Sign in Subscribe

CCNA 200-301 WAN Architecture: MPLS, VPNs, SD-WAN, and Enterprise WAN Design Explained

CCNA 200-301 WAN Architecture: MPLS, VPNs, SD-WAN, and Enterprise WAN Design Explained

1. Introduction

WAN architecture is one of those CCNA topics that feels messy until you stop treating it like a vocabulary list. Leased lines, PPP, MPLS, Internet VPNs, DMVPN, broadband, LTE, and SD-WAN aren’t just buzzwords cluttering up the chapter. They’re the actual ways enterprises connect sites in the real world.

They represent different ways enterprises connect branches, headquarters, data centers, and cloud services across distance, with different tradeoffs in cost, performance, security, and operational complexity.

For the CCNA 200-301 exam, the goal is not deep service-provider engineering. What you do need to know is what each WAN technology is actually doing, whether it’s the transport or the overlay, who’s responsible for it, and why one business might choose it over another. That distinction is really important, because it’s what separates a correct answer from a “sounds-right-but-isn’t” exam choice.

If you can distinguish private from encrypted, MPLS from IPsec, and transport from overlay, you will avoid a lot of easy exam mistakes.

2. What WAN Architecture Actually Includes

A WAN, or wide area network, connects geographically separated networks. A LAN usually stays inside one building, or maybe across a campus if you’re being generous with the term. A WAN, on the other hand, links sites across cities, regions, or even countries. That’s the whole point: distance becomes part of the design.

But WAN architecture is more than “the link between sites.” It includes the full design model for how remote locations communicate and stay available.

In practice, WAN architecture includes these building blocks:

  • Transport/underlay: MPLS, leased line, Metro Ethernet, broadband Internet, DIA, or LTE/5G
  • Overlay: GRE, IPsec, DMVPN, or SD-WAN tunnels and policies
  • Routing/control: static routing, default routes, OSPF, and sometimes BGP awareness at the edge
  • Security: encryption, segmentation, ACLs, firewall policy, and tunnel authentication
  • Availability: redundant circuits, dual routers, failover logic, and tracking
  • Cloud/SaaS access: backhaul through HQ versus direct local Internet breakout
  • Operations: monitoring, logging, visibility, and troubleshooting

That is the real exam mindset: WAN architecture is a design framework, not just a circuit purchase.

3. Core Enterprise WAN Components and Demarcation

At the branch, traffic usually moves from the LAN to a WAN edge router or firewall, then to the provider handoff. That handoff is the demarcation point between customer responsibility and provider responsibility.

CE is the customer edge device—your router or firewall. PE is the provider edge device—the carrier router facing your site. In MPLS discussions, this distinction matters a lot: the customer manages the CE and its routing toward the provider, while the provider manages the PE and the provider cloud.

Depending on service type, the provider may deliver:

  • Layer 1 service such as a dedicated circuit
  • Layer 2 service such as Ethernet handoff
  • Layer 3 managed service such as MPLS L3VPN

That layer matters because it affects who handles routing. With Layer 1 or Layer 2 services, the customer usually owns the routing across the link, because the provider is mostly just giving you transport and connectivity. They’re moving the bits, not making the routing decisions for you.

With a Layer 3 managed service like MPLS L3VPN, the provider participates in transport within its own cloud, while the customer still controls routing on the CE side.

Older serial WAN designs also used CSU/DSU-style handoffs and serial interfaces. You do not need deep historical detail for CCNA, but you should understand that a leased line is the service, while serial encapsulation such as HDLC or PPP was one way routers accessed some older WAN circuits.

4. Common WAN Topologies

Topology describes how sites are connected.

Point-to-point is a direct link between two sites. It is simple and predictable, but not scalable.

Hub-and-spoke connects branches to a central hub, often HQ or a data center. It is easier to manage and often cheaper than building many direct links, but branch-to-branch traffic may hairpin through the hub.

Full mesh gives every site a direct path to every other site. That improves direct reachability but becomes expensive and complex at scale.

Partial mesh is the practical middle ground: only important site pairs get direct connectivity.

Dual-homed designs add redundant WAN paths or providers for availability.

One subtle exam point: an MPLS provider cloud may present logical any-to-any connectivity to the customer even though the physical provider core is abstracted away. In other words, the customer sees site reachability through the service, not the provider’s internal topology.

5. Traditional WAN Options: Leased Lines, Ethernet, Internet, and Cellular

Leased lines are dedicated circuits between sites. They’re private and predictable, but they’re also expensive.

Private here means dedicated or provider-isolated transport, not encryption.

Serial WAN links historically used encapsulations such as Cisco HDLC or PPP. Cisco HDLC is Cisco proprietary, and you’ll see it on Cisco serial interfaces.

PPP is an open standard and adds features such as authentication, link negotiation, and multilink support.

Metro Ethernet is commonly delivered as carrier Ethernet service. Conceptually, think of E-Line as point-to-point Ethernet and E-LAN as multipoint Ethernet service. Providers may also offer managed Layer 3 services over Ethernet access, so don’t assume “Ethernet” automatically means you’re handling all the routing yourself. This is more precise than saying Metro Ethernet is simply “private or carrier-managed.”

