Cisco 300-415: OMP, Routes and Transport Locators — Study Guide

By Laurynas Brazys · 14 August 2026 · #cisco #300-415 #certification #exam-prep #study-guide

Part of the Cisco SD-WAN 300-415 ENSDWI — Study Guide. Practice with verified answers in the Cisco exam hub, or take timed practice tests on ExamRoll.io.

Overview

Overlay Management Protocol (OMP) is the Cisco SD-WAN control-plane protocol used between WAN Edge routers and vSmart controllers. vSmart manages the overlay control plane and WAN Edge connectivity, reflecting reachability, policy, and keying information to all sites. Control connections to vSmart use DTLS by default (TLS optional), while data-plane tunnels between WAN Edge devices use IPsec. vBond orchestrates initial device onboarding and brokered connectivity to vSmart. Understanding how OMP distributes vRoutes, TLOCs, and service routes, how attributes drive route and path selection, and how OMP interacts with BGP/OSPF/static routing is essential for stable, scalable designs.

OMP Control Plane and Information Exchange

OMP runs between every WAN Edge and each vSmart controller. WAN Edge devices do not form OMP adjacencies with each other; all exchange is via vSmart, which acts as a route reflector.

Key control-plane exchanges:

• OMP peering: Secure DTLS/TLS control connections from WAN Edge to vSmart across VPN 0. vBond coordinates this first-hop discovery.
• Route distribution: WAN Edge advertises local VPN prefixes (vRoutes), TLOCs (transport reachability), and service routes to vSmart. vSmart reflects eligible routes to other WAN Edges based on policy and loop-prevention rules.
• Policy distribution: vSmart distributes centralized control policies (route advertisement control), data policies (traffic steering), and application-aware routing policies.
• Crypto keying: vSmart distributes keying information so WAN Edge routers can form authenticated IPsec data-plane tunnels.
• Statefulness and convergence: OMP incremental updates carry only changes, with keepalives and hold timers supervising adjacency health. Graceful restart allows devices to retain and mark routes stale during short control-plane outages, preserving forwarding as long as data-plane TLOCs remain up.

Failure modes to consider:

• DTLS/TLS failures (for example DCONFAIL): underlay reachability, firewall/NAT blocking, certificate/time issues, or template misconfiguration.
• Control-policy drops: intended or unintended filtering of vRoutes/TLOCs causes partial reachability.
• Over-subscription at vSmart: insufficient controller capacity or excessive route churn increases convergence time.

OMP Routes, TLOCs, and Attributes

OMP carries three primary route types and a general IP prefix construct.

• vRoute (VPN route): An overlay route to a VPN prefix (IPv4/IPv6) with a next-hop expressed as one or more TLOCs. Attributes include origin, Originator, site ID, VPN ID, preference, tag, and the TLOC set. vSmart uses these to reflect to other sites and to enforce policy and loop prevention.
• TLOC route: Advertises a transport location—the tuple that identifies a WAN Edge transport endpoint. A TLOC is uniquely defined by system IP, color, and encapsulation. TLOC routes let all peers learn how to reach each transport underlays for building IPsec tunnels.
• Service route: Advertises a service present in a VPN (for example, firewall, IDS/IPS, L4–7 services). Used with service chaining to steer traffic via service nodes.
• IP prefix: The prefix itself (IPv4/IPv6) in the VPN; practically, the vRoute carries the IP prefix plus next-hops (TLOCs). Policies can match on the IP prefix element when filtering or setting attributes.

TLOC attributes and their roles:

• System IP: The SD-WAN router ID; part of the TLOC key (system-ip, color, encapsulation).
• Color: Logical transport label indicating the WAN underlay (for example, mpls, biz-internet, public-internet, private variants). Colors drive policy and preferred underlay selection.
• Encapsulation: IPsec (default) or GRE. Determines data-plane tunnel type. Encapsulation must match between peers on a given TLOC pair.
• Preference: Relative priority for TLOC selection; higher preference is chosen first among multiple TLOC options. Useful for active/backup across transports (for example, MPLS preferred over Internet).
• Weight: Used for weighted load-balancing across ECMP TLOCs of equal preference. Higher weight increases traffic share.
• Tag: A policy label for grouping/selection (no forwarding semantics by itself).

