> ## Content Index > Fetch the complete content index at: https://www.pinglabz.com/llms.txt > Use this file to discover other available public pages before exploring further. # OMP Deep Dive: Routes, TLOCs, Service Routes, and Path Selection - URL: https://www.pinglabz.com/omp-deep-dive/ - Published: 2026-07-12T09:12:13.000Z - Updated: 2026-08-24T09:44:13.000Z - Description: OMP carries everything in Catalyst SD-WAN: routes, TLOCs, service routes, keys, and policy. This deep dive walks each advertisement type and the path selection logic, with WAN Edge CLI drawn from Cisco's current 20.x documentation. - Author: Jaime - Tags: SD-WAN, BGP, CCIE, #Import 2026-08-01 19:54 OMP is to Catalyst SD-WAN what BGP is to the internet: the one protocol that carries everything. Routes, next-hop locations, service advertisements, encryption keys, policy - all of it rides OMP, over a secure connection to the controllers. If you understand OMP, you understand how an SD-WAN fabric actually forwards a packet. If you do not, the whole thing stays magic. This article is the deep dive: OMP routes, TLOCs, service routes, and path selection. It extends the [complete SD-WAN guide](https://www.pinglabz.com/sd-wan/). As with the rest of this series, the command output is drawn from Cisco's current 20.x documentation and reflects real WAN Edge CLI - a documented reference, clearly labeled, because a full controller stack cannot be driven through a device CLI session. ## What OMP is The Overlay Management Protocol runs between each WAN Edge and the **Controller** (formerly vSmart), over a secure DTLS/TLS connection. The Controller is a route reflector for the entire overlay - edges do not peer with each other, they all peer with the Controllers, which redistribute the information. This is deliberately BGP-like, and the analogy holds all the way down. OMP carries three kinds of advertisement, and understanding the three is understanding OMP: OMP routes The prefixes reachable in each service VPN, and which TLOC (which edge, over which transport) to reach them through. The "what and where to reach it". TLOC routes Transport Locators - the identity of each tunnel endpoint: system-ip + color + encapsulation. The "how to build the tunnel to that edge". The BGP next-hop analogue. Service routes Advertisements of services (firewall, IPS, load-balancer) available at a site, so traffic can be steered through them. The "what's available here". ## The TLOC: the concept that makes SD-WAN make sense A TLOC (Transport Locator) is the single most important idea in the data plane. It uniquely identifies a tunnel endpoint by three things: ``` system-ip : colour : encapsulation e.g. 10.0.0.11 : mpls : ipsec e.g. 10.0.0.11 : biz-internet : ipsec ``` One WAN Edge with two transports (MPLS and internet) has **two TLOCs** \- same system-ip, different color. A remote edge learns both, and can build a tunnel over either transport to reach it. The **color** is how SD-WAN reasons about transports abstractly: "mpls", "biz-internet", "public-internet", "lte" - the color, not the underlay address, is what policy and path selection work with. An OMP route says "prefix 10.20.0.0/24 is reachable via TLOC 10.0.0.11:mpls:ipsec". Resolve the TLOC to its actual tunnel endpoint, build (or reuse) the IPsec tunnel over the MPLS transport, and forward. **That two-step - OMP route points at a TLOC, TLOC resolves to a tunnel - is the entire SD-WAN forwarding model.** It is exactly BGP's "prefix points at a next-hop, next-hop resolves to an interface", lifted into an overlay. ## Verifying OMP on the edge (documented reference) ### OMP routes ``` Edge# show sdwan omp routes PATH ATTRIBUTE VPN PREFIX FROM PEER ID LABEL STATUS TLOC IP COLOR ENCAP --------------------------------------------------------------------------------- 1 10.20.0.0/24 10.0.0.4 1 1002 C,I,R 10.0.0.12 mpls ipsec 1 10.20.0.0/24 10.0.0.4 2 1002 C,I,R 10.0.0.12 biz-internet ipsec ``` The same prefix, reachable via the same remote edge (10.0.0.12) over two colors. `C,I,R` \= chosen, installed, resolved - the healthy state. Two paths means the edge can load-share or fail over between MPLS and internet to reach that prefix. ### TLOCs ``` Edge# show sdwan omp tlocs ADDRESS FAMILY TLOC IP COLOR ENCAP FROM PEER STATUS ------------------------------------------------------------------ ipv4 10.0.0.11 mpls ipsec 0.0.0.0 C,Red,R ipv4 10.0.0.11 biz-internet ipsec 0.0.0.0 C,Red,R ipv4 10.0.0.12 mpls ipsec 10.0.0.4 C,I,R ipv4 10.0.0.12 biz-internet