I85PREP
⌘ K
CNPE study materials
CNPE study resources

CNPE: WAN and Cloud Connectivity

CNPE · Work through your exam, one topic at a time.

All guide sections

WAN and Cloud Connectivity

The WAN and Cloud Connectivity domain tests how you extend the enterprise to remote sites and public cloud without misstating latency, security or cost.

Transport options

  • Dedicated private circuits give committed rates and SLAs but long lead times; broadband and 4G/5G turn up fast with no SLA and variable loss.
  • MPLS L3VPN: the customer edge peers with the provider edge, provider (P) routers stay invisible, and VRFs with route targets keep customers apart. MPLS is not encrypted by default.
  • SD-WAN builds an IPsec overlay over any underlay mix, uses BFD and per-application probes to steer traffic by SLA, adds forward error correction, and provisions zero-touch from a controller. Local internet breakout keeps SaaS traffic off the private core.
  • Cloud: private interconnects (for example AWS Direct Connect or Azure ExpressRoute) bypass the internet but may still need a VPN for encryption. VPC/VNet peering is non-transitive; hub-and-spoke needs a transit gateway or virtual hub. Site-to-site VPN is cheaper and encrypted but inherits internet jitter.

Sizing and MTU

  • An IPsec tunnel adds roughly 50–73 bytes (outer IP, UDP for NAT-T, ESP header, IV, padding, integrity trailer), so a 1500-byte underlay yields a tunnel MTU near 1427–1450. Each MPLS label removes another 4 bytes.
  • Clamp TCP MSS to tunnel MTU minus 40 bytes; 1360 is a common safe value and prevents PMTUD black holes where ICMP is filtered.

Worked example

Branch users cannot open a hosted app over a new IPsec tunnel although small pings succeed. A do-not-fragment ping of 1472 bytes fails while 1400 succeeds. The underlay is 1500, the tunnel path is smaller, and the firewall drops the ICMP fragmentation-needed message, so TCP never learns the real MTU. Fix: clamp MSS to 1360 on the tunnel interface or raise the tunnel MTU where supported.

Traps that cost marks

Assuming encryption implies an SLA. Forgetting that dual-ISP designs create asymmetric routing that breaks stateful inspection. Marking QoS on the internet and expecting it to survive. Expecting VPC peering to be transitive. Ignoring cloud egress charges when choosing a breakout design.