What does an SD-WAN architecture look like, layer by layer?

An SD-WAN architecture has three parts: edge devices at each site, an encrypted overlay that runs across whatever links you have, and a central controller that tells every edge what to do. Understanding which part trusts which is the quickest way to judge whether a design is safe.

What are the parts?

Edge devices sit at branches, data centers and sometimes cloud networks. Each one connects to one or more underlay links: broadband, MPLS, 4G or 5G. NIST SP 800-215 lists the common features of SD-WAN offerings as connectivity over any transport, application awareness, integrated security and networking functions, and centralized visibility and management.

The underlay is the set of ordinary links. SD-WAN treats them as untrusted pipes of varying quality.

The overlay is the set of tunnels built across the underlay between edges. Policy decides which application uses which tunnel. The guide describes the key design step as removing the tight coupling between the control plane and the data plane, so one place can set access control, routing and application priority.

The controller (and orchestrator) holds the policy, authenticates new edges and brings them into management workflows. The guide describes this as the ability to recognize and authenticate newly connected appliances and apply a uniform set of policies to all components.

How does a new site join?

The usual pattern is called zero-touch provisioning. Walk through it:

1. A box is shipped to the branch with no site-specific setup.
2. Staff plug it in. It reaches out to a known controller address over any link.
3. The controller checks the device identity, often a certificate or serial number registered in advance.
4. The controller sends a configuration, and the box builds tunnels to its peers.

Step 3 is the weakest point of many rollouts. If the controller accepts any device that knows a shared secret, a stolen or cloned box can join the network. Check how your design proves device identity.

What changes in the security model?

Two shifts stand out. The first is that the controller becomes a high-value target. Whoever can change policy there can change it at every site. The second is that local internet breakout moves inspection to each branch exit. SP 800-215 describes an integrated option, secure access service edge (SASE), where networking and security are delivered together from points of presence in the cloud, with uniform policy for users wherever they are.

A constructed example: a company with 25 sites sends all branch internet traffic to a cloud inspection service through SD-WAN, except two warehouse sites on cellular links. The cellular edges have a typo in the policy template and breakout is open. All the other sites look healthy on the dashboard, and the gap only appears in a spot check of a warehouse edge.

How does this relate to our other SD-WAN posts?

For a control checklist, see our post on how to secure an SD-WAN. For the MPLS comparison, see the post on SD-WAN versus MPLS. This post stays on structure.

How to check or apply this

1. Draw your design on one page: edges, links, controller location, and where internet traffic exits. If you cannot draw it, nobody can audit it.
2. For each edge type, write down how it proves identity to the controller.
3. Confirm that controller access needs multi-factor authentication and comes only from approved networks.
4. Check that overlay tunnels use current encryption and that certificates have expiry alerts.
5. Compare the policy on three random edges to the template. Differences are drift.
6. Test a controller outage. Do sites keep forwarding on their last known policy, and for how long?

Quick check

Sources

• NIST SP 800-215, Guide to a Secure Enterprise Network (secure enterprise networks guide)

Last reviewed: 18 October 2026.