SD-WAN was sold to the enterprise as liberation from the private circuit, and the fiber backbone was quietly recast as legacy plumbing. Both characterizations are wrong. At scale, the overlay and the underlay are not competitors; they are two halves of a resilience architecture, and networks fail when their operators only understand one of them.
The Overlay Illusion
An SD-WAN fabric measures loss, latency, and jitter across its tunnels and steers application flows toward the best path, typically re-evaluating on sub-second probe intervals. This is genuinely valuable. It masks brownouts that would have required a human and a maintenance window a decade ago. But the overlay can only choose among the paths the underlay actually provides. If both of a site’s transports ride the same metro fiber ring, or the same long-haul conduit along a rail corridor, the SD-WAN controller is selecting between two names for one failure domain.
This is where large deployments go wrong. Diversity is purchased at the circuit level, from different providers, at different price points, and assumed at the physical level. Yet carriers lease capacity from one another constantly, and two logos on two invoices are no guarantee of two trenches. A backhoe does not consult your vendor matrix before it digs.
An overlay can only be as resilient as the diversity of the glass beneath it, and diversity is something you must verify, not something you can configure.
Engineering the Underlay Deliberately
Treating the fiber backbone as a first-class design object changes the questions you ask during procurement. Demand KMZ route files, not just service descriptions, and overlay them to find shared conduit, shared bridge crossings, and shared building entrances. Insist on diverse entry points into your critical facilities; a site with two carriers entering through one duct bank has one circuit with extra billing. Where true path diversity is unavailable, say so in the risk register instead of letting the topology diagram imply otherwise.
On the transport side, modern coherent optics and ROADM-based line systems give backbone operators restoration options that complement the overlay: optical-layer protection switching for fast, coarse recovery, and IP/MPLS or segment-routed TE paths for granular traffic engineering above it. The design goal is layered recovery with distinct time constants, so each layer handles the failures it sees best rather than all layers reacting at once to the same event.
Making the Layers Cooperate
The subtle failure mode at scale is interaction between recovery mechanisms. If the optical layer restores a path in tens of milliseconds while the SD-WAN probes declare the tunnel dead and swing thousands of flows to a backup transport, you get oscillation: flows sloshing between paths, TCP sessions resetting, and voice quality degrading on a link that was technically healed. Tuning matters here. Overlay failover thresholds should be deliberately slower than underlay restoration, with hold-down and dampening intervals sized so each layer finishes its work before the next one intervenes.
A few practices consistently separate resilient deployments from fragile ones:
- Map every tunnel to its physical route and maintain that mapping as circuits are groomed and re-homed.
- Schedule failure rehearsals that disable transports at the physical or provider level, not just at the tunnel interface.
- Export overlay path-quality telemetry into the same observability platform as backbone optical and routing metrics.
- Review carrier maintenance notices against your diversity map, because grooming events silently collapse paths that were diverse at installation.
Resilience as a Continuous Audit
The uncomfortable truth is that resilience decays. Circuits are re-groomed, carriers consolidate, buildings change owners, and the diversity you validated at turn-up erodes without any change on your side. The architecture that survives is one that treats path diversity as a living inventory with an owner and a review cadence, and that treats the SD-WAN layer as an intelligent consumer of that inventory rather than a substitute for it.
When both layers are engineered on purpose, the result is genuinely impressive: fiber cuts that users never notice, brownouts absorbed by application-aware steering, and maintenance windows that stop being all-hands events. When only the overlay is engineered, the result is a dashboard full of green tunnels riding one strand of glass. The difference between those two networks is not the software they bought. It is whether anyone did the unglamorous work of knowing where the fiber actually goes.