CCDE Enterprise Case Study Part 5: MPLS VPN Migration, VRF Design, and WAN Scalability Analysis

CCDE Enterprise Case Study Part 5 – MPLS VPN Design for Independent Store Migration

In this section of the CCDE enterprise case study, we analyze one of the most important enterprise WAN architecture scenarios:

🎯 MPLS VPN Expansion and WAN Segmentation

This question tests:

• Capacity analysis
• MPLS VPN architecture
• VRF segmentation
• WAN scalability
• Traffic engineering
• Enterprise isolation principles
• Operational design thinking

The Business Goal

Jacobs wants to:

• Avoid the 28% Annet cost increase
• Leverage the existing Bluesky MPLS provider
• Drive future integration
• Reduce provider complexity
• Minimize operational overhead

However:

• Independent stores must remain isolated
• Current WAN capacity is limited
• Store-to-store communication must stay blocked
• Firewall policy enforcement must continue

Table of Contents

• 1. Correct Answer Analysis
• 2. Understanding the Capacity Problem
• 3. Why VRF Separation Is Mandatory
• 4. Why Option A Is Incorrect
• 5. Why Option B Is Incorrect
• 6. Why Option C Is Incorrect
• 7. Why Option D Is Correct
• 8. Enterprise WAN Mathematics
• 9. MPLS VRF Configuration Examples
• 10. Machine Learning and Capacity Forecasting
• 11. Final Architectural Takeaways
• 12. Related Articles

1. Correct Answer Analysis

✅ Correct Answer

Provision a new, separate L3 MPLS VPN for independent stores within the Bluesky MPLS WAN on a new central tail circuit into the DC that breaks out into separate VRFs in the existing DC CE router.

This answer is correct because it solves:

• Capacity issues
• Traffic isolation requirements
• Scalability concerns
• Security segmentation requirements

while preserving:

• MPLS VPN separation
• Existing firewall policy model
• Operational clarity

2. Understanding the Capacity Problem

The most important part of this question is:

💡 Capacity Analysis

Many engineers focus only on:

• VRFs
• MPLS VPNs
• Routing

But CCDE-level architecture requires:

$$ Infrastructure\\ Capacity\\ Validation $$

Existing Bluesky Utilization

The Bluesky MPLS utilization already reaches:

$$ 8Gbps $$

The Annet MPLS utilization reaches approximately:

$$ 4Gbps $$

Combined traffic becomes:

$$ 8Gbps + 4Gbps = 12Gbps $$

But:

$$ Existing\\ DC\\ Circuit = 10Gbps $$

🚫 Result

The existing Bluesky tail circuit cannot support both environments simultaneously.

Enterprise Capacity Planning Principle

Enterprise WAN design must always account for:

• Peak utilization
• Traffic bursts
• Growth projections
• Failure scenarios

You never design WAN capacity based only on averages.

WAN Engineering Formula

$$ Required\\ Capacity = Peak\\ Traffic + Growth + Failure\\ Margin $$

3. Why VRF Separation Is Mandatory

Independent stores currently operate in:

• A hub-and-spoke topology
• A controlled security model
• A policy-restricted environment

Store-to-store communication is intentionally blocked.

This means:

$$ Traffic\\ Isolation = Mandatory $$

Why Existing Jacobs MPLS VPN Cannot Be Shared

The Jacobs MPLS network is:

• Full mesh
• Optimized for VoIP
• Open internally

If independent stores join the same MPLS VPN:

$$ Independent\\ Stores \leftrightarrow Jacobs\\ Stores $$

communication becomes possible by default.

💡 Critical MPLS VPN Principle

MPLS VPN membership defines routing reachability.

Therefore:

• Separate VPN required
• Separate VRF required
• Separate policy enforcement required

Why VRFs Matter

$$ VRF = Virtual\\ Routing\\ Table $$

Each VRF creates:

• Separate routing domain
• Separate forwarding table
• Traffic isolation

This allows:

• Independent store segmentation
• Controlled firewall traversal
• Policy enforcement

4. Why Option A Is Incorrect

Option A

Provision a separate MPLS VPN using the existing Bluesky MPLS CE and circuit.

At first glance this appears reasonable.

However:

🚫 Existing Capacity Is Already Near Saturation

The existing 10Gbps circuit cannot support:

$$ Existing\\ Traffic + Independent\\ Store\\ Traffic $$

This is the central reason Option A fails.

Architecturally:

• VPN separation is correct
• VRF segmentation is correct

But:

$$ Capacity\\ Constraint = Fatal $$

5. Why Option B Is Incorrect

Option B

Terminate independent stores into the existing Jacobs VPN and use ACLs.

This violates core enterprise segmentation principles.

Problem 1 – Full Mesh Reachability

The Jacobs MPLS VPN is already:

• Full mesh
• Internally reachable

Joining independent stores directly into this VPN creates:

$$ Unwanted\\ East-West\\ Reachability $$

Problem 2 – ACLs Are Not Proper Segmentation

ACLs are:

• Stateless
• Difficult to scale
• Operationally fragile

ACLs should not replace:

$$ Architectural\\ Isolation $$

💡 CCDE Principle

Security should be built into architecture, not patched with ACLs.

Problem 3 – Capacity Still Fails

Even ignoring security concerns:

$$ Capacity\\ Still\\ Exceeds\\ 10Gbps $$

Therefore Option B fails both:

• Security design
• Capacity planning

6. Why Option C Is Incorrect

Option C

Deploy a new CE router back-to-back with the existing CE router.

