Skip to content
Log in Sign up My account

3.1 WAN Connectivity Options

Blueprint 3.1: WAN connectivity options including on-premises, hybrid, and cloud

  • 3.1.a Layer 2 VPN
  • 3.1.b MPLS Layer 3 VPN
  • 3.1.c Metro Ethernet
  • 3.1.d DWDM
  • 3.1.e 4G/5G
  • 3.1.f SD-WAN customer edge

ENSLD does not ask you to configure a WAN circuit. It asks you to pick the right transport for a set of requirements: bandwidth, latency, who controls routing, how many sites, how fast you must deploy, and what it costs. This page is a comparison toolkit. For the mechanics of MPLS L3VPN see ENARSI MPLS Layer 3 VPN.

The design questions to ask first

  1. Who owns the routing? On a Layer 2 service the enterprise runs its own routing across the provider. On a Layer 3 service the provider takes part in your routing.
  2. How many sites, and what traffic pattern? Hub-and-spoke, partial mesh or any-to-any.
  3. What is the SLA? Latency, jitter, loss and availability, and whether the provider backs them with class-of-service.
  4. Is the traffic private by nature? Internet transport is cheap but needs an overlay and encryption.
  5. How fast must the site come up? Internet and cellular install in days. Leased circuits can take months.

Transport comparison

Option Layer Provider sees your routes? Typical use Main strength Main weakness
Layer 2 VPN (VPWS, VPLS, EVPN) 2 No Customer wants control of routing, data centre interconnect Transparent to your protocols, you run your own IGP Larger broadcast domain, you own the loop and scale problems
MPLS L3VPN 3 Yes (PE-CE routing) Many-site private WAN with QoS Any-to-any by default, provider SLA and CoS Cost, lock-in, slow provisioning, limited reach
Metro Ethernet 2 No Campus-to-campus, site to hub inside a metro area High bandwidth at low cost, simple handoff Geographic reach, depends on provider footprint
DWDM 1 No Own or lease wavelengths between data centres or campuses Huge capacity, very low latency, protocol transparent Highest cost, point-to-point, needs fibre
Broadband or DIA Internet 3 No Branch and cloud access Cheap, fast to deploy No SLA, needs overlay VPN for privacy
4G/5G cellular 3 No Backup, temporary or remote sites Quick to deploy, independent of wired path Variable latency, data caps, often carrier NAT

Layer 2 VPN services

A Layer 2 VPN gives the customer what looks like a wire or a switch. The provider carries Ethernet frames and never looks at IP.

Service Topology Common names
Point-to-point Two sites VPWS, pseudowire, EoMPLS, E-Line (EPL or EVPL)
Multipoint Many sites in one broadcast domain VPLS, EVPN, E-LAN (EP-LAN or EVP-LAN)
Rooted multipoint Hub talks to spokes, spokes cannot talk to each other E-Tree

The MEF terms are worth knowing. A UNI is the customer-facing port. An EVC is the Ethernet virtual connection between UNIs. "Private" services (EPL, EP-LAN) take the whole port. "Virtual private" services (EVPL, EVP-LAN) allow several EVCs per port, selected by VLAN.

Design impact of a multipoint Layer 2 service

A VPLS or E-LAN service puts every site in one Layer 2 domain. Broadcast, unknown unicast and multicast traffic cross the WAN. Spanning tree, if you run it, now spans sites. Most designs route between sites and keep each site's VLANs local. Use Layer 2 extension only where an application truly needs it, and prefer EVPN or an overlay such as OTV or VXLAN over stretching VLANs on a raw VPLS.

graph LR
  subgraph L2 ["Layer 2 VPN: customer routers peer directly"]
    A1["CE A"] --- P1["Provider<br/>Ethernet cloud"] --- B1["CE B"]
    A1 -. "OSPF adjacency across the cloud" .- B1
  end
  subgraph L3 ["MPLS L3VPN: customer routers peer with the provider"]
    A2["CE A"] -- "eBGP or OSPF" --- PE1["PE"] --- PE2["PE"] -- "eBGP or OSPF" --- B2["CE B"]
  end

MPLS Layer 3 VPN as a WAN service

The provider runs a VRF per customer on its PE routers. The CE peers with the PE using static routes, OSPF, EIGRP or, most often, eBGP. The provider gives you any-to-any reachability without you building tunnels.

