Control Plane
Previously, you learned how the control plane has traditionally been separated from the data plane. SD-WAN Controller (vSmart) is the component that provides control plane functionality and is the brain of the SD-WAN fabric. It is highly scalable and can handle up to 5000 control connections per instance, with up to 12 SD-WAN Controllers in a single production deployment (as of SD-WAN Version 20.12). With these numbers, a deployment can support very large SD-WAN networks.
SD-WAN Controller is responsible for the implementation of control plane policies, centralized data polices, service chaining, and VPN topologies. It also handles key management, which is an important part in the security and encryption of the fabric.
Separating the control plane from the data and management planes allows a solution to achieve greater scale while simplifying network operations. With Cisco Catalyst SD-WAN, all SD-WAN Controllers learn all the routing information. Then they calculate the routing table and distribute it to the WAN Edge routers, taking into consideration applicable centralized control policies.
A WAN Edge router can connect to multiple SD-WAN Controllers at a time but needs connectivity to only one to get its routing and policy information.
The protocol that SD-WAN Controllers use to communicate all this information is called Overlay Management Protocol (OMP). Although OMP handles routing, it would be a disservice to consider it simply a routing protocol. OMP is used to manage and control the overlay beyond just routing (key management, configuration updates, and so on). As illustrated in Figure 2-9, OMP runs between SD-WAN Controller and WAN Edge routers inside a secured tunnel. When a policy is built via the management plane, it is distributed to SD-WAN Controller via NETCONF, and SD-WAN Controller then distributes this policy via an OMP update to WAN Edge routers.
)
Figure 2-9 Cisco Control Plane and Data Plane Overview
SD-WAN Controller operates similarly to a BGP route reflector in iBGP. It receives routing information from each WAN Edge router and can apply policies before advertising this information back out to other WAN Edge routers. One example of these policies is the creation of distinct per-VPN topologies. To achieve it, the control policy is defined in SD-WAN Manager, which then distributes the policy through the management plane. Then, SD-WAN Controller applies the policy to the fabric. In this example, topology modification is achieved by manipulating what routes get distributed and how the data plane is built between WAN Edge routers.
The control plane also plays an important role in the encryption of the fabric. In legacy WAN technologies, securing the network required a considerable amount of processing power, as each device would compute its own encryption keys per peer and distribute those keys to peers by using a protocol such as ISAKMP/IKE. For more efficient scaling in Cisco SD-WAN networks, key exchange and distribution have been moved to the SD-WAN Controller, and no IKE is implemented since identity has already been established between the WAN Edge routers and SD-WAN Control Components. Each WAN Edge router computes its own set of keys per transport and sends them to SD-WAN Controllers. SD-WAN Controllers then distribute them to each WAN Edge router, according to the defined policy. This process repeats when IPsec security associations (SAs) expire and new keys are generated. By moving the key exchange to a centralized location, you achieve greater scale as each WAN Edge router doesn’t need to handle key negotiation or distribution. (Refer to Figure 2-9 for an overview of how the control and data planes are built.) Chapter 3, “Control Plane and Data Plane Operations,” covers this in more detail.
If control connectivity has been established but has been lost due to an outage, data plane connectivity continues to work. By default, WAN Edge routers continue forwarding data plane traffic in the absence of control plane connectivity for up to 12 hours, utilizing the last-known state of the routing table, although this is configurable, depending on your requirements. When control plane connectivity is reestablished, WAN Edge routers are updated with any policy changes that were made during the outage. When the control connection is restored, the routing table is refreshed, and any stale routes are flushed.
For redundancy, it is the best practice to deploy at least two geographically dispersed SD-WAN Controllers. They should have identical policy configuration to ensure network stability. If these configurations differ, there’s a risk of suboptimal routing and potential blackholing of traffic. SD-WAN Controllers maintain a full mesh of OMP sessions among themselves and exchange control and routing information, although each operates autonomously (that is, there is no database synchronized between them).
Figure 2-10 shows how OMP is established between multiple SD-WAN Controllers and WAN Edge routers. SD-WAN Controllers form a full mesh among themselves, which ensures that they stay synchronized. WAN Edge routers establish one OMP session to each of two (by default) SD-WAN Controllers, but they do not create OMP sessions with each other. When there are more than two SD-WAN Controllers in the network, their selection is based on an algorithm to ensure that load balancing occurs. In the event of the total failure of an SD-WAN Controller, the sessions are redistributed between the remaining SD-WAN Controllers to maintain network continuity and stability.
)
Figure 2-10 OMP Session Establishment
By default, each WAN Edge router establishes multiple secure control connections, one over each available transport, to each selected SD-WAN Controller. However, only one OMP session is established between the WAN Edge device and each SD-WAN Controller, using one of those control connections as a transport.