MPLS L3VPN is a provider-managed WAN service discussed in the next section.

DIA and broadband Internet are public WAN underlays. DIA is usually a business-grade dedicated Internet service, while broadband is generally cheaper and more best-effort.

Both can support business traffic, but critical use often requires VPN protection, redundancy, and careful design.

LTE/5G is often used for backup, temporary turn-up, or small branches. It’s useful, but performance depends on coverage and signal quality, and cellular providers may use carrier-grade NAT, which can make inbound reachability and VPN behavior a little more interesting than you’d like.

6. PPP vs HDLC for CCNA

If serial WAN links appear on the exam, know the difference between HDLC and PPP.

Cisco HDLC is a Cisco proprietary implementation with minimal negotiation and no built-in PPP-style authentication. It works best on Cisco-to-Cisco serial links.

PPP is an open standard that supports PAP and CHAP authentication, along with LCP and NCP negotiation. It offers better multivendor interoperability.

PAP uses a basic two-way handshake and is weaker because credentials can be exposed more easily. CHAP uses a challenge-response process and is more secure than PAP. At CCNA level, that distinction is enough.

Example PPP configuration:

interface s0/0/0
encapsulation ppp
ppp authentication chap
ip address 10.1.1.1 255.255.255.252

7. MPLS L3VPN Fundamentals and Customer/Provider Roles

MPLS is a provider technology that forwards traffic across the carrier backbone using labels. For CCNA, the important service is usually MPLS Layer 3 VPN. The customer CE router connects to the provider PE router, and the provider carries traffic between sites.

MPLS L3VPN commonly gives enterprises any-to-any site reachability, but that reachability depends on provider VPN design, VRF policy, and customer routing. Inside the provider network, customer routes are kept separate using VRFs—virtual routing and forwarding instances.

What the customer usually cares about:

  • Predictable performance
  • Provider-managed backbone
  • QoS classes and SLAs, if purchased
  • Scalable branch connectivity

What MPLS does not inherently provide is encryption. MPLS privacy comes from provider traffic separation, not cryptographic confidentiality.

That is a major exam trap.

From the customer perspective, routing may be static or dynamic between CE and PE, depending on the service. Deep MPLS internals are beyond CCNA scope; CE/PE roles and private-versus-encrypted distinctions are not.

8. Internet VPNs, Overlays, and Underlays

The underlay is the transport: Internet, MPLS, Ethernet, or LTE. The overlay is the logical network built on top: GRE, IPsec, DMVPN, or SD-WAN. Remember it this way: underlay carries packets; overlay defines the logical path and policy.

IPsec is the main security technology for site-to-site VPNs. When it’s configured correctly, it gives you confidentiality, integrity, peer authentication, and anti-replay protection.

Site-to-site VPNs commonly use IKE or IKEv2 to negotiate security associations and keys.

GRE is a tunneling protocol. It encapsulates traffic, and it’s handy when you need to carry multicast or routing protocols more flexibly.

GRE by itself does not encrypt traffic.

IPsec tunnel mode can secure site-to-site traffic by itself. GRE is not always required. GRE over IPsec is used when you want GRE’s routing and encapsulation flexibility plus IPsec security.

Basic GRE example:

interface Tunnel0
ip address 172.16.1.1 255.255.255.252
tunnel source g0/0
tunnel destination 198.51.100.2

That source and destination identify the underlay endpoints. The tunnel interface carries the logical overlay traffic.

DMVPN is a Cisco-developed architecture that uses mGRE, NHRP, and usually IPsec. The hub keeps the NHRP mappings, and the spokes can build spoke-to-spoke tunnels dynamically instead of forcing every packet through the hub. That’s the whole point of it.

That’s what makes the design much more scalable. For CCNA, DMVPN is mostly recognition-level knowledge and is historically important, but modern exam discussions often focus more on SD-WAN.

9. SD-WAN Fundamentals

SD-WAN is not a circuit type. It’s a policy-driven overlay architecture that can run over multiple underlays like MPLS, broadband, DIA, and LTE.

Vendor implementations differ, but common themes include centralized orchestration, encrypted overlay tunnels, application-aware path selection, and transport independence.

Typical SD-WAN capabilities include:

  • Centralized policy deployment
  • Application-aware routing
  • SLA-based path steering using metrics like latency, jitter, and loss
  • Segmentation
  • Zero-touch branch deployment concepts
  • Local Internet breakout for SaaS, when policy allows

Local breakout is not automatically secure just because SD-WAN is present. Branch Internet access still needs security controls such as firewalling, DNS and web filtering, secure web gateways, or broader security service edge and secure access service edge style policy integration.

A common hybrid design is MPLS plus Internet under an SD-WAN overlay: critical traffic may prefer MPLS, while SaaS traffic exits locally over Internet.

10. Routing, Edge Services, and High Availability

Small branches often use a default route toward the WAN edge. Larger environments may run OSPF internally and exchange reachability with the WAN edge. BGP is awareness-level important at the enterprise edge and in larger provider or cloud-connected designs. EIGRP may still appear as legacy awareness, but OSPF and BGP are more important conceptually for modern CCNA alignment.

