OMP is to Catalyst SD-WAN what BGP is to the internet: the one protocol that carries everything. Routes, next-hop locations, service advertisements, encryption keys, policy - all of it rides OMP, over a secure connection to the controllers. If you understand OMP, you understand how an SD-WAN fabric actually forwards a packet. If you do not, the whole thing stays magic.
This article is the deep dive: OMP routes, TLOCs, service routes, and path selection. It extends the complete SD-WAN guide. As with the rest of this series, the command output is drawn from Cisco's current 20.x documentation and reflects real WAN Edge CLI - a documented reference, clearly labelled, because a full controller stack cannot be driven through a device CLI session.
What OMP is
The Overlay Management Protocol runs between each WAN Edge and the Controller (formerly vSmart), over a secure DTLS/TLS connection. The Controller is a route reflector for the entire overlay - edges do not peer with each other, they all peer with the Controllers, which redistribute the information. This is deliberately BGP-like, and the analogy holds all the way down.
OMP carries three kinds of advertisement, and understanding the three is understanding OMP:
The TLOC: the concept that makes SD-WAN make sense
A TLOC (Transport Locator) is the single most important idea in the data plane. It uniquely identifies a tunnel endpoint by three things:
system-ip : colour : encapsulation
e.g. 10.0.0.11 : mpls : ipsec
e.g. 10.0.0.11 : biz-internet : ipsecOne WAN Edge with two transports (MPLS and internet) has two TLOCs - same system-ip, different colour. A remote edge learns both, and can build a tunnel over either transport to reach it. The colour is how SD-WAN reasons about transports abstractly: "mpls", "biz-internet", "public-internet", "lte" - the colour, not the underlay address, is what policy and path selection work with.
An OMP route says "prefix 10.20.0.0/24 is reachable via TLOC 10.0.0.11:mpls:ipsec". Resolve the TLOC to its actual tunnel endpoint, build (or reuse) the IPsec tunnel over the MPLS transport, and forward. That two-step - OMP route points at a TLOC, TLOC resolves to a tunnel - is the entire SD-WAN forwarding model. It is exactly BGP's "prefix points at a next-hop, next-hop resolves to an interface", lifted into an overlay.
Verifying OMP on the edge (documented reference)
OMP routes
Edge# show sdwan omp routes
PATH ATTRIBUTE
VPN PREFIX FROM PEER ID LABEL STATUS TLOC IP COLOR ENCAP
---------------------------------------------------------------------------------
1 10.20.0.0/24 10.0.0.4 1 1002 C,I,R 10.0.0.12 mpls ipsec
1 10.20.0.0/24 10.0.0.4 2 1002 C,I,R 10.0.0.12 biz-internet ipsecThe same prefix, reachable via the same remote edge (10.0.0.12) over two colours. C,I,R = chosen, installed, resolved - the healthy state. Two paths means the edge can load-share or fail over between MPLS and internet to reach that prefix.
TLOCs
Edge# show sdwan omp tlocs
ADDRESS
FAMILY TLOC IP COLOR ENCAP FROM PEER STATUS
------------------------------------------------------------------
ipv4 10.0.0.11 mpls ipsec 0.0.0.0 C,Red,R
ipv4 10.0.0.11 biz-internet ipsec 0.0.0.0 C,Red,R
ipv4 10.0.0.12 mpls ipsec 10.0.0.4 C,I,R
ipv4 10.0.0.12 biz-internet ipsec 10.0.0.4 C,I,RThe local edge's own two TLOCs (from peer 0.0.0.0 = self) and the remote edge's two, learned from the Controller (10.0.0.4). This is the map of every tunnel endpoint in the fabric.
BFD - the tunnels themselves
Edge# show sdwan bfd sessions
SYSTEM IP SITE ID STATE SOURCE-TLOC REMOTE-TLOC DST-IP PROTO UPTIME
------------------------------------------------------------------------------------
10.0.0.12 200 up mpls mpls 198.51.100.2 ipsec 1:20:15
10.0.0.12 200 up biz-internet biz-internet 203.0.113.2 ipsec 1:20:14BFD runs inside every data-plane tunnel and is how SD-WAN measures each path's health - loss, latency, jitter - in real time. show sdwan bfd sessions is the data-plane counterpart to show sdwan omp routes: OMP tells you what the control plane knows; BFD tells you whether the tunnels actually work. Application-aware routing (covered later) is built directly on these BFD measurements.
OMP path selection
When multiple OMP routes exist for the same prefix, OMP selects among them with a best-path algorithm that is - once again - deliberately BGP-like:
- Valid and reachable routes only (the TLOC must resolve and BFD must be up).
- Higher OMP route preference wins (set by policy - the local-pref analogue).
- Lower origin metric.
- OMP route origin type and other tie-breaks.
- Lower TLOC preference, then TLOC IP, as final tie-breaks.
The number of equal-cost paths installed is governed by send-path-limit (how many the Controller advertises) and ecmp-limit (how many the edge installs). By default an edge advertises each route-TLOC tuple, and a device can have up to eight TLOCs. Understanding this is what lets you reason about "why is my traffic taking MPLS when I wanted internet" - it is an OMP best-path question, answered by policy setting route/TLOC preference.
OMP vs BGP: the analogy in full
If you know BGP, you already understand 80% of OMP - which is why the CCIE blueprint expects BGP mastery before SD-WAN. The remaining 20% is the TLOC (a next-hop that carries transport identity) and the fact that policy is applied centrally at the Controller rather than per-router. That is genuinely why the OMP deep dive is cross-linked from the BGP pillar: readers who know BGP ask "what is the SD-WAN version of this", and OMP is the answer.
Troubleshooting OMP
- A prefix is missing on an edge?
show sdwan omp routes- is it there but not chosen (a policy filtering it at the Controller), or absent entirely (the originating edge is not advertising it, or its control connection is down)? - Route present but not forwarding? The TLOC is not resolved, or the BFD session is down. Check
show sdwan omp tlocsandshow sdwan bfd sessions- the tunnel to that TLOC must be up. - Traffic on the wrong transport? An OMP best-path outcome. Check the route/TLOC preferences a centralised control policy is setting.
- Nothing at all?
show sdwan control connectionsfirst. No control connection to the Controller means no OMP, means nothing.
Key takeaways
- OMP is SD-WAN's BGP - one protocol carrying routes, TLOCs, service routes, keys and policy, between each edge and the Controllers (which act as route reflectors).
- A TLOC identifies a tunnel endpoint by system-ip + colour + encapsulation. An edge with two transports has two TLOCs. It is the BGP next-hop, enriched with transport identity.
- Forwarding is two steps: an OMP route points at a TLOC; the TLOC resolves to an IPsec tunnel over a transport. That is the whole data-plane model.
show sdwan omp routes/tlocs/bfd sessionsare the three commands that tell you what the control plane knows and whether the tunnels work.- OMP path selection is BGP-like: valid/reachable, then OMP route preference (local-pref), then metrics and TLOC tie-breaks.
- Know BGP and you know most of OMP. The new parts are the TLOC and centralised (Controller-applied) policy.
Next: SD-WAN centralized control policy - shaping the overlay. The full cluster index lives on the SD-WAN pillar, cross-linked to BGP.
