<\/span><\/h2>\nA TLOC represents the physical or logical interface where an edge router connects to a WAN transport provider. In data-plane terms, it acts as the next-hop address for overlay traffic traversing across the SD-WAN fabric. Rather than identifying a tunnel endpoint by a single interface IP, Cisco SD-WAN defines every TLOC by a specific 3-tuple value<\/strong>:<\/p>\nTLOC = { System IP, Color, Encapsulation }\n<\/code><\/pre>\n<\/span>The TLOC 3-Tuple Components<\/span><\/h3>\n\n- System IP Address<\/strong>
\nThe System IP is a persistent, globally unique 32-bit IPv4 address assigned to a WAN Edge device. It functions identically to a router ID in OSPF or BGP. It does not need to be routable in the underlay transport network; instead, it provides a stable device identifier that remains unchanged regardless of interface state changes.<\/li>\n- Color<\/strong>
\nThe color attribute is an abstraction that specifies the transport circuit type associated with the interface (for example, mpls<\/code>, biz-internet<\/code>, public-internet<\/code>, lte<\/code>, or metro-ethernet<\/code>). Colors tell the SD-WAN fabric whether a link is private or public:<\/li>\n- Private Colors:<\/strong> (e.g.,
mpls<\/code>, private1<\/code>) By default, routers attempt to connect to other private color endpoints using their private, natively assigned IP addresses without NAT traversal.<\/li>\n- Public Colors:<\/strong> (e.g.,
biz-internet<\/code>, public-internet<\/code>, lte<\/code>) The router uses Session Traversal Utilities for NAT (STUN) to discover post-NAT public IP addresses and ports to establish tunnels across public backbones.<\/li>\n- Encapsulation<\/strong>
\nThis defines the data-plane transport protocol applied across the underlay. Cisco SD-WAN supports IPsec<\/strong> (the enterprise standard for encrypted payload transmission) and GRE<\/strong> (used in specific high-throughput, unencrypted transit designs).<\/li>\n<\/ol>\n<\/span>How OMP Builds Data Paths Using TLOC Routes<\/span><\/h3>\nCisco SD-WAN automates full-mesh or hub-and-spoke connectivity using the Overlay Management Protocol (OMP)<\/strong>. When an edge router boots up and attaches to a transport:<\/p>\n\n- TLOC Route Generation:<\/strong> The edge router creates a TLOC route containing its 3-tuple, along with metadata: private IP\/port, public IP\/port (resolved via STUN), Site ID, preference, weight, and encryption keys.<\/li>\n
- Control-Plane Advertisement:<\/strong> The router advertises this TLOC route to the centralized vSmart controller<\/strong> over secure DTLS or TLS control connections inside transport VPN 0.<\/li>\n
- Policy Reflection:<\/strong> The vSmart controller filters and distributes these TLOC routes to remote peer routers according to centralized control policies.<\/li>\n
- Data-Plane Formation:<\/strong> Once peer edge routers receive each other’s TLOC attributes, they initiate direct, peer-to-peer IPsec tunnels.<\/li>\n
- Liveness Monitoring via BFD:<\/strong> The routers immediately launch Bidirectional Forwarding Detection (BFD) over the newly formed tunnels to measure latency, jitter, loss, and reachability.<\/li>\n<\/ol>\n
Key Takeaway:<\/strong> A TLOC is a composite 3-tuple {System IP, Color, Encapsulation}<\/code> distributed by OMP that allows edge devices to advertise transport endpoints and dynamically build secure data tunnels without manual tunnel provisioning.<\/p><\/blockquote>\n
\n<\/span>TLOC vs. System IP vs. Site ID: Key Architectural Differences<\/span><\/h2>\nBecause Cisco SD-WAN introduces multiple identification layers across control and data planes, network engineers often conflate TLOCs with System IPs and Site IDs. While all three are assigned during edge provisioning, they serve distinct functions within the overlay hierarchy.<\/p>\n
\n\n\n| Metric \/ Attribute<\/th>\n | TLOC (Transport Locator)<\/th>\n | System IP<\/th>\n | Site ID<\/th>\n<\/tr>\n<\/thead>\n |
\n\nPrimary Definition<\/strong><\/td>\n| The data-plane tunnel next-hop endpoint on a transport interface.<\/td>\n | The persistent, unique logical identifier for an edge node.<\/td>\n | A numeric identifier grouping one or more devices at a single physical facility.<\/td>\n<\/tr>\n | \nArchitectural Layer<\/strong><\/td>\n| Data Plane \/ Underlay Transit<\/td>\n | Control Plane & Management Plane<\/td>\n | Fabric Topology & Policy Scope<\/td>\n<\/tr>\n | \nSyntax \/ Format<\/strong><\/td>\n3-Tuple: {IP, Color, Encapsulation}<\/code> (e.g., {10.255.0.1, mpls, ipsec}<\/code>)<\/td>\n32-bit IPv4 address format (e.g., 10.255.0.1\/32<\/code>)<\/td>\nInteger between 1<\/code> and 4294967295<\/code><\/td>\n<\/tr>\n\nRoutability<\/strong><\/td>\n| Transport IPs must be routable in the WAN underlay; the 3-tuple is tracked in OMP.<\/td>\n | Non-routable in the underlay; used internally by OMP, vSmart, and vManage.<\/td>\n | Non-routable; functions strictly as an administrative and policy label.<\/td>\n<\/tr>\n | \nTunnel Impact<\/strong><\/td>\n| Direct endpoint of IPsec\/GRE tunnels; monitored by BFD.<\/td>\n | Anchors control connections to vSmart, vBond, and vManage.<\/td>\n | By default, prevents data-plane IPsec tunnels between routers sharing the same Site ID.<\/td>\n<\/tr>\n | \nvManage Template Location<\/strong><\/td>\nFeature Template: VPN 0 Interface<\/em> (Tunnel Interface configuration)<\/td>\nFeature Template: System Template<\/em><\/td>\nFeature Template: System Template<\/em><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/span>Structural Interdependence<\/span><\/h3>\nThese three identifiers work together in a hierarchical model:
\n* The Site ID<\/strong> dictates where<\/em> the traffic originates or terminates.
