Multi-Overlay traffic rules
A site can use multiple overlays simultaneously to support different traffic forwarding and security requirements.
Common examples include:
Direct Internet Access for trusted applications or services that require the shortest path to the Internet.
Secure Cloud Internet for Internet traffic that must be inspected by a cloud-hosted Secure Internet Gateway.
VPN Private Network for accessing resources hosted in a data center or headquarters (Spoke-to-Hub communication).
VPN Private Network for communication between branch offices through a hub site (Spoke-to-Spoke communication).
These overlays can coexist within the same deployment, allowing traffic to follow different paths depending on business and security requirements.
Any SD-WAN router supports any combination of Overlays, but the number of VPN tunnels that a router can support depends on the hardware model and available system resources.
Traffic forwarding decisions are controlled through overlay traffic rules. These rules determine which overlay should be used for a given traffic flow based on criteria such as source networks, destination networks, applications, or services.
When several overlays are configured on the same site, particular attention should be given to the definition and ordering of traffic rules. Since traffic is matched against the configured rules, an incorrectly ordered or overly broad rule may direct traffic through an unintended overlay.
The following design illustrates a deployment combining multiple overlays:
 |
Traffic Rule Design Considerations
When multiple overlays are deployed, traffic rules should be designed so that each traffic flow matches the intended overlay.
Review both the rule matching criteria and the order in which rules are evaluated to ensure that Internet, cloud security, and VPN traffic are routed according to the desired policy.