CCDE Enterprise Case Study Part 8: SD-WAN, DIA, MPLS Reduction & Internet Bandwidth Design Analysis

CCDE Enterprise Case Study Part 8 – SD-WAN, DIA, Internet Circuit Reduction, and Enterprise WAN Design Analysis

In this part of the CCDE enterprise architecture case study, we analyze one of the most realistic enterprise WAN transformation discussions:

• Migration toward SD-WAN
• Direct Internet Access (DIA)
• MPLS cost reduction
• Internet breakout decentralization
• ISP bandwidth optimization
• Centralized versus distributed traffic engineering

This question is extremely important because it tests whether the architect understands:

• Traffic flow behavior
• Overlay networking
• Bandwidth engineering
• Failure-domain analysis
• Enterprise WAN scaling

🎯 Final Correct Answer: NO

Jacobs cannot confidently reduce central ISP circuit capacity simply because stores begin using DIA.

In fact:

$$ SD\text{-}WAN\\ Overlay\\ Traffic \uparrow $$

which means:

$$ Internet\\ WAN\\ Dependency \uparrow $$

Table of Contents

• 1. Understanding the Question
• 2. What DIA Actually Changes
• 3. The Wrong Assumption About Internet Reduction
• 4. SD-WAN Overlay Traffic Explained
• 5. ISP Utilization Analysis
• 6. MPLS Failure Scenarios
• 7. Internet Bandwidth Engineering
• 8. SD-WAN Mathematical Analysis
• 9. SD-WAN CLI and Tunnel Examples
• 10. Machine Learning and Capacity Forecasting
• 11. Key Architectural Takeaways
• 12. Related Articles

1. Understanding the Question

James Medina proposes:

• Store DIA internet breakout
• MPLS reduction
• SD-WAN overlays
• Removal of secondary ISP circuits
• Reduction of central ISP bandwidth

At first glance, this sounds logical:

$$ Store\\ Internet\\ Traffic \rightarrow Local\\ Breakout $$

Therefore:

$$ Central\\ Internet\\ Traffic \downarrow $$

However:

💡 This is only partially true.

The architect must understand:

• Overlay traffic behavior
• DC reachability requirements
• Failure-state traffic patterns
• Tunnel replication
• Encrypted transport overhead

2. What DIA Actually Changes

Traditionally:

$$ Store \rightarrow MPLS \rightarrow DC \rightarrow Internet $$

This is centralized internet breakout.

With DIA:

$$ Store \rightarrow Local\\ Internet $$

This reduces:

• Backhaul latency
• Central firewall load
• DC internet congestion

However:

The stores STILL require access to:

• DC applications
• Authentication systems
• VoIP systems
• ERP platforms
• Shared services

That traffic now traverses:

$$ Internet + SD\text{-}WAN\\ Overlay $$

3. The Wrong Assumption About Internet Reduction

James assumes:

$$ DIA = Less\\ DC\\ Internet\\ Usage $$

This is incomplete.

Because:

• SD-WAN overlays consume internet bandwidth
• Inter-site VPN traffic increases
• Tunnel replication occurs
• Encrypted transport overhead increases

SD-WAN Overlay Formula

$$ Total\\ Internet\\ Usage = Local\\ Breakout + Overlay\\ VPN\\ Traffic + Control\\ Plane + Encrypted\\ Overhead $$

In fact:

$$ Internet\\ Dependency \uparrow $$

after SD-WAN migration.

4. SD-WAN Overlay Traffic Explained

This is the MOST important concept in this question.

Traditional MPLS Model

Store --> MPLS --> DC

Traffic remains private.

Internet circuits are mostly used for:

• User internet browsing
• Public SaaS access
• External services

SD-WAN Overlay Model

Store --> Internet --> Encrypted Tunnel --> DC

Now:

• Private traffic uses internet bandwidth
• WAN traffic becomes internet traffic
• MPLS failover increases tunnel usage

🎯 Critical Enterprise Insight

SD-WAN does NOT eliminate WAN traffic.

It changes:

$$ Private\\ WAN\\ Traffic \rightarrow Internet\\ Overlay\\ Traffic $$

5. ISP Utilization Analysis

Jacobs ISP Utilization

• Peak inbound traffic reaches 0.9 Gbps
• Average inbound remains high
• Traffic spikes already approach circuit limits

Toolmate ISP Utilization

• Peak traffic also reaches 0.9 Gbps
• Inbound utilization steadily increases
• Current bandwidth is already heavily utilized

Utilization Formula

$$ Utilization = \frac{Used\\ Bandwidth}{Available\\ Bandwidth} \times 100 $$

If:

$$ Peak = 0.9Gbps $$

and:

$$ Link = 1Gbps $$

then:

$$ Utilization = 90\% $$

This is already extremely high for enterprise WAN engineering.

💡 Enterprise WAN Best Practice

Sustained utilization above:

$$ 70\% $$

usually indicates:

• Congestion risk
• Packet drops
• Jitter increase
• Queue growth

6. MPLS Failure Scenarios

This is where the design becomes dangerous.

James proposes:

• Removing backup MPLS links
• Removing backup ISP links
• Relying on SD-WAN internet failover

Now imagine:

Failure Scenario

Bluesky MPLS Failure

What happens?

• Store-to-DC traffic moves to SD-WAN overlay
• Internet circuits absorb WAN traffic
• DC internet utilization spikes massively

Failure Traffic Formula

$$ Failure\\ Traffic = Internet\\ Traffic + WAN\\ Overlay\\ Traffic $$

This means:

$$ Bandwidth\\ Demand \uparrow\uparrow $$

during outages.

