WAN and SD-WAN Design
Domain 3 - WAN and SD-WAN Design is the heaviest weighted area. It tests transport and topology selection, Cisco SD-WAN control and data plane, policy, application-aware routing, and high availability.
Transport and topology selection
MPLS L3VPN gives deterministic SLA and any-to-any reachability; Internet with IPsec gives bandwidth at lower cost; DIA and LTE/5G serve as local breakout and backup. Topology follows traffic flows: hub-and-spoke for flows through a central data center, regional hubs or partial mesh for latency, full mesh only when justified. Legacy DMVPN is mGRE plus NHRP plus IPsec.
Cisco SD-WAN anatomy
Controllers: vManage (management), vSmart (OMP control plane), vBond (orchestration and NAT traversal). Data plane devices expose TLOCs - system-IP plus color - and advertise routes via OMP with site-id, preference, and service VPN. Colors name the transport (mpls, biz-internet, lte). OMP control policy defines topology (hub-and-spoke, full mesh, custom with affinity and regions), traffic engineering, and cflowd export.
Policy, SLA, and QoS
Application-aware routing uses SLA classes for delay, loss, and jitter, measured per tunnel by BFD, to steer each application per VPN. Data policy provides QoS shaping to the contracted rate, ACLs, NAT, and local internet exit. Cloud OnRamp for SaaS keeps trusted SaaS traffic at the branch while backhauling only what needs inspection or central logging.
Worked example
40 branches, each with MPLS at 100 Mbps (color mpls) and Internet at 500 Mbps (color biz-internet), plus one data center hub. Voice requires delay <=150 ms, loss <=1%, jitter <=30 ms; Teams should egress locally; ERP stays central. Design: two TLOCs per branch, a control policy advertising only the data center and default from the hub to spokes, and an app-route policy sending voice over MPLS with Internet fallback on SLA violation. Size hub cEdges for 40 tunnels at the committed rates plus tunnel overhead.
Traps
- Believing app-aware routing creates bandwidth; it only chooses among existing paths.
- Forgetting tunnel overhead and MTU/PMTUD on 1500-byte paths.
- A control policy that accidentally builds a full mesh and saturates hubs.
- QoS policy without shaping, which is ignored by the provider.