SD-WAN private WANs may sound fancy, but at their core, they’re not as complex as they seem. If you’re familiar with the fundamentals of IP networking and router concepts, you’re halfway there. Let’s break it down in plain terms.
It’s Basically Like a Cisco 2600 Setup
Think of an SD-WAN device as being conceptually similar to a Cisco 2600 router. In the old-school days, if you wanted to connect multiple sites, you might set up GRE (Generic Routing Encapsulation) tunnels between locations. Each site would have a base IP and potentially a routed subnet—this could even be as specific as a single IP (/32) routed through that base IP.
An SD-WAN private WAN works in much the same way:
It has a base IP address.
A subnet is routed via the base IP. This could be any size, from a larger block to a /32.
The sites are interconnected over the internet, forming a mesh or hub-and-spoke topology—just like you would with GRE tunnels.
But Instead of GRE Tunnels, SD-WAN Uses Linux Networking
Here’s where things get interesting. Most SD-WAN solutions are built on stock Linux, and instead of relying on GRE, they use Linux network namespaces. These namespaces create isolated networking environments that behave much like the VRFs (Virtual Routing and Forwarding) used in MPLS networks.
So, in essence:
Each namespace functions like its own virtual router.
Traffic between these namespaces can be securely encapsulated, routed, and managed across the internet—effectively creating a private WAN that behaves like MPLS but without the cost or complexity.
How Linux Network Namespaces Work & Their Similarity to MPLS VRFs
Linux network namespaces are a powerful feature that allows multiple isolated network stacks to exist on the same machine. Each namespace operates as if it’s a completely separate network environment, with its own routing tables, interfaces, and IP configurations. This functionality mirrors the behavior of VRFs (Virtual Routing and Forwarding) in MPLS, which are used to create virtualized, logically separated networks over shared infrastructure.
What Are Linux Network Namespaces?
A network namespace in Linux is essentially a container for network resources. When a namespace is created:
It gets its own set of network interfaces.
It maintains its own routing table and nftables rules.
It can have its own loopback interface, which is isolated from the host system and other namespaces.
This means that processes within a namespace only see and interact with the network stack of that namespace, creating a virtual network environment independent of others on the same machine.
Example:
Namespace A has interface veth0 and routes 192.168.1.0/24.
Namespace B has interface veth1 and routes 10.10.10.0/24.
These namespaces do not share routes or communicate unless explicitly configured to do so.
How Do They Compare to MPLS VRFs?
The concept of network namespaces aligns closely with VRFs in MPLS:
Isolation: Both namespaces and VRFs provide logical separation of routing domains. In MPLS, VRFs are used to segregate customer traffic, ensuring one customer’s routes do not interfere with another’s. Similarly, namespaces keep network configurations isolated on the same Linux host.
Routing Tables: In MPLS VRFs, each VRF has its own routing table, which dictates how traffic is forwarded. Linux namespaces achieve the same by maintaining independent routing tables for each namespace.
Scalability: Just as MPLS VRFs allow providers to support multiple customers over a single physical infrastructure, Linux namespaces enable multiple network environments to coexist on a single machine, whether for containers, virtual machines, or SD-WAN.
How Linux Namespaces Are Used in SD-WAN
In SD-WAN, Linux namespaces are often used to emulate the functionality of VRFs to create isolated routing domains for different sites or customers. Here’s how this works in practice:
Namespace for Each Site or Service: Each site in an SD-WAN deployment can be assigned its own namespace, keeping its routing and traffic handling isolated from other sites.
Encapsulation and Interconnection: Namespaces can be interconnected using VPN tunnels, such as WireGuard or IPsec, to simulate the customer isolation provided by MPLS VRFs.
Dynamic Routing: Routing protocols (e.g., BGP or OSPF) can run within each namespace to ensure dynamic and flexible traffic management.
Why Namespaces Are Powerful for SD-WAN
The use of Linux namespaces in SD-WAN solutions provides several advantages:
Cost Efficiency: By leveraging open-source Linux features, SD-WAN eliminates the need for expensive MPLS infrastructure while maintaining similar capabilities.
Flexibility: Namespaces can be created, modified, or removed dynamically, allowing SD-WAN to adapt to changing business needs.
Feature Parity: Namespaces offer the same routing isolation and control as MPLS VRFs, making them an ideal building block for private WANs.
Linux network namespaces are a modern, software-driven alternative to MPLS VRFs. By providing isolated network environments within the same system, namespaces enable SD-WAN solutions to deliver the same level of traffic segregation and routing control as MPLS, but without the cost and complexity. This makes namespaces a foundational technology in the evolution of networking, enabling businesses to create scalable, flexible, and efficient private WANs over the internet.
Where the Magic Happens | The “Secret Sauce”
The real differentiator in SD-WAN isn’t the basic connectivity setup—that’s relatively straightforward. The magic lies in the features and applications that vendors build around this foundation. Here’s what makes SD-WAN shine:
1. Automation
Dynamic path selection: Automatically chooses the best path for traffic based on real-time network conditions like latency, jitter, and packet loss.
Zero-touch provisioning: Devices can be deployed and configured remotely without manual intervention.
2. Visibility
Centralized dashboards provide a single pane of glass for monitoring all sites, traffic flows, and application performance.
Detailed analytics help pinpoint issues and optimize performance.
3. Security
Built-in features like encryption, firewalls, and intrusion detection/prevention ensure secure communication across the public internet.
Policies can be centrally enforced to maintain compliance across all sites.
4. Optimization
WAN optimization techniques like traffic compression and deduplication improve throughput and reduce bandwidth consumption.
Quality of Service (QoS) ensures critical applications (e.g., voice or video) get priority over less important traffic.
5. Quality of Experience (QoE)
SD-WAN actively monitors and adjusts for network conditions to deliver a consistent user experience.
Real-time traffic, such as voice calls, gets preferential treatment to ensure crystal-clear audio.
SD-WAN | The Holy Grail of Networking
When all of these features come together, SD-WAN transforms from a simple private WAN to the holy grail of networking—a single pane of glass that combines:
Routing: The basics of IP networking, but smarter and centralized.
Firewalls: Integrated security at every edge.
Network Management: Centralized control and visibility across the entire WAN.
WAN Optimization: More efficient use of bandwidth.
Quality of Experience: Enhanced application performance and reliability.
Wrapping UP
SD-WAN private WANs leverage tried-and-true networking principles and enhance them with modern Linux-based technology. While the underlying concepts are familiar (think Cisco 2600 with GRE tunnels), SD-WAN’s real value comes from the advanced features built around the connectivity layer. This makes SD-WAN a cost-effective and highly flexible alternative to MPLS, perfect for today’s businesses needing secure, efficient, and reliable networking across dispersed sites.
Ronald Bartels | LinkedIn | Instagram
The Hub & Spoke | SD-WAN Blog
The Morning Patrol with Ron Mastelek 💪
