Search for a command to run...
SD-WAN Data Plane
![[Cisco SD-WAN] WAN Edge Packet Forwarding Order of Operations](/_next/image?url=https%3A%2F%2Fcdn.hashnode.com%2Fres%2Fhashnode%2Fimage%2Fupload%2Fv1710383702910%2F285d116a-c00a-4ada-8d46-5e9593c875e5.png&w=3840&q=75)
Visit to see more: https://linktr.ee/nddnam
I am an enthusiastic Network Engineer with 7+ years of experience working on MPLS L3VPN Network projects, Cisco SDWAN Deployment, and Enterprise Networks.
I love to automate every daily task and think Dev-Ops as always. Thus, I am entering the DevNet world.
Hope it helps
Uncover the power of SD-WAN in our insightful blog series. Explore benefits, implementation strategies, and real-world use cases.
Learn by examples
In this blog, I'll show how to use Ansible to automate interface configuration across multiple Cisco IOS-XE routers using a loop. This is especially useful for bulk interface provisioning and ensuring consistency across your edge routers. Objective C...
Lab topology and sample configs for testing Segment Routing with SR-TE and PCE on Cisco IOS XE routers. 🖥️ Topology [ R1 ]---[ R2 ]---[ R3 ]---[ R4 ] | | |-------------------------| R1: PCC (client), Source R4: Dest...
![[SR-MPLS] LAB Segment Routing with SR-TE and PCE](/_next/image?url=https%3A%2F%2Fcdn.hashnode.com%2Fres%2Fhashnode%2Fimage%2Fupload%2Fv1746671465429%2F97233c37-df08-47a4-9148-0ccdc7b49622.png&w=3840&q=75)
How IGP convergence ties into Fast Reroute (FRR) and Segment Routing - Traffic Engineering (SR-TE) 🔁 IGP + Fast Reroute (FRR) IGP convergence usually takes tens to hundreds of milliseconds—even up to a few seconds depending on the topology and tuni...
![[SR-MPLS] IGP & SR-TE Segment Routing - Traffic Engineering](/_next/image?url=https%3A%2F%2Fcdn.hashnode.com%2Fres%2Fhashnode%2Fimage%2Fupload%2Fv1746670805015%2F8e6879c4-0dbd-4513-9327-9026de08933f.png&w=3840&q=75)
Azure Load Balancer vs. Application Gateway
A Deep Dive into Secure Cloud Connectivity
About the packet forwarding order of operations, given that various policies can influence the forwarding of a single flow at a site, it's crucial to comprehend how these policies are applied, evaluated, and interacted.
Firstly, control policies operate separately from data plane policies as they don't directly affect data plane operations. Instead, they influence the routing information upon which the data plane relies, thereby impacting traffic forwarding.
Control policies can modify, filter, summarize, or restrict the advertisement of routing prefixes or TLOCs. Consequently, a WAN Edge device will construct its forwarding plane based on the altered control plane information.
Figure 1-1. Cisco WAN Edge Packet Forwarding Order of Operation
When a packet traverses a WAN Edge router, it follows a carefully orchestrated sequence of steps:
IP Destination Lookup: The router begins by examining the destination IP address of the packet. It consults its routing table to determine the most appropriate next-hop for forwarding the packet. This lookup is crucial as it guides all subsequent forwarding decisions.
Ingress Interface ACL: Next, the packet encounters any ACLs configured on the ingress interface. These ACLs, often part of localized policies, dictate whether the packet should be allowed, denied, or subjected to specific actions like traffic shaping or Quality of Service (QoS) markings. If the packet is denied by the ACL, it is dropped immediately and not processed further.
Application-Aware Routing: Following the routing decision based on the routing table, the packet undergoes evaluation against an Application-Aware Routing policy. This policy is designed to optimize traffic based on application-specific requirements. However, it's important to note that Application-Aware Routing can only differentiate between paths of equal cost in the routing table. If multiple next-hop addresses for a destination don't have equal-cost paths, the Application-Aware Routing policy has no impact, and the packet follows the most preferred path based solely on the routing table.
Centralized Data Policy: Once Application-Aware Routing is applied, the packet's journey may be further influenced by centralized data policies. These policies have the authority to override decisions made by Application-Aware Routing, providing additional control over traffic forwarding.
Routing and Forwarding: With the routing decisions made, the router determines the appropriate output interfaces for the packet's continued journey.
Security Policy: If configured, the packet is subjected to various security measures in a predefined order. These may include firewall rules, intrusion prevention systems (IPS), URL filtering, and advanced malware protection. Each security measure is applied according to its configured rules and policies.
Encapsulation and Encryption: As the packet prepares to traverse the fabric, it undergoes encapsulation and encryption processes to ensure secure transmission across the network. This includes adding VPN labels and applying tunnel encapsulation as necessary.
Egress Interface ACL: Finally, the packet encounters any ACLs configured on the egress interface before leaving the router. Similar to the ingress ACLs, these ACLs may permit, deny, or manipulate the packet's contents based on predefined rules. Any modifications or denials applied here take effect before the packet is forwarded out of the router toward its final destination.
How Cisco SD-WAN Data Plane works?
**Get the Cisco SD-WAN Zero-to-One ebook