Design and operational guidance:

• Advertise at least two TLOCs per site for high availability and transport diversity. Use preference for primary/backup behavior; use weight for proportional ECMP when equal-cost paths are desired.
• Keep colors semantically consistent across the fabric to simplify control policies and application-aware routing.
• Verify encapsulation alignment and NAT characteristics per transport; mismatches or asymmetric NAT can prevent IPsec SA formation even if OMP control is up.

Advertisement, Redistribution, Selection, and Loop Prevention

Route advertisement and selection occur at two layers: within OMP and within the local RIB on WAN Edges.

Within OMP:

• WAN Edge originates local routes (connected, static, BGP, OSPF) into OMP per VPN if permitted by route-policy. Summarization and tagging can be applied at origination or on vSmart.
• vSmart reflects vRoutes and TLOCs to other sites according to control policy. By default, vSmart does not reflect a route back to the same site ID from which it was learned, preventing site-internal loops across redundant routers.
• OMP route selection compares attributes in order: higher OMP preference, lowest origin type (if applicable), lowest MED-like metric (if present), and deterministic tiebreakers such as Originator and router IDs. Among equal vRoutes, multiple TLOC next-hops can be retained for ECMP.

Between routing protocols on the WAN Edge (administrative preference):

• The RIB compares candidates from connected, static, BGP, OSPF, and OMP. By default, locally sourced routes (connected/static) and underlay IGP/BGP are preferred over OMP for identical prefixes. This avoids mistakenly preferring an overlay-learned copy of a locally reachable network.
• If you must prefer OMP for specific prefixes (for example, to avoid asymmetric return over underlay), use route filtering or longer-prefix advertisements rather than relying on global preference changes.

Interoperability and redistribution:

• OSPF: Redistribute OSPF into OMP from branch/DC VPNs with explicit prefix filters. When exporting OMP into OSPF at DCs, avoid readvertising routes learned from the other DC via the DCI.
• BGP: Use OMP-to-BGP and BGP-to-OMP redistribution at DC edges to integrate with the data center core. To prevent routing loops and duplicate learning across a DCI between two DC WAN Edge sets, configure the same overlay AS on both DCs. The overlay AS participates in AS-path loop-prevention logic when OMP-learned routes are injected into BGP and vice versa, stopping routes from bouncing between DCs.
• Static: Use for default route origination into OMP or for specific reachability, with strict policy guardrails to avoid accidentally blackholing traffic.
• Site ID: Assign the same site ID to redundant WAN Edge routers at the same physical site. vSmart will withhold re-advertising a site’s own vRoutes back to that site, preventing overlay loops. Different physical sites must use unique site IDs.

Route leaking between service VPNs:

• Use centralized control-policy to export selected prefixes from one VPN to another, then import on the target VPN. Leaking occurs in the control plane; no VRF route-targets exist—policy performs the role.
• Apply least privilege: match explicit prefixes or tags, set appropriate communities/tags, and avoid leaking 0/0 or broad summaries unless intended.
• Consider security policy: leaked routes may bypass security zones; coordinate with zone-based firewall, segmentation, and service chains.

TLOC extension and dual transport:

• TLOC extension lets one WAN Edge share a transport circuit connected to another WAN Edge over a LAN interface. This enables dual-transport reachability when only one device physically terminates a given underlay.
• Benefits: retains transport diversity and active/backup behavior per TLOC preference without duplicating CPE.
• Risks: introduces failure domains (if the owning edge fails, the extended transport is lost), consumes LAN bandwidth, and can create asymmetric paths. Use fast BFD and clearly defined primary/backup preferences.

High Availability, Timers, and Scale Considerations

Graceful restart:

• OMP supports graceful restart so that upon control-plane interruptions (for example, vSmart reload or network flap), receiving peers mark routes as stale and retain them while attempting to reestablish peering. Data-plane IPsec tunnels and BFD keep traffic flowing if TLOCs remain up.
• When stale timers expire without recovery, stale routes are withdrawn to prevent blackholes. Enable graceful restart on both WAN Edge and vSmart for consistent behavior.

Hold timers and liveliness:

• OMP peering uses periodic keepalives on the DTLS/TLS control session. The hold timer determines when a nonresponsive peer is declared down. Tuning is rarely required; focus on underlay stability and jitter control to avoid false positives.
• Data-plane liveliness is independent: BFD over each IPsec tunnel drives fast failure detection and steering between TLOCs.

