Overlays
An Overlay defines how traffic is transported after it has been classified. It determines the path that traffic follows from the LAN toward its destination.
Each Overlay is either a VPN overlay or an internet overlay. A VPN overlay creates a private WAN that securely connects sites through a hub. An internet overlay determines how traffic destined for the Internet exits the network, for example through local Internet breakout or cloud-based Internet egress.
Multiple Overlays are used when different types of traffic must follow different paths. For example, one Overlay can be used for direct internet access, another for traffic sent through a cloud security gateway, another for VPN traffic to a data center, and another for VPN traffic to a Partner gateway.
Type | Purpose |
|---|---|
VPN | Carries encrypted site-to-site or site-to-data center traffic, typically using a hub-and-spoke model. |
Internet | Carries traffic to the public internet, either through local WAN egress or through a cloud security service. |
For VPN overlays, the hub can be a Site, such as a customer hub site, a Gateway, such as a Partner-managed concentrator, or a Gateway cluster.
For internet overlays, the configuration defines how traffic exits toward the internet. Traffic can use local egress, where it leaves directly through the site’s WAN underlay, or cloud egress, where it is sent through a Partner cloud service.
Role in the model
Overlays receive classified traffic from Traffic Rules and determine how that traffic is forwarded.
Each Site is assigned an ordered list of Overlays. This order is important because it is also the classification order. Traffic is checked against the Overlays from top to bottom. The first Overlay with a matching Traffic Rule handles the flow.
For this reason, specific VPN overlays should be placed before broader or catch-all internet overlays. This prevents traffic that should use a private VPN path from being classified too early by a general internet overlay.