Retail Store Connectivity After MPLS
A retailer operates 180 stores, each with point-of-sale, inventory sync, and video upload. Peak store traffic is 20 Mbps, and POS calls must reach us-east-2 in under 80 ms. The current MPLS contract costs $4,800 per store per month and expires in six months. Finance requires a 40% network cost reduction. Stores have business fiber from one ISP, consumer broadband as a second path, and LTE available. PCI DSS requires cardholder traffic to be encrypted and segmented from guest Wi-Fi, and the security team forbids direct internet exposure of POS systems. The company already has two 1 Gbps Direct Connect connections into us-east-2 and a transit gateway. A pilot at 10 stores showed 55 ms average latency over IPsec VPN but 3 hours of downtime when the fiber ISP failed.
1. Recommend a replacement connectivity model for the stores. Justify it against cost, latency, and PCI constraints.
Read the worked answer
Recommendation: replace per-store MPLS with an SD-WAN overlay over business fiber, using IPsec tunnels to the existing Direct Connect gateways and LTE as failover. Do not extend Direct Connect to every store.
Reasoning: A 40% reduction from $4,800 per store is aggressive if each store keeps private MPLS. The pilot already showed 55 ms average latency over IPsec, which is inside the 80 ms target, so the public internet is viable when encrypted. Direct Connect per store would preserve private connectivity but is far too expensive and operationally heavy for 180 sites. The existing two 1 Gbps Direct Connect connections can aggregate store traffic into us-east-2, and the transit gateway can route it to inspection and POS VPCs. PCI does not require MPLS; it requires encryption, segmentation, and access control. The tradeoff is that internet quality varies by store, so contract business fiber with an SLA and keep LTE for business continuity. Guest Wi-Fi must not share the POS overlay.
2. The pilot had three hours of downtime when the fiber ISP failed. How should the design prevent that?
Read the worked answer
Recommendation: use two diverse underlay paths per store, preferably different ISPs or fiber plus LTE, with BGP or SD-WAN health checks that fail over automatically. Test failover under load, not just with pings.
Reasoning: Three hours of downtime suggests the second path was not actually usable, was not monitored, or required manual intervention. A backup link that is not tested is not a recovery plan. The SD-WAN device should probe the POS application through each tunnel, not only the internet, and switch when latency or loss crosses a threshold. LTE should be sized for POS and inventory traffic; video upload can be deprioritized or queued during failover. Keep local POS processing tolerant of brief WAN loss so cards can still be authorized if the store has a local gateway. The tradeoff is cost and complexity at 180 sites, but it is still below MPLS. Run quarterly failover tests and track mean time to restore by store cohort.
3. How should PCI segmentation and internet breakout be designed for guest Wi-Fi and POS traffic?
Read the worked answer
Recommendation: separate POS and guest traffic at the store into distinct VRFs or VLANs, send POS traffic only through the encrypted overlay to a centralized inspection VPC, and give guest Wi-Fi a local internet breakout with no route into POS.
Reasoning: The security team forbids direct internet exposure of POS systems, so POS should not accept inbound connections and should not use a public breakout. Route POS traffic over IPsec to the transit gateway, inspect it with AWS Network Firewall or a security VPC, and then reach the payment application. Guest Wi-Fi is lower risk but higher volume; backhauling it to us-east-2 wastes Direct Connect capacity and adds latency, so local breakout is appropriate if it is isolated. Disable split tunneling on POS devices and use distinct credentials and certificates per store. The tradeoff is that centralized inspection adds a hop and cost, but it gives one policy enforcement point and consistent logging for PCI evidence.