SD-WAN from Scratch: VeloCloud Architecture Explained

Overview

VeloCloud SD-WAN (now VMware SD-WAN by Broadcom) is the platform deployed across my current network — 42 countries, multi-cloud, multi-ISP. After years of managing it in production, this post covers how it actually works, not just what the marketing slides say.

The core promise of SD-WAN is: transport independence. Your application traffic should work over any available underlay — MPLS, broadband, LTE, satellite — and the network should route it intelligently based on real-time path performance, not static routing tables. VeloCloud delivers this through Dynamic Multi-Path Optimization (DMPO) and a clean separation between the data plane (Edges), control plane (Controllers), and management plane (Orchestrator).

---

---

The Three Planes

Management Plane — VeloCloud Orchestrator (VCO)

The Orchestrator is the single pane of glass. Everything you configure lives here — profiles, policies, segment definitions, business policies, firewall rules. The VCO never touches forwarding; it pushes configuration to Edges via the Controller and exposes real-time monitoring, path analytics, and alerts.

What the VCO manages:

• Zero Touch Provisioning (ZTP) — Edges activate by calling home to the VCO
• Network segmentation — create isolated segments (like VRFs)
• Business policies — map applications to transport preferences
• Firewall rules — stateful + application-aware
• Monitoring — path quality metrics, top talkers, SLA dashboards

VCO can be cloud-hosted (VMware-hosted SaaS), on-prem (VCO appliance in your DC), or hybrid.

Control Plane — VeloCloud Controller (VCC)

The Controller handles routing. Every Edge establishes a persistent VCMP (VeloCloud Management Protocol) tunnel to two Controllers for redundancy. The Controller distributes routes between Edges — it knows every Edge's subnets, dynamically exchanges prefixes, and builds the overlay routing table.

The Controller does not forward user traffic. Traffic flows Edge-to-Edge (or Edge-to-Gateway) directly — the Controller only tells each Edge where to find everything else.

Data Plane — VeloCloud Edge (VCE)

The Edge is the CPE device at each site. It handles actual packet forwarding, encryption, QoS, and the DMPO logic. Every Edge builds encrypted VCMP tunnels to other Edges (hub-and-spoke or full-mesh depending on the profile), probes each path continuously, and steers traffic onto the best path in real time.

---

Dynamic Multi-Path Optimization (DMPO)

DMPO is what separates VeloCloud from a simple VPN overlay. Here's how it works:

Continuous path probing: Every Edge sends probes to all peers over every available WAN link every 100ms. It measures latency, jitter, and packet loss for each path independently.

Per-packet or per-flow steering: Based on business policy, VeloCloud can steer different application flows onto different WAN links simultaneously. A voice call goes via MPLS (low jitter), a file backup goes via broadband (high throughput, cost-effective), and a video stream goes via whichever path currently has the best characteristics.

Forward Error Correction (FEC): On links with measurable packet loss, the Edge can transmit redundant FEC packets to reconstruct lost data without retransmission. This is critical for voice/video over broadband or LTE where loss spikes occur.

Remediation: When a path degrades, VeloCloud moves flows off it within milliseconds — far faster than BGP reconvergence.

---

Business Policies and Application Steering

Business policies are the heart of VeloCloud's value. They define: which applications go over which transport, under what conditions.

A policy is structured as: Match (application/destination) → Action (transport preference + QoS).

# Example Business Policy — as seen in VCO config export (YAML)
businessPolicies:
  - name: "VoIP-Priority"
    match:
      application: "MICROSOFT_TEAMS"   # App-aware — Deep Packet Inspection
    action:
      linkSteering: "MPLS_FIRST"       # Prefer MPLS; fallback to broadband
      qos:
        dscp: "EF"                     # Mark Expedited Forwarding
        priority: HIGH
      slaThreshold:
        latencyMs: 150
        jitterMs: 30
        lossPercent: 1

  - name: "Backup-Traffic"
    match:
      application: "VEEAM_BACKUP"
    action:
      linkSteering: "BROADBAND_ONLY"   # Keep backups off expensive MPLS
      qos:
        priority: LOW
      rateLimit: "50Mbps"

  - name: "Default-Internet"
    match:
      destination: "0.0.0.0/0"
    action:
      linkSteering: "COST_OPTIMIZED"  # Cheapest available path

---

WAN Transport Design

Each VeloCloud Edge supports up to 4 WAN links. Best practice for enterprise:

---

Segmentation

VeloCloud supports network segmentation via Segments — effectively VRFs in the overlay. A segment is a logically isolated network with its own routing table, firewall policy, and set of Edges. Traffic between segments requires explicit inter-segment policy.

Common segmentation patterns:

• Corporate — internal user traffic, ERP, intranet
• Guest — internet-only, isolated from corporate
• PCI — cardholder data environment, strict firewall rules, dedicated MPLS path
• OT/IoT — operational technology, air-gapped from corporate segment

Each segment maps to a VLAN on the LAN side of the Edge. The Edge applies the segment's routing and policy to that VLAN's traffic.

---

Monitoring Key Metrics in Production

These are the metrics I watch daily in the VCO dashboard:

---

Common Operational Issues