Retail SD-WAN: Local Breakout, PCI, and Video
RetailCo operates 450 stores. Each store has a 20 Mbps MPLS circuit back to a hub in Dallas and a 100/20 Mbps broadband circuit used only for guest Wi-Fi. Point-of-sale and inventory traffic is backhauled to Dallas; latency to the payment processor in AWS is 140 ms, above the 80 ms target. Video training consumes 6 Mbps per store at peak and is often unusable. The Dallas hub has 2x1 Gbps internet and 1 Gbps MPLS. The company wants direct internet access for SaaS, local breakout for payment, and to keep PCI traffic on a compliant path. There are three WAN engineers. Budget allows SD-WAN but not a full hardware refresh; existing ISR 4331s can run SD-WAN. The CIO asks for a design that reduces MPLS to 10 Mbps per store while keeping voice quality.
1. Design the SD-WAN topology and controller placement. Which sites host controllers, and how many TLOCs should each store have?
Read the worked answer
Use Cisco SD-WAN with a controller cluster in Dallas: two vSmart controllers, two vBond orchestrators, and vManage or a hosted equivalent. For 450 stores, do not place controllers at stores. Each store gets two TLOCs: MPLS (color mpls) and internet (color biz-internet), each with BFD. Keep a hub-and-spoke overlay for PCI and voice to Dallas, and allow direct internet access from the store for SaaS. For payment, use local internet breakout only through a store firewall or a regional security stack; if PCI requires inspection, backhaul POS over the MPLS TLOC to Dallas. A full mesh is unnecessary and would increase tunnel scale. The Dallas hub needs 2x1 Gbps internet and 1 Gbps MPLS; with 450 stores at 10 Mbps MPLS, the hub MPLS is not oversubscribed. Use application-aware routing to prefer MPLS for voice and POS, and internet for SaaS and video.
2. Define application-aware routing policy for voice, POS, and video, including SLA thresholds and deterministic fallback.
Read the worked answer
Define SLA classes: voice latency under 150 ms, jitter under 30 ms, loss under 1%; POS latency under 100 ms, loss under 0.1%; video latency under 200 ms, loss under 1% with FEC. For voice, prefer MPLS, fail to internet only if BFD shows loss or latency above threshold, and use DSCP EF end to end. For POS and PCI, pin to MPLS; if MPLS fails, use an IPsec tunnel over internet to the Dallas firewall, not direct internet. For SaaS, prefer internet with local breakout and measure HTTP response; for video training, use internet with a business policy and 6 Mbps per store, but cap it at 20% of the circuit. Use BFD intervals of 1s x 3 for voice and 3s x 3 for data to avoid flapping. Fallback should be deterministic: primary MPLS, secondary internet, and last-resort drop for PCI rather than violate policy.
3. Calculate the new per-store MPLS requirement and justify 10 Mbps. Which traffic stays on MPLS, and what is the hub oversubscription risk?
Read the worked answer
New MPLS per store: 10 Mbps. Traffic on MPLS: voice 1 Mbps (G.711 plus overhead), POS 0.5 Mbps, inventory 1 Mbps, PCI backups 2 Mbps, control 0.5 Mbps, and burst headroom. That is about 5 Mbps committed; 10 Mbps gives 2x headroom. Video training (6 Mbps) moves to internet DIA, as do SaaS and guest. Do not put video on MPLS; it would consume 60% of the circuit and compete with voice. At Dallas, 450 x 10 Mbps equals 4.5 Gbps if all stores sent line rate, but the hub MPLS is 1 Gbps. Stores do not all burst at once, and the hub only sees PCI, voice, and inventory. Size hub MPLS at 1 Gbps with 2:1 oversubscription and monitor. If PCI backups grow, schedule them off-peak or add a second MPLS link.