Retail WAN Redesign: Overlay Topology and Breakout Placement
Northwind Retail runs 80 stores, four regional distribution centers, and two data centers. The WAN is an MPLS hub-and-spoke: every store backhauls all traffic to the data centers, where firewalls and internet egress sit. Stores have 20 Mbps MPLS and a new 200/20 Mbps broadband circuit. The business is rolling out cloud POS and Microsoft Teams; pilot stores report poor call quality and slow POS screen loads. Security requires cardholder traffic to remain on MPLS and pass through the data-center firewall. Broadband at most stores is behind carrier-grade NAT, and the MPLS contract has six months left. Leadership wants local internet breakout for SaaS but is worried about losing centralized policy and visibility. A regional hub design is under consideration to reduce tunnel count and keep policy enforcement near stores.
1. Recommend an overlay topology and breakout model for the 80 stores. Justify it against full-mesh and pure hub-and-spoke alternatives, and state where security policy should be enforced.
Read the worked answer
Recommend a partial-mesh overlay anchored on regional hubs rather than a full mesh or pure dual-DC hub-and-spoke. With 80 stores, full mesh creates 3,160 potential tunnels, most of which carry no traffic, and CGNAT prevents many stores from accepting inbound tunnel establishment. Pure hub-and-spoke to the two data centers preserves the current tromboning problem for Teams and cloud POS. Place a regional hub in each of the four distribution centers or nearby colocations; stores build outbound tunnels to the nearest regional hub and to the data centers for cardholder flows. Enforce PCI policy at the data-center firewall and enforce SaaS breakout/security policy at the regional hub. The regional hub becomes the local internet egress and policy point, while the data center remains the compliance boundary. This reduces tunnel scale to roughly 80 store-to-hub tunnels plus hub-to-DC tunnels, keeps latency lower for SaaS, and preserves centralized visibility in the orchestrator. The trade-off is additional hub hardware and a need to design hub redundancy; use two hubs per region or dual-homed hubs so a regional hub is not a single point of failure.
2. Describe how you would classify and steer cloud POS and Teams traffic while keeping cardholder data compliant. Include what happens when broadband degrades.
Read the worked answer
Classify by application signature first, then by destination. Create an application flow for cloud POS matching the SaaS domain/IP ranges and TCP 443, and a separate flow for cardholder traffic matching POS-to-payment-processor subnets. Pin cardholder flows to the MPLS path and the data-center firewall; do not allow them on broadband. For Teams, match the Teams application signature and UDP media ranges (3478-3489) plus TCP 443 fallback. Primary path is regional-hub broadband breakout; secondary is MPLS to the data center. Configure SLA probes for loss, latency, and jitter; use a threshold that reflects voice, e.g., jitter below 30 ms and loss below 1%. When broadband breaches the threshold, dynamic path selection moves new Teams flows to MPLS and, if supported, preserves existing sessions with FEC or duplication rather than hard failover. Because MPLS is only 20 Mbps per store, add QoS to cap Teams and prevent backups from starving voice. Log the path decision and probe results so the pilot's poor quality can be attributed to a specific segment.
3. Explain the implications of carrier-grade NAT for overlay tunnel establishment and for any inbound service the stores might need.
Read the worked answer
CGNAT means the store has no stable public address and cannot accept inbound tunnels. The appliance must initiate the overlay tunnel outbound to the regional hub or orchestrator rendezvous point, using NAT traversal/UDP encapsulation and keepalives. That is acceptable for store-to-hub and store-to-DC traffic because the hub maintains the mapping. It is not acceptable for inbound management or a server behind the store. For inbound services, terminate at the regional hub and reverse-proxy or port-forward to the store over the overlay, or order a static public IP for that site. Also verify that CGNAT does not time out idle mappings aggressively; shorten keepalives if the carrier's NAT timer is short. In the design, avoid any requirement for store-to-store direct tunnels; route store-to-store traffic through the regional hub. This preserves the security model and avoids relying on unsupported inbound NAT.