Campus and Branch WAN Design
Campus and Branch WAN Design
This domain tests WAN topology, transport choice, routing, security overlay, QoS and SLA-driven forwarding across MX, SRX, Session Smart Router and SD-WAN designs. The exam focuses on matching transport and topology to application and budget requirements.
Core rules
- Choose transports from requirements: MPLS for deterministic SLA, internet for cost, LTE/5G for diversity or primary at small sites. Hybrid WAN combines them under an overlay.
- Select topology deliberately. Hub-and-spoke centralizes policy; partial or full mesh reduces hub transit; ADVPN and Session Smart Router provide dynamic spoke-to-spoke paths.
- Use BGP with a private ASN plan for scale and summarization; OSPF suits smaller domains. Avoid designs that create asymmetric routing through stateful firewalls.
- Secure the overlay with IPsec or SD-WAN encryption, segment traffic, and decide where internet breakout occurs: centralized at the hub or local with SRX or SASE enforcement.
- Apply QoS with DSCP classification, shaping to contracted rates and correct overhead. For IPsec, account for MTU overhead and clamp MSS.
Worked example
Eighty branches have two internet links plus LTE, with two data-center hubs. Reasoning: Session Smart Router at branch and hub provides application-aware paths and encryption; SRX at the hubs enforces security policy. Voice is prioritized, SaaS breaks out locally through SRX, and LTE is standby with data-cap monitoring. BGP summarizes branch routes, and SLA probes steer traffic away from degraded links. This meets cost, resilience and application experience requirements without oversubscribing the hubs.
Traps that cost marks
- Treating SD-WAN as tunnels only, with no SLA probes.
- Ignoring IPsec MTU and MSS.
- Oversubscribing hub capacity.
- LTE plans without data caps.
- Asymmetric routing through stateful firewalls.