Steering Voice and SCADA Across MPLS and Broadband
A manufacturer operates 12 plants. Each plant has a 50 Mbps MPLS circuit and a 500/100 Mbps broadband circuit. SCADA traffic must remain on MPLS for regulatory reasons. Microsoft Teams must use broadband whenever it meets quality. BGP is configured with default routes from both providers. Today all traffic prefers MPLS, so broadband is idle and MPLS saturates during nightly backup replication. A pilot policy sends Teams over broadband, but calls drop when broadband jitter exceeds 40 ms; the pilot also shows backup traffic competing with voice on MPLS after failover. The security team will not allow SCADA on broadband. You need a policy design that uses broadband safely, protects voice, and keeps backups from causing failover storms.
1. Design the policy order and match criteria for SCADA, Teams, and backup traffic. Explain why order matters.
Read the worked answer
Use first-match ordering with the most specific and least negotiable flow first. Top: SCADA, matched by plant subnet plus industrial protocol/port and destination controller range, pinned to MPLS with no broadband fallback. Next: Teams, matched by application signature and UDP media ranges, primary broadband, secondary MPLS. Next: backup replication, matched by server subnets and backup ports, primary broadband with a rate limit and a schedule, secondary MPLS only outside voice hours. Last: a default internet flow using broadband breakout with MPLS fallback. Order matters because a broad default or subnet match above Teams would capture the media flows and make the later application policy unreachable. Likewise, if backup sits above Teams, backup will consume the broadband SLA and trigger steering churn. QoS should mark voice EF, SCADA high-priority but policed, and backup scavenger class. The policy must also explicitly deny SCADA on broadband so a failover cannot silently violate the compliance requirement.
2. Define the SLA probe and path-selection behavior for Teams. What happens when broadband jitter exceeds 40 ms and MPLS is also congested?
Read the worked answer
Run per-WAN-link SLA probes toward the regional hub or a known SaaS rendezvous, measuring loss, latency, and jitter, not just reachability. Set a Teams threshold consistent with voice, for example jitter below 30 ms, loss below 1%, and latency below 150 ms. Primary path is broadband; secondary is MPLS. Use hysteresis and a hold-down timer so a single spike does not move every call. When broadband exceeds 40 ms jitter, new Teams flows should steer to MPLS, and existing flows should use FEC or duplication if available before a hard move. If MPLS is also congested, do not simply fail into it: apply QoS admission control, preempt backup traffic, and keep Teams on the path with the better measured score. If neither path meets threshold, preserve the call with FEC and alert operations rather than oscillating. The backup policy must be scheduled or rate-limited so it cannot repeatedly create this dual-congestion condition.
3. BGP advertises defaults from both providers. How do you prevent asymmetric routing and ensure the return path for locally broken-out Teams traffic?
Read the worked answer
Do not rely on BGP default selection as the traffic-steering mechanism. Keep BGP for underlay reachability, but steer application flows with SD-WAN policy and probes. Set BGP preferences so SCADA and data-center-bound traffic consistently prefer MPLS, and do not advertise a broadband default into the MPLS domain in a way that pulls return traffic asymmetrically. For locally broken-out Teams, source-NAT at the regional hub so SaaS replies return to the hub's public address, and ensure the hub has a symmetric route back to the store over the overlay. The hub firewall must be stateful and allow the return flow. Verify that the overlay next-hop is not overridden by a more-preferred BGP route; use route policy or separate routing contexts if needed. Test with traceroute in both directions and confirm that the return path follows the same hub and transport as the outbound path.