a site has and whether the Controller can reach it directly. A branch connected over only one underlay still functions, but loses the automatic failover of a Controller reachable across multiple transport domains.

Underlay type also drives security decisions. A private MPLS circuit is traditionally treated as secured, so its traffic can use a clear-text overlay tunnel and skip IPsec overhead; an internet underlay cannot make that assumption. Topology matters for scale too – a full-mesh design with multiple underlays generates far more SLA-monitoring traffic than hub-and-spoke on one underlay.

What is an underlay network?

The underlay is the physical or provider network that actually moves packets: an MPLS circuit, a broadband internet connection, LTE/5G, or a private Layer 2 service. SD-WAN treats it purely as transport, with no awareness of tenants, applications, or policy. On top of it, SD-WAN builds an overlay: encrypted IPsec tunnels for data traffic and, by default, a second plain-text VXLAN-based overlay.

Two sites share an underlay when a common transport connects them directly – both on the same internet provider, for example. They have a disjointed underlay when no shared transport exists: one has only internet, the other only MPLS. Disjointed underlays are common after NAT-traversal failures or during MPLS migration, and they are why SD-WAN Gateways exist.

Types of underlay networks

Shared underlay – all sites reach each other over the same transport, such as a common internet provider or MPLS service; the simplest design, and it needs no gateway.

Disjointed underlay – two sites have no transport in common, so a third device acts as an SD-WAN Gateway, importing routes from one underlay’s VRF and re-exporting into the other’s.

Multi-transport (hybrid) underlay – a branch carries MPLS, broadband, and LTE/5G at once; SD-WAN policy steers traffic to whichever underlay meets an application’s latency and loss targets.

Restricted (isolated) underlay – in regions that block IPsec across borders, branches form an SD-WAN island on a government-approved underlay, interconnected through a hub-controller node rather than directly.

Underlay networks & Versa

Versa VOS edge devices build the SD-WAN overlay – encrypted IPsec tunnels and, optionally, a plain-text VXLAN tunnel – across whatever underlay transports a site has, and SLA monitoring measures each underlay path’s latency, jitter, and loss to steer traffic to the best one. The Consolidated SD-WAN Design Guide and the Versa SD-WAN Design Guide cover overlay addressing and encryption around underlay trust.

When sites don’t share a common underlay, Versa’s SD-WAN Solution Architecture describes an SD-WAN Gateway: a hub device with interfaces in both underlay networks that redistributes routes so disjointed branches can still communicate.

Frequently asked questions

What is the difference between an underlay and an overlay network?

The underlay is the physical transport – MPLS, internet, LTE/5G – that carries packets. The overlay is the encrypted, logical network SD-WAN builds on top of it, so applications and policy see one consistent fabric regardless of which physical link traffic took.

Can an SD-WAN deployment use more than one underlay?

Yes, and most production deployments do. A branch commonly carries MPLS, broadband, and LTE/5G at once, each a separate underlay. SD-WAN policy and SLA monitoring dynamically choose which underlay carries a given flow, based on real-time latency, jitter, and packet-loss measurements.

What is a disjointed underlay network?

A disjointed underlay exists when two sites share no common transport – one has only internet, the other only MPLS. Without a gateway, an outage on either link isolates that site. An SD-WAN Gateway, with interfaces in both underlays, redistributes routes to bridge them.

Does Versa encrypt all underlay traffic?

By default, yes – data follows an encrypted IPsec overlay. Administrators can configure a WAN interface for clear-text transport when the underlay is a trusted private circuit, such as MPLS, avoiding IPsec overhead; an SD-WAN policy can override this per flow.

Can underlay networks be isolated for regulatory reasons?

Yes. In regions that restrict encrypted IPsec traffic crossing borders, branches can form an SD-WAN island on a government-approved private underlay, with no direct connectivity outside the region. A hub-controller node links the isolated island’s control plane back to the rest of the network.

More on Underlay Network

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about underlay networks, these are worth looking at next.