Example branch default route:

ip route 0.0.0.0 0.0.0.0 203.0.113.1

NAT overload/PAT is common for branch Internet access, but not typically used between private internal sites across MPLS. Example:

access-list 1 permit 10.10.10.0 0.0.0.255
ip nat inside source list 1 interface g0/0 overload

ACLs and firewalls enforce least-privilege access. QoS matters on constrained links: voice and interactive apps care about latency, jitter, and loss more than bulk backup traffic does. MPLS providers often offer QoS classes, but actual treatment depends on the service contract and provider design.

For high availability, branches may use dual transports such as MPLS primary and LTE backup. Failover can be triggered by interface state, route loss, or tracking tools like IP SLA. In the real world, you want all three working before the outage, not after someone starts yelling.

Active/standby is simpler, while active/active can use both links but adds a lot more policy complexity. FHRP is adjacent branch resiliency knowledge, but it is more of a LAN default-gateway topic than a core WAN architecture topic.

11. Cloud/SaaS Access Patterns and Hybrid WAN

Cloud changed WAN design. In older hub-and-spoke designs, branches often backhauled Internet traffic through HQ so security could be centralized. That made sense when most of the important stuff lived in the data center.

It made a lot more sense back when most applications still lived in the data center and SaaS wasn’t eating everyone’s lunch. It works less well when users spend the day in productivity suites, customer relationship management platforms, and other SaaS applications.

Backhaul through HQ improves central control but adds delay and can create bottlenecks.

Direct Internet breakout usually improves SaaS user experience by sending branch traffic directly to the Internet, but it requires strong branch-edge security policy.

That is why hybrid WAN became common: MPLS or private transport for selected internal or latency-sensitive traffic, plus Internet for cloud and SaaS access, often coordinated by SD-WAN.

12. Troubleshooting WAN Problems

A good WAN troubleshooting flow is to ask: Is the problem the transport, the overlay, the routing, or the policy?

  • Interface up/down: check physical status, provider handoff, IP addressing, and errors
  • Tunnel down: verify underlay reachability, tunnel source and destination, and IPsec or IKE status
  • Tunnel up but app down: check routing, ACLs, NAT exemptions, DNS, and application reachability
  • Internet works but HQ does not: suspect VPN, routing, or firewall policy
  • Voice poor over VPN: suspect jitter or loss on the underlay, not just the tunnel
  • Failover not occurring: verify tracking, route priorities, and test conditions

Useful verification commands include:

show ip interface brief
show ip route
show interfaces
show ip nat translations
show crypto isakmp sa
show crypto ipsec sa
show dmvpn

For monitoring, SNMP helps with interface and device health, Syslog shows events and failures, and NetFlow helps identify who is using bandwidth and which applications are crossing the WAN.

13. Practical Design Scenarios

Retail chain: 20 stores, cloud POS, payment traffic, guest Wi-Fi. Best fit is often hybrid WAN or SD-WAN: broadband or DIA for cost-effective scale and SaaS access, segmented traffic, and LTE backup for outages.

Healthcare clinic: electronic medical record access and voice or video consults. Predictability matters more, so MPLS or hybrid WAN is often preferred for critical traffic, with Internet breakout for lower-risk SaaS where policy allows.

Cloud-first company: heavy productivity suite and web application use. Backhauling all of that through HQ just adds latency without buying you much of anything.

Direct Internet breakout with SD-WAN policy and branch security controls is usually better.

14. CCNA Exam Traps and Quick Review

  • MPLS = provider-managed private WAN service; privacy or isolation is not encryption
  • IPsec = security for site-to-site VPNs
  • GRE = tunneling and flexibility, not security
  • GRE over IPsec = routing flexibility plus encryption
  • DMVPN = scalable Cisco-originated dynamic VPN architecture
  • SD-WAN = centralized policy-driven overlay across multiple transports, not a circuit
  • Underlay = transport
  • Overlay = logical tunnel or policy layer
  • CE = customer edge; PE = provider edge

Fast elimination strategy for multiple-choice questions:

  • If the answer describes encryption, GRE alone is wrong.
  • If the answer describes a provider backbone, think MPLS.
  • If the answer describes a circuit, it is not SD-WAN.
  • If the answer says private, do not assume encrypted.
  • If the requirement is secure public transport, think IPsec VPN.
  • If the requirement is centralized policy across MPLS and Internet, think SD-WAN.

15. Conclusion

WAN architecture makes much more sense when you classify technologies by role. MPLS, broadband, DIA, and LTE are transports. GRE, IPsec, DMVPN, and SD-WAN are overlays or control models built on top of transport. MPLS is private but not inherently encrypted. GRE tunnels but does not secure. IPsec secures. SD-WAN orchestrates policy across multiple links.

For CCNA, that role-based thinking is the key. When a question describes a WAN scenario, ask: Is it talking about the underlay, the overlay, the security method, or the management architecture? If you answer that first, most WAN questions become much easier.