Design points that matter:

  • PE-CE routing protocol choice. eBGP gives the cleanest policy and loop control, and it is what most providers prefer. If you use OSPF, remember the provider's VPN backbone behaves like a super-backbone with sham links needed for backdoor links. Details are on the ENARSI L3VPN page.
  • QoS. The provider sells a small number of classes, often three to six. Your campus has more classes than that, so you must map your markings into the provider's classes and re-mark on the CE. Without that mapping your voice is treated as best effort in the cloud.
  • Multiple sites with backdoor links. If two sites are also linked by a private link, routing can prefer the backdoor in surprising ways. Plan route preference deliberately.
  • Encryption. MPLS is private but not encrypted. If policy requires encryption, add GET VPN (see 3.2) or IPsec.
  • Reach. A single provider rarely covers every country. Multi-provider designs need either an inter-provider arrangement or an overlay across both.

Metro Ethernet

Metro Ethernet is Ethernet delivered over a provider's metro network, often fibre with a 1 or 10 Gbps handoff and rate-limited to what you buy. It is usually sold as one of the Layer 2 services above, but it is also commonly used as the access circuit that carries an MPLS L3VPN or Internet service to the PE.

Design notes:

  • You can buy bandwidth in steps (for example 100 Mbps on a gigabit port). The port speed is higher than the subscribed rate, so shape to the CIR on the CE, then queue inside the shaper. See the QoS pattern in ENCOR for the parent/child policy.
  • The provider may pass or strip VLAN tags and may or may not tunnel your Layer 2 control protocols. Ask whether CDP, LLDP, LACP and STP BPDUs are transparently carried.
  • Ethernet OAM (802.1ag, Y.1731) gives fault management and delay measurement end to end.

DWDM

Dense wavelength-division multiplexing puts many optical channels (wavelengths) on one fibre pair. Each wavelength can carry its own Ethernet, SAN or SONET/OTN signal at 10, 100 or 400 Gbps. It is Layer 1, so it is transparent: the optical layer does not care what protocol you send.

Use DWDM when:

  • Two data centres need very high bandwidth, low and fixed latency, and storage replication traffic.
  • You need to carry several different services (Ethernet, Fibre Channel) without a router in the middle.
  • You can get dark fibre or a managed wavelength service.

Reasons not to use it: cost per link is high, it is strictly point-to-point or ring, and it needs amplifiers and dispersion management over long spans. It is an inter-site backbone choice, not a branch choice.

4G and 5G

Cellular is a Layer 3 access technology delivered through a modem or a cellular gateway.

Role Fit
Backup to a wired circuit Excellent. Independent path, quick to bring up, pay little until used.
Primary for pop-up sites, vehicles, kiosks Good. Site is live in days.
Primary for a data-heavy branch Poor. Data caps, jitter and variable throughput.

Design cautions: many carriers use CGNAT, so the router has a private address and you cannot accept inbound connections. Tunnels must therefore be initiated from the branch. Latency and throughput change with signal. Voice and video work, but plan a lower-bandwidth QoS profile when running on the cellular path. 5G improves capacity and latency, but you still design for it as a metered, variable link.

Hybrid and cloud connectivity

A hybrid WAN combines a private transport (MPLS or Metro Ethernet) with Internet transport. The private path carries SLA-sensitive traffic. The Internet path carries bulk, SaaS and backup traffic. Because the Internet path is untrusted, an encrypted overlay (IPsec, DMVPN or SD-WAN) rides on it.

For cloud, the main choices are:

  • Internet VPN to the cloud provider's gateway: cheapest, no bandwidth guarantee.
  • Private cloud connection (a dedicated circuit, via a colocation facility or a carrier): predictable latency and throughput. Cloud connectivity options are covered further in the automation and cloud domain (blueprint 5.5).
  • SD-WAN cloud on-ramp: SD-WAN edges in the cloud extend the fabric, and the fabric steers SaaS traffic to the best exit. See 3.5.

SD-WAN customer edge

With SD-WAN the CE becomes a policy-driven WAN edge that sits on any mix of transports. The transport is treated as underlay: MPLS, Internet, LTE and Metro Ethernet can all be present at the same site, and the overlay chooses between them per application. The provider's service stays Layer 3 or Layer 2, but the enterprise controls routing and path selection on top.

