Home » SD-WAN Architecture: Overlay, Underlay, vEdge, Orchestrator, Zero-Touch Provisioning และ Application-Aware Routing
SD-WAN Architecture: Overlay, Underlay, vEdge, Orchestrator, Zero-Touch Provisioning และ Application-Aware Routing
SD-WAN Architecture: Overlay, Underlay, vEdge, Orchestrator, Zero-Touch Provisioning และ Application-Aware Routing
SD-WAN (Software-Defined Wide Area Network) เปลี่ยนวิธีเชื่อมต่อสาขาขององค์กร Overlay สร้าง virtual network ทับ physical connections, Underlay คือ physical transport (Internet, MPLS, LTE), vEdge คือ edge device ที่สาขา, Orchestrator จัดการทั้งระบบจากส่วนกลาง, Zero-Touch Provisioning ติดตั้งอุปกรณ์โดยไม่ต้องมี engineer ไปที่สาขา และ Application-Aware Routing เลือกเส้นทางตาม application requirements
SD-WAN เปลี่ยน WAN จาก “expensive + rigid” เป็น “affordable + agile”: MPLS ราคาแพง (10-50x internet), provisioning ช้า (2-4 สัปดาห์), rigid (เปลี่ยน topology ยาก) SD-WAN ใช้ internet เป็น transport (ถูกกว่า 10x+), ZTP deploy ใน minutes, application-aware routing เลือกเส้นทางอัตโนมัติ, centralized management ดูแลร้อยสาขาจากที่เดียว Gartner: 60%+ ขององค์กรจะใช้ SD-WAN ภายในปี 2568
SD-WAN vs Traditional WAN
| Feature |
Traditional WAN (MPLS) |
SD-WAN |
| Transport |
MPLS (expensive, carrier-managed) |
Any: Internet, MPLS, LTE, 5G (mix and match) |
| Cost |
$500-5,000/site/month (MPLS) |
$50-500/site/month (internet-based) |
| Provisioning |
2-4 weeks (carrier dependency) |
Minutes-hours (ZTP, ship device to site) |
| Routing |
Static, destination-based |
Application-aware, policy-based, dynamic |
| Management |
CLI per device, carrier for MPLS |
Centralized dashboard (orchestrator) |
| Cloud Access |
Backhaul to DC → then to cloud (hair-pinning) |
Direct internet breakout at branch → cloud direct |
| Encryption |
Usually not encrypted (trusted MPLS) |
Encrypted by default (IPsec/WireGuard over internet) |
SD-WAN Architecture Components
| Component |
Function |
Examples |
| Orchestrator/Controller |
Central management — define policies, monitor, analytics |
Cisco vManage, Fortinet FortiManager, VMware VCO |
| vEdge/Edge Device |
Branch device — terminate tunnels, apply policies, route traffic |
Cisco vEdge/cEdge, FortiGate, VeloCloud Edge |
| Overlay |
Virtual tunnels (IPsec/GRE) between edges → encrypted, dynamic |
Auto-VPN mesh between all sites |
| Underlay |
Physical transport — Internet, MPLS, LTE, 5G, satellite |
Multiple ISPs per site for redundancy |
| Gateway |
Connect SD-WAN to cloud (AWS, Azure), SaaS, or legacy MPLS |
Cloud on-ramp, colocation gateways |
Zero-Touch Provisioning (ZTP)
| Step |
What Happens |
| 1. Pre-stage |
Admin configures device in orchestrator (serial number, site name, policies) |
| 2. Ship |
Device shipped to branch site — no engineer needed |
| 3. Connect |
Non-technical staff plugs in power + internet cable |
| 4. Phone Home |
Device boots → contacts cloud orchestrator → authenticates with certificate |
| 5. Download Config |
Orchestrator pushes full configuration → tunnels established automatically |
| 6. Operational |
Device joins SD-WAN fabric → traffic flows according to policies → minutes total |
Application-Aware Routing
| Feature |
How |
Example |
| DPI (Deep Packet Inspection) |
Identify application by payload/behavior (not just port) |
Detect Zoom vs YouTube vs Salesforce |
| SLA Monitoring |
Continuously measure latency, jitter, loss per transport link |
MPLS: 10ms/0.1% loss | Internet: 30ms/1% loss |
| Policy-Based Routing |
Define SLA requirements per application → auto-select best path |
Voice: latency < 150ms → use MPLS | Backup: any path ok → use internet |
| Dynamic Failover |
Link degrades below SLA → traffic moves to backup path in seconds |
Internet link loss > 1% → switch voice to LTE backup |
| Direct Internet Breakout |
SaaS/cloud traffic goes direct to internet at branch (no backhaul) |
Office 365, Salesforce → local internet breakout |
SD-WAN Vendors
| Vendor |
Product |
Strength |
| Cisco |
Catalyst SD-WAN (Viptela) |
Largest install base, Meraki for SMB, Catalyst for enterprise |
| Fortinet |
FortiGate SD-WAN |
Integrated NGFW + SD-WAN — security-first approach |
| VMware/Broadcom |
VeloCloud |
Cloud-native, strong multi-cloud, gateway network |
| Palo Alto |
Prisma SD-WAN (CloudGenix) |
AI/ML-driven, strong security integration with Prisma SASE |
| HPE/Aruba |
EdgeConnect (Silver Peak) |
WAN optimization built-in, strong QoE metrics |
| Versa |
Versa SASE |
Unified SASE platform: SD-WAN + security + analytics |
SD-WAN + SASE
| Feature |
SD-WAN Only |
SASE (SD-WAN + Security) |
| Networking |
Overlay, app-aware routing, ZTP |
Same + cloud-delivered networking |
| Security |
Basic (IPsec encryption) |
Full: ZTNA, SWG, CASB, FWaaS, DLP |
| Architecture |
Edge-focused (device at branch) |
Cloud-edge converged (PoPs worldwide) |
| Remote Users |
VPN back to branch/DC |
Direct ZTNA to applications from anywhere |
| Trend |
Evolving towards SASE |
Gartner recommended architecture for 2025+ |
ทิ้งท้าย: SD-WAN = Modern WAN for Cloud-First Organizations
SD-WAN Architecture vs Traditional: 10x cheaper (internet vs MPLS), minutes vs weeks provisioning, app-aware vs destination-based Components: orchestrator (central), vEdge (branch), overlay (tunnels), underlay (internet/MPLS/LTE), gateway (cloud) ZTP: pre-stage → ship → plug in → phone home → auto-config → operational in minutes Application-Aware: DPI identification, SLA monitoring (latency/jitter/loss), policy routing, dynamic failover Vendors: Cisco (largest), Fortinet (security-first), VMware VeloCloud, Palo Alto Prisma, HPE EdgeConnect SASE: SD-WAN + cloud security (ZTNA, SWG, CASB, FWaaS) — converged architecture for 2025+ Key: SD-WAN + SASE is the future of enterprise WAN — cheaper, agile, cloud-optimized, security-integrated
อ่านเพิ่มเติมเกี่ยวกับ MPLS Deep Dive Label Switching LSP LDP RSVP-TE และ VPN Technologies IPsec SSL VPN WireGuard ที่ siamlancard.com หรือจาก icafeforex.com และ siam2r.com