\n* The System IP<\/strong> defines which device<\/em> is processing the traffic.
\n* The TLOC<\/strong> defines which physical path or circuit<\/em> carries the data across the network.<\/p>\nWhen two routers share the same Site ID, OMP recognizes them as co-located branch routers. By default, Cisco SD-WAN suppresses data tunnel formation between identical Site IDs, assuming local LAN or Direct Connect paths handle intra-site traffic.<\/p>\n Key Takeaway:<\/strong> System IP identifies the router, Site ID identifies the location, and TLOC defines the specific underlay circuit used to send data across the overlay.<\/p><\/blockquote>\n
\n<\/span>How to Configure a TLOC: Step-by-Step CLI and vManage Workflow<\/span><\/h2>\nTLOCs are exclusively provisioned within VPN 0<\/strong> (the Transport\/Underlay VPN). To transform a standard interface into a functional TLOC, you must assign an IP address, declare it as a tunnel interface, set a transport color, and select the encapsulation.<\/p>\n<\/span>CLI Configuration Workflow<\/span><\/h3>\nFollow these sequential steps when configuring an edge router through the command line (cisco-native or SD-WAN CLI):<\/p>\n Step 1: Navigate to VPN 0 and Configure the Physical\/Sub-Interface<\/h4>\nDefine the physical underlay interface connecting to the Internet or MPLS service provider.<\/p>\n sdwan\n config\n vpn 0\n interface GigabitEthernet0\/0\/0\n description WAN-Underlay-Biz-Internet\n ip address 198.51.100.2 255.255.255.0\n no shutdown\n<\/code><\/pre>\nStep 2: Enable the Tunnel Interface and Assign Encapsulation<\/h4>\nDesignate the interface as a fabric tunnel endpoint and specify the encapsulation type (ipsec<\/code> is typical).<\/p>\n tunnel-interface\n encapsulation ipsec\n<\/code><\/pre>\nStep 3: Assign Transport Color and Peering Parameters<\/h4>\nAssign the circuit color. If the circuit should only form tunnels with matching transport colors on remote branches, append the restrict<\/code> keyword.<\/p>\n color biz-internet restrict\n<\/code><\/pre>\nStep 4: Configure Allowed Inbound Services<\/h4>\nBy default, the tunnel interface blocks inbound infrastructure traffic. Permit the essential protocols required for control-plane and management stability:<\/p>\n allow-service bfd\n allow-service omp\n allow-service stun\n allow-service https\n allow-service ssh\n exit\n exit\n commit\n<\/code><\/pre>\n<\/span>Cisco Catalyst SD-WAN Manager (vManage) Workflow<\/span><\/h3>\nTo deploy TLOC configurations at scale across template-driven devices:<\/p>\n \n- Access Feature Templates:<\/strong> Navigate to Configuration > Templates > Feature Templates<\/strong>.<\/li>\n
- Configure the System Template:<\/strong> Ensure the System IP<\/strong> and Site ID<\/strong> are populated using global or device-specific variables.<\/li>\n
- Edit the VPN 0 Interface Template:<\/strong> Open the Cisco VPN Interface Ethernet<\/em> template assigned to VPN 0.<\/li>\n
- Enable Tunnel Interface:<\/strong> Under the Tunnel Interface<\/strong> drop-down menu, toggle the value to On<\/strong>.<\/li>\n
- Define Color and Restrict:<\/strong> Set the transport color (e.g.,
biz-internet<\/code>). Set Color Restrict<\/strong> to On<\/code> if traffic must not cross-connect to unlike transports (e.g., keeping MPLS traffic off broadband internet).<\/li>\n- Apply Tunnel Encapsulation:<\/strong> Select IPsec<\/strong> under the Encapsulation section.<\/li>\n
- Attach to Device Template:<\/strong> Attach the interface template to the device’s master Cisco VPN 0 Template<\/strong>, update device values, and deploy the template to the target hardware.<\/li>\n<\/ol>\n
Key Takeaway:<\/strong> A TLOC is instantiated whenever an interface within VPN 0 has tunnel-interface<\/code> enabled, a designated color, and an active encapsulation protocol.<\/p><\/blockquote>\n