Choose SD-WAN CE when:

  • You want to mix transports and move traffic between them based on measured loss, latency and jitter.
  • You want centralised policy and zero-touch provisioning for many branches.
  • You want direct Internet access and cloud on-ramp from each branch with security in the path.

Design details are in 3.4 and 3.5. The platform basics are on the ENCOR SD-WAN page.

Exam trap

MPLS L3VPN does not give you a Layer 2 domain between sites, and a Layer 2 VPN does not give you provider routing. When a scenario says "the customer wants to run its own IGP across the WAN and keep control of routing", the answer is a Layer 2 service, not L3VPN.

Exam trap

DWDM and Metro Ethernet are not routing services. Neither one gives you any-to-any reachability on its own. If the requirement is many branch sites with simple full-mesh connectivity and provider QoS, MPLS L3VPN fits. If it is two data centres needing wavelength-level bandwidth, DWDM fits.

Exam trap

Cellular as a primary link is not the wrong answer for a remote or temporary site, but it is the wrong answer when the requirement says "guaranteed bandwidth" or "inbound connections from the Internet". CGNAT and variable throughput rule it out.

Design exercise

Scenario. A retailer has 400 stores, 3 regional data centres and one head office. Stores need voice and POS traffic with a predictable SLA, plus guest Wi-Fi that goes straight to the Internet. The three data centres need to replicate storage over 100 km of fibre that the company can lease. Stores in rural areas often wait months for wired circuits. The network team wants to keep its own routing policy and not depend on the provider for it.

Requirements and constraints.

  • Store to data centre connectivity with QoS for voice.
  • Storage replication between data centres with very high bandwidth and low latency.
  • Rural stores must go live quickly.
  • The team keeps control of routing.
  • Budget favours Internet transport where it is acceptable.
Model answer
  • Stores: use an SD-WAN customer edge with two transports at most stores: a provider L3VPN or Metro Ethernet circuit for voice and POS, and a broadband Internet circuit for guest, SaaS and failover. The SD-WAN overlay gives the team routing and path control above the transport. Rural stores use broadband plus a 5G backup, or 5G as primary for the first weeks while a wired circuit is delivered.
  • Data centre interconnect: lease dark fibre or DWDM wavelengths. Storage replication needs bandwidth and fixed low latency, and DWDM is protocol transparent so it can carry Ethernet and Fibre Channel.
  • Rejected: a pure MPLS L3VPN for every store is the most expensive option and slow to deliver in rural areas. A Layer 2 multipoint VPN across 400 stores would create a huge broadcast domain. Internet-only for stores removes the SLA for voice. Cellular-only fails the guaranteed-bandwidth need at busy stores.
  • Why SD-WAN meets the routing requirement: the overlay carries its own control plane (OMP), so the customer's policy does not depend on the underlay provider.

Quick check

Which WAN service lets you run your own OSPF adjacency directly between two sites?

A Layer 2 VPN such as VPWS or VPLS. The provider carries Ethernet frames and does not participate in routing, so your routers see each other as neighbours across the cloud. With an MPLS L3VPN your CE peers with the provider PE instead.

A site buys 200 Mbps of Metro Ethernet on a 1 Gbps handoff. Why shape on the CE?

The port is faster than the subscribed rate, so the CE never sees local congestion. Without a shaper, the provider drops excess traffic with no regard for your priorities. A parent shaper at 200 Mbps with a child queuing policy makes your own markings decide what is dropped.

Why is carrier-grade NAT a design concern for cellular WAN links?

The router receives a private address, so inbound connections cannot reach it and the tunnel must be initiated from the branch outward. A hub-and-spoke overlay with the hub having a public address works. A design that depends on inbound connectivity to the cellular site does not.

References

  • Cisco Enterprise WAN design guides: search "Cisco SD-WAN Design Guide" and "Enterprise WAN" on cisco.com (CVD)
  • Cisco Live On-Demand Library: search "WAN design", "Metro Ethernet", "cellular WAN"
  • RFC 4364 (BGP/MPLS IP VPNs), RFC 4761 and RFC 4762 (VPLS), RFC 7432 (EVPN)
  • MEF service definitions: search "MEF Carrier Ethernet services E-Line E-LAN E-Tree"