SD-WAN Overlay & Underlay · OnStak Use Case

Know it’s the ISP, not the overlay.

When a third of incidents get pinned on the SD-WAN overlay and no one can see the ISP underneath, the real fault goes unfixed. Here is how a $66B financial holding got 100% path visibility and stopped the false alarms.

100%

overlay and underlay path visibility

3-5 min

ISP routing-change detection

75% fewer

false SD-WAN escalations

Network operations center monitoring SD-WAN overlay and underlay

Story highlights

  • Full path, finally visible. Overlay and underlay testing achieved 100% path visibility, including the ISP underlay that was dark before.
  • False alarms cut. 75% of incidents wrongly blamed on the SD-WAN overlay stopped being misrouted.
  • WAN made dependable. ISP routing changes were caught in 3-5 minutes, and WAN availability rose to 99.95%.

The situation

A $66B holding blind below the overlay.

The financial holding could not see its ISP underlay routing, so 30-40% of incidents were wrongly blamed on the SD-WAN overlay, and peak-hour packet loss ran high with no real-time path data. They set out to see both layers.

The problem

The overlay took the blame for the underlay.

With no view of the ISP layer, the wrong culprit got named again and again. Three things drove it.

ISP underlay was dark

Zero visibility into ISP underlay routing.

The overlay was mis-blamed

30-40% of incidents were wrongly pinned on the SD-WAN overlay.

No real-time path data

Peak-hour packet loss hit 180 to 220ms with nothing to trace it.

What OnStak did

See both layers, tell them apart.

OnStak tested overlay and underlay together and built dashboards that separated network from application.

1

Tested both layers

Overlay and underlay testing with enterprise and cloud agents.

2

Caught ISP changes live

Real-time ISP routing-change detection.

3

Separated network from app

Dashboards that distinguished network issues from application issues.

4

Ended the mis-routing

Incidents went to the right team the first time.

What changed

From mis-blaming the overlay to seeing the true fault.

Before

The overlay took the blame.

  • ISP underlay routing was invisible.
  • 30-40% of incidents wrongly blamed on the overlay.
  • No real-time path data during peak hours.
After, with OnStak

Now both layers are in view.

  • 100% overlay and underlay path visibility.
  • ISP routing changes caught in 3-5 minutes.
  • False SD-WAN escalations down 75%.

The outcome

Anonymized financial holding · $66B in assets

Both layers in view, the right team every time.

100%
Path visibility
Overlay and underlay.
3-5 min
ISP change detection
Routing changes caught fast.
75%
Fewer false escalations
SD-WAN wrongly blamed no longer.
99.95%
WAN availability
Increased to 99.95%.

The idea that holds it together

Blame is cheap; visibility is the fix.

“When you can see both layers, the incident goes to the right team the first time.”

Awais Janjua  /  Chief Technology Officer, OnStak

Built on
Splunk observability platform Enterprise + cloud agents Overlay + underlay testing ISP routing-change detection Network-vs-application dashboards

Coffee? No Slides

No pitch deck. No 47-page proposal. Just a straight talk about what’s broken and what to fix first.

  • Solutions
  • Debrief
  • About Us