This is architecturally awkward.

More importantly:

🚫 The option never specifies a new MPLS tail circuit.

Without a new tail circuit:

$$ Capacity\\ Problem\\ Remains $$

The solution introduces:

• More hardware
• More complexity
• No actual bandwidth improvement

This is a classic example of:

$$ Infrastructure\\ Complexity \neq Scalability $$

7. Why Option D Is Correct

Option D

Provision:

• New MPLS VPN
• New tail circuit
• Separate VRF

This solves:

Requirement	Solved?
Traffic isolation	✅
Capacity issue	✅
Firewall policy enforcement	✅
Scalability	✅
Operational clarity	✅

Why This Is Good Enterprise Architecture

The solution preserves:

• Logical segmentation
• Security boundaries
• Policy enforcement
• Independent operational control

while providing:

$$ Dedicated\\ Capacity $$

This is a textbook MPLS enterprise design.

Enterprise Segmentation Formula

$$ Security + Scalability = Isolation + Dedicated\\ Capacity $$

8. Enterprise WAN Mathematics

Traffic Aggregation Formula

$$ Total\\ Traffic = Traffic_1 + Traffic_2 + Traffic_3 $$

Bandwidth Utilization Formula

$$ Utilization = \frac{Traffic}{Available\\ Capacity} $$

Oversubscription Ratio

$$ Oversubscription = \frac{Required\\ Bandwidth}{Available\\ Bandwidth} $$

Scalability Formula

$$ Scalability \propto Segmentation + Capacity + Simplicity $$

MPLS VPN Isolation Formula

$$ VRF_A \neq VRF_B $$

9. MPLS VRF Configuration Examples

Example – VRF Definition

vrf definition INDEPENDENT-STORES

vrf definition INDEPENDENT-STORES

 rd 65000:100

 address-family ipv4

 route-target export 65000:100
 route-target import 65000:100

Example – Interface Assignment

interface GigabitEthernet0/0

interface GigabitEthernet0/0

 vrf forwarding INDEPENDENT-STORES

 ip address 10.10.10.1 255.255.255.252

Example – BGP VPNv4

router bgp 64556

router bgp 64556

 address-family vpnv4

 neighbor 192.168.1.1 activate
 neighbor 192.168.1.1 send-community extended

Example – MPLS L3VPN Redistribution

router ospf 100 vrf INDEPENDENT-STORES

router ospf 100 vrf INDEPENDENT-STORES

 redistribute bgp 64556 subnets

Why VRFs Are Better Than ACL-Based Segmentation

VRFs provide:

• True routing isolation
• Independent forwarding tables
• Scalable segmentation
• Cleaner operations

ACLs only filter traffic after routing decisions.

This makes ACL-based segmentation operationally weaker.

10. Machine Learning and Capacity Forecasting

Modern enterprise WAN environments increasingly use:

• Traffic forecasting
• Anomaly detection
• Capacity prediction
• AIOps analytics

Understanding utilization graphs requires data science thinking.

Useful related concepts:

• Time Series Forecasting Beginners Guide
• Stationary vs Nonstationary Data
• How to Evaluate and Ensure Your Data
• RandomizedSearchCV Beginners Guide

These concepts help enterprise architects:

• Predict WAN growth
• Avoid saturation
• Improve procurement planning
• Optimize infrastructure investments

11. Final Architectural Takeaways

🎯 Correct Answer

Provision a new, separate L3 MPLS VPN for independent stores within the Bluesky MPLS WAN on a new central tail circuit into the DC that breaks out into separate VRFs in the existing DC CE router.

Why This Is Correct

• Solves capacity limitations
• Maintains segmentation
• Preserves firewall policy model
• Supports scalability
• Maintains operational clarity

Why Other Options Fail

Option	Primary Failure
Option A	No additional WAN capacity
Option B	Security and segmentation failure
Option C	No new tail circuit defined

💡 Most Important CCDE Lesson

Architecture is not just about protocols.

It is about:

• Capacity
• Segmentation
• Scalability
• Operational simplicity
• Business alignment

12. Related Articles

CCDE Enterprise Case Study Series

• CCDE Enterprise Case Study Part 1 – Enterprise Architecture Overview
• CCDE Enterprise Case Study Part 2 – Main Enterprise Challenges
• CCDE Enterprise Case Study Part 3 – Scalability and Operations
• CCDE Enterprise Case Study Part 4 – MPLS Contract Renewal
• CCDE Enterprise Case Study Part 6: DMVPN vs MPLS vs SD-WAN for Jacobs WAN Integration and VoIP Optimization

Related CCIE Networking Articles

• Complete MPLS L3VPN Configuration Lab
• Complete MPLS QoS Configuration Lab
• Reliable BGP Peering Physical Connectivity
• OSPF Area Types Explained
• Complete Cisco Nexus VXLAN EVPN
• Mastering Passive Interface in OSPF

Final Conclusion

This question is an excellent example of real enterprise architecture thinking.

The correct solution is not simply:

• "Use MPLS"
• "Use VRFs"
• "Deploy ACLs"

Instead, the architect must evaluate:

• Capacity limits
• Segmentation requirements
• Operational simplicity
• Security architecture
• WAN scalability

The optimal enterprise design becomes:

$$ Dedicated\\ Capacity + Dedicated\\ VPN + Dedicated\\ VRF $$

This reflects exactly how large enterprise MPLS WANs are designed in real-world environments.