ipsec 10.0.0.4 C,I,R ``` The local edge's own two TLOCs (from peer 0.0.0.0 = self) and the remote edge's two, learned from the Controller (10.0.0.4). This is the map of every tunnel endpoint in the fabric. ### BFD - the tunnels themselves ``` Edge# show sdwan bfd sessions SYSTEM IP SITE ID STATE SOURCE-TLOC REMOTE-TLOC DST-IP PROTO UPTIME ------------------------------------------------------------------------------------ 10.0.0.12 200 up mpls mpls 198.51.100.2 ipsec 1:20:15 10.0.0.12 200 up biz-internet biz-internet 203.0.113.2 ipsec 1:20:14 ``` BFD runs inside every data-plane tunnel and is how SD-WAN measures each path's health - loss, latency, jitter - in real time. `show sdwan bfd sessions` is the data-plane counterpart to `show sdwan omp routes`: OMP tells you what the control plane knows; BFD tells you whether the tunnels actually work. Application-aware routing (covered later) is built directly on these BFD measurements. ## OMP path selection When multiple OMP routes exist for the same prefix, OMP selects among them with a best-path algorithm that is - once again - deliberately BGP-like: 1. **Valid and reachable** routes only (the TLOC must resolve and BFD must be up). 2. **Higher OMP route preference** wins (set by policy - the local-pref analogue). 3. **Lower origin metric.** 4. **OMP route origin type** and other tie-breaks. 5. **Lower TLOC preference,** then TLOC IP, as final tie-breaks. The number of equal-cost paths installed is governed by `send-path-limit` (how many the Controller advertises) and `ecmp-limit` (how many the edge installs). By default an edge advertises each route-TLOC tuple, and a device can have up to eight TLOCs. Understanding this is what lets you reason about "why is my traffic taking MPLS when I wanted internet" - it is an OMP best-path question, answered by policy setting route/TLOC preference. ## OMP vs BGP: the analogy in full **OMP route**\= a BGP prefix (NLRI) **TLOC**\= the BGP next-hop (but richer: color + encap) **Controller (vSmart)**\= a BGP route reflector **OMP route preference**\= local preference **Centralised control policy**\= route-maps applied at the reflector If you know BGP, you already understand 80% of OMP - which is why the CCIE blueprint expects BGP mastery before SD-WAN. The remaining 20% is the TLOC (a next-hop that carries transport identity) and the fact that policy is applied centrally at the Controller rather than per-router. That is genuinely why the OMP deep dive is cross-linked from the [BGP pillar](https://www.pinglabz.com/bgp/): readers who know BGP ask "what is the SD-WAN version of this", and OMP is the answer. ## Troubleshooting OMP 1. **A prefix is missing on an edge?** `show sdwan omp routes` \- is it there but not chosen (a policy filtering it at the Controller), or absent entirely (the originating edge is not advertising it, or its control connection is down)? 2. **Route present but not forwarding?** The TLOC is not resolved, or the BFD session is down. Check `show sdwan omp tlocs` and `show sdwan bfd sessions` \- the tunnel to that TLOC must be up. 3. **Traffic on the wrong transport?** An OMP best-path outcome. Check the route/TLOC preferences a centralised control policy is setting. 4. **Nothing at all?** `show sdwan control connections` first. No control connection to the Controller means no OMP, means nothing. ## Key takeaways - OMP is SD-WAN's BGP - one protocol carrying routes, TLOCs, service routes, keys and policy, between each edge and the Controllers (which act as route reflectors). - A **TLOC** identifies a tunnel endpoint by system-ip + color + encapsulation. An edge with two transports has two TLOCs. It is the BGP next-hop, enriched with transport identity. - Forwarding is two steps: an OMP route points at a TLOC; the TLOC resolves to an IPsec tunnel over a transport. That is the whole data-plane model. - `show sdwan omp routes` / `tlocs` / `bfd sessions` are the three commands that tell you what the control plane knows and whether the tunnels work. - OMP path selection is BGP-like: valid/reachable, then OMP route preference (local-pref), then metrics and TLOC tie-breaks. - Know BGP and you know most of OMP. The new parts are the TLOC and centralised (Controller-applied) policy. Next: [SD-WAN centralized control policy - shaping the overlay](https://www.pinglabz.com/sd-wan-centralized-control-policy/). The full cluster index lives on the [SD-WAN pillar](https://www.pinglabz.com/sd-wan/), cross-linked to [BGP](https://www.pinglabz.com/bgp/).