Software-Defined Architecture: Overlay, Underlay and Fabric

What it is

Software-defined networking (SDN) moves the intelligence of the network into a controller, while the devices carry the traffic.

The controller decides how traffic should flow. This topic covers three main ideas: the separation of the control plane from the data plane, the two kinds of APIs that connect the layers, and the terms underlay, overlay and fabric.

How it works

A controller sits between applications and devices, and the network itself is split into a physical underlay and a virtual overlay.

Separating the control plane from the data plane

In a traditional device, the control plane and data plane are in the same box. In classic SDN, they are separated.

The control plane is moved into the central controller, which builds the forwarding rules. The data plane stays in the devices, which simply apply the rules to each packet at full speed.

The benefit is a single point from which policy is set. The network can be programmed as one system, and applications can ask for changes without touching each device.

In many real products, the separation is partial. The devices keep some control plane functions, and the controller handles policy and management. The key idea remains that the controller manages the network as a whole.

North-bound and south-bound APIs

A controller has one interface looking up and another looking down.

North-bound APIs connect the controller to applications and to people above it. They let a script, a portal or another system ask the controller to do something, such as create a policy or read the state of the network.

They are usually REST APIs that exchange JSON. The direction is called north-bound because diagrams draw applications at the top.

South-bound APIs connect the controller to the network devices below it. The controller uses them to push configuration and to read status. Common examples are:

• OpenFlow: a protocol made for SDN that programs the forwarding tables of a device.
• NETCONF and RESTCONF: protocols for configuring devices using data models.
• CLI over SSH and SNMP: older methods that many controllers still use for devices that do not support newer ones.
• OpFlex: a protocol used in Cisco ACI between the controller and the devices.

Underlay, overlay and fabric

Modern SDN designs, especially for campuses and data centres, split the network into two layers.

The underlay is the physical network and the simple IP routing that connects all the devices. It consists of the switches, the cables and a routing protocol that gives every device reachability to every other.

The underlay does not know about users or applications. Its job is to move packets reliably between devices, and it is usually kept simple and stable.

The overlay is a virtual network built on top of the underlay using tunnels. User traffic is wrapped inside packets that travel over the underlay between devices. A common tunnel technology is VXLAN.

The overlay lets the network create logical segments, such as one for employees and one for guests, that are independent of the physical wiring. Segments can span many switches and be added or removed without touching the underlay.

The fabric is the combination of the underlay and the overlay, seen as one system. It is the whole network, managed as a single logical switch. A device that joins the fabric is configured by the controller, and the fabric carries user traffic between any two points with consistent policy.

Cisco's SD-Access is an example for campus networks. Catalyst Center acts as the controller. The fabric uses VXLAN in the data plane, LISP for the control plane, and group-based policy (Cisco TrustSec) for security.

Why split the layers?

Separating the underlay from the overlay means each can change on its own.

Engineers can build a stable, simple underlay once. Then they can add, move or change overlay networks quickly, in software, without rewiring or reconfiguring the physical devices. This gives flexibility with predictability.