Routing Configuration Guide, Cisco Catalyst SD-WAN Releases 17.x

PDF

BGP for Cisco SD-WAN overlay networks

Updated: February 6, 2026

Overview

Details how BGP facilitates the exchange of routing information between different networks to direct internet traffic.

BGP is the routing protocol that directs traffic across the internet by exchanging routing information between different networks, known as autonomous systems (AS). It determines the best paths for data packets to travel between these large networks to ensure efficient and reliable delivery

Cisco Catalyst SD-WAN overlay networks support BGP unicast routing protocols. These protocols can be configured on Cisco IOS XE Catalyst SD-WAN devices within any Virtual Routing and Forwarding (VRF) instance, excluding transport and management VRFs. This configuration enables reachability to local site networks. Cisco IOS XE Catalyst SD-WAN devices can also redistribute route information learned from BGP into the Overlay Management Protocol (OMP), allowing OMP to make more informed path selections within the overlay network.

BGP topologies

  • Direct Connection to Layer 3 VPN MPLS WAN Cloud: When a local site connects directly to a Layer 3 VPN (L3VPN) MPLS WAN cloud, the Cisco IOS XE Catalyst SD-WAN devices function as MPLS Customer Edge (CE) devices. They establish a BGP peering session with the Provider Edge (PE) router in the L3VPN MPLS cloud.

  • Indirect Connection to WAN Cloud: If devices at a local site are one or more hops away from the WAN cloud and connect indirectly through a non-Cisco IOS XE Catalyst SD-WAN device, standard routing must be enabled on the devices' DTLS connections to reach the WAN. In such scenarios, either OSPF or BGP can serve as the routing protocol.

In both of these topologies, BGP sessions operate over a Datagram Transport Layer Security (DTLS) connection. This DTLS connection is established on the loopback interface within VRF 0, which is the dedicated transport VRF for carrying control traffic in the overlay network. The Cisco SD-WAN Validator learns about this DTLS connection via the loopback interface and relays this information to the Cisco SD-WAN Controller for tracking TLOC-related data. Although VRF 0 also hosts the physical interface connecting the Cisco IOS XE Catalyst SD-WAN device to its neighbor (e.g., PE router in MPLS or hub/next-hop router), a DTLS tunnel connection is not established on this physical interface.