Campus and Branch WAN Design
This domain tests WAN topology and transport choices for branches: MPLS, Internet, IPsec, SD-WAN, routing, and QoS.
Core rules
- Choose topology from traffic patterns: hub-and-spoke for centralized DC, partial mesh for peer traffic.
- Match transport to SLA: MPLS for deterministic latency, Internet plus IPsec for cost and agility, hybrid for both.
- Run BGP for policy and failover; use QoS marking and queuing for voice and POS.
- Account for MTU: IPsec and encapsulation reduce payload; set TCP MSS clamping.
- Design redundant CPE, diverse carriers, and deterministic failover.
Worked example
A 50-branch company needs voice quality and resilient POS access. Design: primary MPLS L3VPN to DC, secondary Internet IPsec overlay via SRX, BGP with local preference preferring MPLS, QoS EF for voice, AF for POS, and MSS clamping on IPsec. Reason: voice needs low jitter, so MPLS is primary; Internet provides cost-effective backup. BGP makes failover deterministic; QoS protects real-time traffic on both paths.
Traps
- Treating Internet as SLA-backed without measurement.
- Ignoring MTU and fragmentation.
- Asymmetric routing without stateful firewall symmetry.
- No QoS on the backup path.