Overlay vs underlay
In networking, the underlay and the overlay are two layers that work together. The underlay is the physical (or provider) network: the routers, switches, circuits and internet links that actually carry packets from one place to another. An overlay is a virtual network built on top of that underlay, usually with tunnels. It has its own logical topology and addressing, independent of the physical paths beneath it.
The underlay is the physical network and links that carry packets; an overlay is a virtual network built on top of it, abstracting away the physical paths.
How the two layers relate
- 01
The underlay provides raw connectivity and reachability between physical endpoints. It is the transport.
- 02
The overlay creates a logical network on top, using encapsulation or tunnels, so endpoints connect as if directly linked regardless of the physical path.
- 03
The overlay can have its own addressing, segmentation and policy that don't depend on, and aren't limited by, the underlay's structure.
- 04
Because the overlay is decoupled from the physical network, it can span different providers, sites and clouds as one coherent network.
What makes overlays so flexible
Separating the logical network from the physical one is what makes overlays so flexible. An overlay can join links from many ISPs, several data centers and several clouds into a single addressed network, apply the same segmentation and policy across all of it, and move or reroute traffic without anyone touching the underlying circuits. The underlay only has to deliver packets between endpoints; topology, security and steering live in the overlay. The cost is a small encapsulation overhead and the need to manage the overlay's own control plane.
Overlays in mesh and SD-WAN
Mesh VPNs and SD-WAN are both overlay technologies. A mesh VPN builds an encrypted overlay of direct tunnels between nodes on top of whatever internet underlay each one has. SD-WAN builds an overlay that it steers across several underlay links, choosing paths and failing over automatically. In both cases the underlay is commodity connectivity and the value lies in the overlay's central control, security and topology. That is why these approaches can replace rigid designs tied to specific circuits.
How this relates to Vexaro Mesh (in development)
Vexaro Mesh, now in development, is designed as an overlay: direct, encrypted tunnels between your sites over whatever internet links they have (the underlay), with the same fabric extended across clouds and through NAT. Each site is to peer into the shared fabric and get consistent addressing and policy independent of the physical paths. Offices, a data center and several clouds would then form one logical network without re-plumbing the underlay.
See the planned features