Traditional WAN: MPLS, broadband, DIA and leased lines

What a branch needs from the WAN

A branch office has users, a few servers or none, and applications that live somewhere else: in a data centre, in a software-as-a-service (SaaS) platform or in a public cloud. The WAN is whatever carries that traffic between the branch and those places. Before SD-WAN, each type of WAN circuit had its own strengths and its own way of being routed, and the network team lived with the differences.

Three questions separate one circuit type from another: who owns the path, what the contract promises about it, and what the branch router has to do to use it. The rest of this lesson answers those for each common circuit.

The common circuit types

Real sites often have two of these at once, for example an MPLS circuit plus a broadband line, so that one can carry the traffic when the other fails. How the router uses the pair is where traditional WANs get awkward, and a later lesson covers that.

How MPLS reaches a branch

With an MPLS VPN the provider places its own router, the provider edge (PE), at the edge of its network. The customer's router at the branch, the customer edge (CE), connects to it. The two normally exchange routes with a routing protocol such as BGP, or use static routes, and the provider carries those routes between all of the customer's sites inside a separate routing table for that customer.

1. The branch router learns the other sites' prefixes from the provider edge, by BGP or by a static route.
2. Traffic leaves the branch unencrypted. The provider keeps customers apart with labels and separate routing tables, and the service is private by contract, not by encryption.
3. The provider can honour traffic classes. If the enterprise marks voice traffic with a DSCP value (a field in the IP header that labels the class of traffic), the provider can map it to a queue that the contract describes.
4. The path inside the core is the provider's. The enterprise cannot see the hops, and has to ask the provider when something is slow.

This is why MPLS is often described as private but not secure. A private path is not the same as an encrypted one, and some organisations still add encryption on top for sensitive traffic.

How internet circuits reach a branch

An internet circuit gives the branch a public path to the internet and nothing else. To reach another site over it, the branch builds an encrypted tunnel, most often IPsec (a standard suite for encrypting IP traffic), to a router at the data centre or at another site. Many networks used static tunnels or a feature such as DMVPN (Dynamic Multipoint VPN, a Cisco way of building tunnels between sites) for this.

• The branch normally sits behind NAT (network address translation), so its inside addresses are rewritten to a public address on the way out.
• The tunnel is configured, and kept alive, by the network team site by site.
• The provider treats the traffic as ordinary internet traffic. A DSCP marking is usually ignored once the packet leaves the access line.

In practice, a small branch with only broadband often gets a simple tunnel to a head-end router and nothing else. A larger one gets MPLS plus broadband and a hand-built design for which traffic uses which.

What an SLA does and does not mean

A service level agreement (SLA) is the part of the contract that states what the provider will deliver, for example availability of the service, or delay and loss between points on its network, and what happens if it misses. Three limits matter when you read one.

• It covers the provider's network. The branch LAN, the router and the application server are outside it.
• It is measured in the contract's way. An average over a month can hide a bad ten minutes that ruined a video meeting.
• The remedy is usually a credit, not a fix. A credit does not give the lost hours back.

Check any SLA wording yourself, because terms differ between providers and between countries. The point for this course is that a WAN design built on one provider's promise inherits that provider's limits.

A typical pre-SD-WAN design

A common arrangement has a data centre with MPLS and internet circuits, regional hubs, and branches that each have one MPLS line and sometimes a broadband line. All branch traffic goes to the data centre first. Internet-bound traffic is sent there too, passed through a central firewall and then out to the internet. A later lesson looks at what that costs.

Mistakes when reasoning about a WAN

• Treating MPLS as encrypted. It separates customers; it does not scramble the data.
• Assuming one provider's SLA covers a path through another. It stops at the edge of that provider's network.
• Calling every internet line the same. A dedicated DIA circuit and a shared broadband line can both be "the internet" and still behave very differently at busy hours.
• Forgetting the backup circuit exists only as paper. A second line that no one tests may not carry the load on the day it is needed.

Test yourself on traditional WAN circuits