An underlay network is the underlying transport network that carries packets between devices, servers, sites, or data centres. It provides the physical or logical connectivity, routing, and switching that overlay networks build on top of, and its reachability, segmentation, and performance directly shape how those overlays behave.
What an underlay network does
An underlay network is the transport fabric that moves traffic between hosts, sites, and data centres. It is the base network layer that carries packets for whatever overlay, application, or segmentation model is built on top of it.
Because the underlay supplies reachability, routing, switching, and often basic segmentation boundaries, it is not just plumbing. Its design choices determine whether higher-level networks can communicate cleanly, fail over predictably, and preserve the performance and isolation assumptions that depend on the physical or logical transport.
How underlay networks relate to overlays
Overlay networks are abstractions, but they still depend on the underlay to move their encapsulated traffic. When the underlay is stable, the overlay can present a consistent logical topology across racks, clusters, sites, or clouds; when the underlay is inconsistent, the overlay inherits that instability in the form of loss, latency, asymmetric paths, or failed adjacencies.
This relationship is why underlay problems often appear as symptoms higher up the stack. An application may report timeouts, an SD-WAN path may flap, or a segmentation policy may behave unpredictably, while the root cause is actually routing, MTU, link capacity, ECMP behaviour, or reachability in the transport layer.
Why underlay design matters for security and resilience
The underlay is a security boundary only in a limited sense, but it strongly influences what an attacker can reach and how far they can move. If routing, segmentation, or path controls are weak, the transport fabric can unintentionally expose management planes, east-west traffic, or inter-site dependencies that an overlay assumes are separated.
Underlay performance also matters for resilience. Congestion, packet loss, or poor convergence can degrade authentication flows, service discovery, replication, and monitoring, which makes security tooling less reliable and incident response slower. In practice, the underlay is part of the trust chain that keeps logical controls usable.
Operational characteristics to watch
Operators usually evaluate an underlay network by reachability, latency, throughput, convergence time, and the consistency of routing and segmentation across the fabric. Those characteristics determine whether overlays remain portable and whether failover behaves the same way across sites or availability zones.
Good underlay practice also includes predictable addressing, clear route advertisement boundaries, and visibility into hop-by-hop behaviour. Without that, troubleshooting becomes guesswork and teams can misattribute a transport problem to an overlay policy or application defect.
Risk and Threat Considerations
Underlay failures create broad blast radius because every overlay and service above them inherits the same transport dependency. A misrouted prefix, failed link, or overly permissive interconnect can expose more systems than intended, while a degraded fabric can hide or delay detection of malicious movement across the network.
Failure mechanism: Weak segmentation, routing mistakes, or compromised transport devices can collapse intended boundaries, allow unintended reachability, or disrupt the paths that security controls depend on.
Impact: Attackers may gain lateral movement opportunities, security monitoring may lose fidelity, and business services may suffer wide-area instability or outage when the underlying transport no longer matches the assumed topology.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.IR-01 — Network resilience is managed to support delivery of critical services | Underlay transport resilience directly affects service continuity and recovery. |
| Recommendation — Design transport resilience so overlay-dependent services keep operating during link or path failures. | ||
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Underlay segmentation and reachability shape whether network boundaries are enforced. |
| AC-4 — Information Flow Enforcement | Underlay routing and segmentation govern how traffic can flow across network paths. | |
| Recommendation — Enforce boundary protection at the transport layer to limit unintended reachability between zones. Apply information flow rules to the transport fabric so traffic only traverses approved paths. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Underlay networks are network infrastructure that must be tracked, hardened and monitored. |
| Recommendation — Inventory, configure, and monitor network infrastructure so routing and segmentation remain controlled. | ||
| NIST Zero Trust (SP 800-207) | SC-2 — Verify and Segment | Zero trust depends on segmentation and path control beneath overlays and applications. |
| Recommendation — Segment the underlay so network paths are explicitly verified and constrained. | ||
Practitioner Guidance
Why practitioners should care: Treat the underlay as a dependency that must be designed, documented, and tested separately from the overlay. The most common mistake is assuming that logical segmentation automatically protects the transport layer underneath it.
What to watch for: Recurrent route instability, asymmetric paths, unexpected inter-site reachability, and unexplained overlay symptoms often point to underlay issues rather than application defects. Validate the transport fabric first when those patterns appear.
Practitioner takeaway: An overlay can only be as reliable and defensible as the underlay that carries it, so transport design and monitoring deserve the same operational discipline as higher-level network policy.
Related resources from NHI Mgmt Group
- What is the difference between a software-defined zero trust overlay and a traditional underlay network for OT connectivity?
- Why has identity replaced the network perimeter as the primary security boundary?
- Why are identity-based attacks growing faster than traditional network attacks?
- What is the difference between network controls and identity controls for infrastructure access?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org