I85PREP
⌘ K
CCDE study materials
CCDE study resources

CCDE: Enterprise WAN and Service Provider Edge Design

CCDE · Work through your exam, one topic at a time.

All guide sections

Enterprise WAN and Service Provider Edge Design

This domain covers WAN service selection, provider edge interaction, enterprise BGP edge policy, overlay designs, and the operational realities of hybrid WAN.

Choosing the transport

Compare Internet DIA, MPLS Layer 3 VPN, Carrier Ethernet (E-Line, E-LAN, E-Tree), broadband, and LTE/5G backup on: SLA and jitter guarantees, any-to-any vs point-to-point, QoS treatment, cost per Mbps at each site, lead time, and encryption requirements. MPLS gives any-to-any with provider-enforced QoS and no encryption obligation; Internet gives price and ubiquity but requires IPsec and offers no delivery guarantee; Carrier Ethernet is strong for site-to-site large flows and data center interconnects.

PE–CE and enterprise edge routing

PE–CE options are eBGP (loop-safe via AS_PATH, policy-rich), OSPF or EIGRP in a VRF, or static with redistribution. Inside the enterprise, run iBGP on the edge routers with route reflectors and policy applied at the edge. Control what you accept: full Internet table only where memory and CPU allow, otherwise default plus specific prefixes. Apply inbound prefix filters, maximum-prefix limits, and RPKI origin validation. The BGP best-path order matters: weight, local preference, locally originated, AS_PATH length, origin, MED, eBGP over iBGP, IGP metric, then tie-breakers.

Overlays and hybrid WAN

DMVPN Phase 3 with NHRP, IPsec and per-tunnel QoS gives hub-spoke with spoke-to-spoke shortcuts. SD-WAN builds IPsec overlays over multiple underlays with application-aware path selection, per-path QoS and centralized policy, but demands strong underlay monitoring to distinguish congestion from loss.

Worked example

A retailer dual-homes to two ISPs, active/standby. Set local preference 200 on routes received from ISP-A, leaving ISP-B at default 100; local preference is the first policy attribute after weight and acts locally and immediately. For return traffic, prepend the enterprise AS twice on advertisements to ISP-B - a hint that will be overridden by ISP-B's own local preference if they prefer their own path. Accept only a default route from each ISP unless you need full tables, and filter outbound so you advertise only your registered aggregate. Enable unicast RPF on the Internet edge and MSS clamping where tunnels reduce MTU.

Traps that cost marks

  • Feeding a full Internet table into an edge platform without checking TCAM and memory.
  • Asymmetric routing across dual-homed stateful firewalls, breaking existing sessions.
  • Overlay MTU: forgetting MSS clamping and fragmentation behavior at the tunnel headend.
  • Assuming MED influences a neighboring AS's choice; it is a hint they may ignore.
  • Deploying QoS across the Internet expecting provider treatment equivalent to MPLS.