\n<\/span>Designing High Availability with TLOC Extensions<\/span><\/h2>\nIn a redundant branch deployment, enterprises often place two WAN Edge routers on-site for high availability. In many cases, each router terminates only one WAN connection\u2014for example, Router A terminates the private MPLS circuit, while Router B terminates the broadband Internet circuit.<\/p>\n [ MPLS Underlay ] [ Internet Underlay ]\n | |\n +--------------+ +--------------+\n | WAN Edge 1 | | WAN Edge 2 |\n | (Color: MPLS)| | (Color: INET)|\n +--------------+ +--------------+\n | |\n +=== [ TLOC Extension Link ]+\n<\/code><\/pre>\nWithout an extension mechanism, Router A cannot send traffic over the Internet if its MPLS link fails, cutting the branch’s WAN bandwidth and redundancy in half. TLOC Extension<\/strong> solves this problem by allowing adjacent edge routers to share their local WAN connections across a dedicated Layer 2 or Layer 3 interconnect.<\/p>\n<\/span>TLOC Extension Design and Implementation<\/span><\/h3>\nThrough TLOC extension, Router A can establish an “extended” TLOC using Router B\u2019s Internet connection, and Router B can establish an extended TLOC using Router A\u2019s MPLS connection. Both routers then maintain active data tunnels over both circuits simultaneously.<\/p>\n Step 1: Establish the Dedicated Interconnect<\/h4>\nConnect an interface between Router A and Router B (e.g., GigabitEthernet0\/0\/2<\/code>). This link must reside in VPN 0<\/strong> and act as an unencapsulated point-to-point link.<\/p>\nStep 2: Configure the Local Extended Interface (Router A)<\/h4>\nOn Router A, configure the point-to-point link facing Router B, and define it as an extension to its local MPLS interface.<\/p>\n sdwan\n config\n vpn 0\n interface GigabitEthernet0\/0\/2\n description TLOC-Extension-Link-to-Edge2\n ip address 192.168.10.1 255.255.255.252\n tloc-extension GigabitEthernet0\/0\/0\n no shutdown\n commit\n<\/code><\/pre>\nStep 3: Configure the Receiving Interface (Router B)<\/h4>\nOn Router B, configure its side of the interconnect. Router B marks this interface as a tunnel-interface<\/code> with the color mpls<\/code>, using Router A’s IP address on the interconnect as its next hop.<\/p>\nsdwan\n config\n vpn 0\n interface GigabitEthernet0\/0\/2\n description TLOC-Extension-From-Edge1\n ip address 192.168.10.2 255.255.255.252\n tunnel-interface\n encapsulation ipsec\n color mpls\n exit\n no shutdown\n commit\n<\/code><\/pre>\n<\/span>Design Considerations and Constraints<\/span><\/h3>\n\n- Bandwidth Bottlenecks:<\/strong> The interconnect must match or exceed the WAN circuit bandwidth to prevent internal packet drops during high-utilization periods.<\/li>\n
- MTU Adjustments:<\/strong> TLOC extension introduces an extra internal hop before encapsulation. Keep your MTU set to at least 1500 bytes (or higher if using 802.1Q sub-interfaces) to avoid packet fragmentation.<\/li>\n
- Platform Limitations:<\/strong> Native TLOC extensions generally cannot cross cellular\/LTE interfaces directly. Cellular connections require dedicated cellular gateway designs or bridging to be shared.<\/li>\n<\/ul>\n
Key Takeaway:<\/strong> TLOC extension enables dual-router sites to cross-share WAN circuits over an internal VPN 0 link, ensuring every router at the site can reach all available WAN transports.<\/p><\/blockquote>\n
\n<\/span>Troubleshooting TLOC Down States and BFD Session Failures<\/span><\/h2>\nWhen a TLOC fails, goes down, or remains in an invalid state, the WAN Edge router cannot form data-plane tunnels. This breaks overlay reachability for client devices in service VPNs.<\/p>\n Use this step-by-step diagnostic workflow to isolate and resolve TLOC failures.<\/p>\n
| | | | | | | | | | | |