Architectural Problem

James wants to:

• Reduce ISP capacity
• Increase dependency on ISP transport

These are contradictory goals.

7. Internet Bandwidth Engineering

Enterprise WAN engineers must design for:

• Normal operations
• Failure operations
• Burst conditions
• Growth projections

Enterprise Capacity Formula

$$ Required\\ Capacity = Peak\\ Traffic + Failure\\ Headroom + Growth\\ Buffer $$

James proposes:

$$ Reducing\\ Capacity $$

while simultaneously:

$$ Increasing\\ Dependency $$

This is poor engineering.

🎯 Correct Enterprise Thinking

When WAN traffic shifts from MPLS to Internet:

$$ Internet\\ Capacity\\ Requirements \uparrow $$

8. SD-WAN Mathematical Analysis

Overlay Tunnel Overhead

$$ Effective\\ Throughput = Raw\\ Bandwidth - Encryption\\ Overhead $$

Failure-State Traffic Growth

$$ Total\\ Traffic = Business\\ Traffic + Replication + Control\\ Plane + Overlay\\ Encapsulation $$

Bandwidth Headroom Formula

$$ Headroom = Capacity - Peak\\ Usage $$

Current Jacobs Headroom

$$ 1Gbps - 0.9Gbps = 0.1Gbps $$

Only:

$$ 100Mbps $$

headroom currently exists.

That is extremely dangerous.

Congestion Probability

$$ Congestion\\ Risk \propto \frac{Peak\\ Usage}{Capacity} $$

9. SD-WAN CLI and Tunnel Examples

Example – IPSec Tunnel

crypto ikev2 proposal SDWAN

crypto ikev2 proposal SDWAN

 encryption aes-cbc-256
 integrity sha256
 group 14

Example – Tunnel Interface

interface Tunnel100

interface Tunnel100

 ip address 10.255.255.1 255.255.255.252

 tunnel source GigabitEthernet0/0
 tunnel destination 100.100.100.1

 tunnel protection ipsec profile SDWAN-PROFILE

Example – DIA Policy

policy-map DIA-INTERNET

policy-map DIA-INTERNET

 class BUSINESS-CRITICAL
  priority percent 30

 class REALTIME
  bandwidth percent 20

 class class-default
  fair-queue

Why SD-WAN Requires More Internet Engineering

SD-WAN shifts critical enterprise traffic onto internet transports.

Therefore:

• Internet circuits become mission critical
• Packet loss matters more
• Jitter matters more
• ISP redundancy becomes more important

10. Machine Learning and Capacity Forecasting

Modern WAN engineering increasingly relies on:

• Traffic forecasting
• Anomaly detection
• Predictive capacity modeling
• Behavioral analytics

For deeper understanding of predictive modeling and enterprise traffic analytics:

• Time Series Forecasting Beginners Guide
• Stationary vs Nonstationary Data
• How to Evaluate and Ensure Your Data
• Understanding Perplexity

Machine learning becomes highly relevant for:

• Bandwidth forecasting
• ISP anomaly detection
• Capacity prediction
• Failure simulation

11. Key Architectural Takeaways

🎯 Final Correct Answer: NO

Jacobs cannot confidently reduce central ISP bandwidth or remove secondary ISP circuits simply because DIA is introduced.

Why?

• SD-WAN overlays consume internet bandwidth
• MPLS failover shifts traffic onto ISP circuits
• Current ISP utilization is already high
• Internet dependency increases dramatically
• Failure-state traffic would overload reduced-capacity circuits

Core Architectural Lesson

Enterprise architects must evaluate:

• Normal-state behavior
• Failure-state behavior
• Traffic redistribution
• Overlay implications
• Operational risk

💡 Most Important CCDE Insight

Traffic does not disappear during migration.

It simply changes transport.

12. Related Articles

CCDE Enterprise Case Study Series

• CCDE Enterprise Case Study Part 1 – Enterprise Architecture
• CCDE Enterprise Case Study Part 2 – Main Issues Facing Jacobs
• CCDE Enterprise Case Study Part 3 – Scalability and Operational Overhead
• CCDE Enterprise Case Study Part 4 – MPLS Design Analysis
• CCDE Enterprise Case Study Part 5 – MPLS WAN Rationalization
• CCDE Enterprise Case Study Part 6 – DMVPN Enterprise Design
• CCDE Enterprise Case Study Part 7 – Enterprise WAN Strategy
• CCDE Enterprise Case Study Part 9: SD-WAN Security Priorities, Direct Internet Access (DIA), and Enterprise Risk Analysis

Related CCIE and Enterprise Networking Articles

• Complete MPLS L3VPN Configuration Lab
• Complete MPLS QoS Configuration Lab
• Reliable BGP Peering Physical Connectivity
• Mastering Passive Interface in OSPF
• Optimizing OSPF Timers for Faster Convergence
• Complete Cisco Nexus VXLAN EVPN

Final Conclusion

This question is a classic CCDE architectural trap.

Many engineers incorrectly assume:

$$ DIA = Less\\ Internet\\ Usage $$

But enterprise architects must understand:

$$ SD\text{-}WAN\\ Overlay\\ Traffic \neq Traffic\\ Elimination $$

The traffic still exists.

It simply moves from:

$$ MPLS \rightarrow Internet $$

Therefore:

• Internet dependency increases
• Bandwidth requirements increase
• Failure-state traffic becomes critical
• ISP resilience becomes MORE important

That is why the correct answer is:

✅ NO