# OpenStack Network Architecture Notes (Overlay/Underlay, Neutron, SDN)

Date: 2026-03-07
Audience: Platform, Network, SRE, Security teams.

## Architecture Summary

- Underlay: physical L2/L3 fabric across racks and zones.
- Overlay: tenant-isolated virtual networks implemented by OpenStack Neutron.
- Control Plane: Neutron API + ML2 plugin + message bus.
- Data Plane: virtual switching and encapsulation (for example VXLAN/Geneve depending on deployment profile).

## Overlay vs Underlay Responsibilities

### Underlay
- Provides IP reachability between compute and network nodes.
- Carries encapsulated tenant traffic.
- Enforces physical redundancy and routing policies.

### Overlay
- Provides tenant isolation and logical network abstraction.
- Supports virtual networks, subnets, routers, and security groups.
- Decouples tenant address spaces from physical topology.

## OpenStack Neutron Components

- Neutron Server: northbound API and orchestration logic.
- ML2 Plugin: network type drivers and mechanism drivers.
- L2 Agent / OVS Agent: programs local forwarding rules.
- L3 Agent: virtual routing/NAT functions.
- DHCP Agent: dynamic address assignment for tenant networks.
- Metadata Agent: instance metadata path.

## SDN Model in This Reference

- SDN control intent is expressed through Neutron resources.
- Virtual forwarding behavior is programmed by Neutron agents/mechanism drivers.
- Security policy is applied via security groups and ACL-like rules.

## Operational Transparency Checklist

- Document network type per tenant network (flat/vlan/vxlan/geneve).
- Document encapsulation MTU policy and fragmentation strategy.
- Document east-west and north-south traffic paths.
- Document failure domains and failover strategy.
- Document monitoring points for latency, packet loss, and throughput.

## Recommended Validation Items

- Overlay-to-underlay MTU validation.
- Cross-zone connectivity and failover test.
- Security group policy enforcement test.
- Routing convergence test under node/link failure.
- Capacity test for encapsulated traffic.