Scalability:

• Scale vSmart horizontally; deploy at least two vSmart controllers for redundancy and capacity. vSmart reflects routes; capacity planning must account for total vRoutes, TLOCs, update rate, and policy complexity.
• Constrain churn with summarization at branches, controlled prefix origination at DCs, judicious use of service routes, and careful policy design (avoid per-prefix policy explosions).
• Prefer centralized control-policy for aggregation and selective advertisement; use tags to group sites/prefixes rather than long ACLs.

Verification and troubleshooting essentials:

• Control connections and certificates:
  • show control connections
  • show control local-properties
• OMP health and content:
  • show omp peers
  • show omp routes
  • show omp tlocs
  • show omp services
• IOS XE SD-WAN equivalents:
  • show sdwan control connections
  • show sdwan omp peers
  • show sdwan omp routes
  • show sdwan omp tlocs
• Data-plane and reachability:
  • show bfd sessions
  • show ip route vpn <id>
  • ping vpn <id> <prefix> tloc <color system-ip encap>
• Common issues:
  • No OMP routes: control-policy blocking, site-ID loop-prevention at play, or certificate/identity mismatch.
  • TLOC advertised but no data-plane tunnel: encapsulation mismatch, NAT traversal blocked, incompatible colors or preferences restricting use.
  • Duplicate or looping DC routes: missing overlay AS alignment, missing outbound BGP filters at the DCI edge, or leaking OMP-learned routes back into OMP via underlay.

Practical Problem Scenario

Acme Beverages operates two data centers (DC1 and DC2) with a Layer 3 DCI and several Internet/MPLS-connected branches. They observe duplicate LAN routes and intermittent asymmetric paths after enabling OMP↔BGP redistribution at both DCs.

Approach:

1. Align overlay AS at both DCs

• Configure the same overlay AS on DC1 and DC2 WAN Edge routers.
• Rationale: Ensures AS-path loop prevention when redistributing OMP into BGP and vice versa, preventing each DC from reimporting the other’s OMP-learned routes via the DCI.

2. Tighten BGP/OMP redistribution policies

• On WAN Edges, match only DC-local LAN prefixes into OMP; prevent importing DCI-learned prefixes into OMP.
• In the BGP direction, tag OMP-derived routes and block readvertisement back toward the fabric or DCI as appropriate.
• Rationale: Least-privilege advertisement eliminates route echoes and scope creep that produces duplicates.

3. Use OMP control-policy for summarization

• Summarize DC LANs into coarse aggregates in control-policy on vSmart; preserve specific exceptions as needed.
• Rationale: Reduces route scale and churn, making duplicate detection less likely and accelerating convergence.

4. Normalize TLOC preferences for transport behavior

• Set higher TLOC preference for MPLS and lower for Internet at branches and DCs; use weight for ECMP only on like-quality links.
• Rationale: Deterministic primary/backup behavior prevents flapping across dissimilar transports and reduces asymmetry.

5. Validate site IDs and same-site suppression

• Ensure redundant WAN Edges in each DC share the same site ID; branches have unique site IDs.
• Rationale: vSmart’s same-site suppression prevents a site from receiving its own routes back, averting site-internal loops.

6. Verify control-plane and data-plane health

• Run:

  show control connections
  show omp peers
  show omp routes vpn 10
  show omp tlocs
  show sdwan omp routes | inc <DC LAN prefix>
  show bfd sessions
  

• Rationale: Confirms that OMP peering is stable, expected summaries are present, no unintended prefixes leak through, and data-plane tunnels are healthy.

7. Stage and commit changes with monitoring

• Apply policies in maintenance windows, monitor route tables at branches (show ip route vpn X), and use synthetic probes via application-aware routing.
• Rationale: Ensures the policy achieves deduplication without collateral impact, and provides rollback checkpoints.

By aligning overlay AS, enforcing precise redistribution, summarizing at vSmart, and normalizing TLOC selection, Acme eliminates duplicate routes and stabilizes path selection across both DCs and all branches.

← Controller Onboarding · All domains · WAN Edge Configuration and Template Management →

Practice these questions → · Timed practice on ExamRoll.io →