WAN and Service Provider Connectivity Design
What the exam tests
WAN and Service Provider Connectivity Design covers WAN topology choices, MPLS L3VPN, internet VPN, BGP, SD-WAN overlays, QoS, and resilient carrier design for Juniper MX and SRX platforms.
Core rules
- Match topology to traffic: hub-and-spoke for centralized policy, partial mesh for regional traffic, full mesh only when any-to-any volume justifies it.
- Use BGP with explicit prefix filters and maximum-prefix limits; never accept default routes blindly.
- Separate underlay transport from overlay policy; SD-WAN can steer voice over MPLS and bulk data over internet.
- Design for diversity: different carriers, entry paths, conduits, and power.
- Model latency, jitter, loss, MTU, and QoS queueing per application.
Worked example
Five branch sites need voice and business apps, 99.9% availability, and two data centers. Use an MPLS L3VPN primary from carrier A with 50 Mbps per site, plus an internet IPsec backup from carrier B. At each branch, a Juniper SRX forms BGP with the provider CE or uses static routes with tracked objects; prefer BGP for failover. Advertise only branch summaries and filter inbound prefixes. Mark voice EF, business AF31, and bulk AF11; reserve 30% for real-time. Verify IPsec MTU: 1500-byte inner packets may fragment, so set TCP MSS clamping and test 1400-byte payloads. The primary path carries voice; the backup is sized at 100 Mbps but only for critical apps during failure.
Traps
Treating internet as SLA-backed MPLS; dual carriers in the same conduit; asymmetric routing after failover; IPsec fragmentation; and BGP sessions without prefix limits.