CCDE Enterprise Case Study Part 9: SD-WAN Security Priorities, Direct Internet Access (DIA), and Enterprise Risk Analysis

CCDE Enterprise Case Study Part 9 – SD-WAN Security Priorities and Direct Internet Access Risks

In this part of the CCDE enterprise architecture case study, we analyze one of the most important modern enterprise networking transformations:

🎯 Migration from MPLS-Centric WAN to SD-WAN with Direct Internet Access

At first glance, SD-WAN appears to solve:

• Bandwidth limitations
• MPLS cost problems
• Cloud connectivity issues
• Application performance challenges

However, enterprise architects must understand that:

$$ WAN\\ Transformation \neq Automatic\\ Security $$

The biggest architectural challenge is often:

$$ Distributed\\ Security\\ Enforcement $$

The Question

If Jacobs were to move to an SD-WAN solution with:

• One MPLS + One Internet circuit at Jacobs stores
• One MPLS + One Internet circuit at Toolmate stores
• Internet-only WAN connectivity at independent stores

Which security area should take priority?

Correct Answer

✅ Direct Internet Access from stores

Table of Contents

• 1. Understanding the Existing Security Model
• 2. Why Direct Internet Access Is the Biggest Risk
• 3. Centralized Proxy Security Architecture
• 4. How SD-WAN Changes Security Boundaries
• 5. SASE and Zero Trust Concepts
• 6. Why PKI Is Not the Primary Concern
• 7. Why DDoS Is Not the Main Problem
• 8. Enterprise Security Mathematics
• 9. SD-WAN and Security CLI Examples
• 10. Machine Learning and Security Analytics
• 11. Key Architectural Takeaways
• 12. Related Articles

1. Understanding the Existing Security Model

The documentation explicitly states:

Provider-assigned public IP addressing is used for external hosting
using a Britnet registered /24 prefix,
which is further subnetted to provide DMZ segmentation
for public-facing Jacobs services and NAT ranges
for employee Internet access via a central proxy server within the DMZ.

This single paragraph reveals a critical architectural detail:

Current Internet Security Is Centralized

Current Security Flow

$$ Store \rightarrow MPLS \rightarrow DC \rightarrow Proxy \rightarrow Internet $$

This means:

• Security policies are centralized
• Internet filtering is centralized
• Threat inspection is centralized
• Logging is centralized
• Compliance is centralized

Benefits of Centralized Security

Feature	Benefit
Central proxy	Single enforcement point
Central logging	Compliance visibility
Unified policy	Consistent filtering
Traffic inspection	Threat reduction
Simplified governance	Lower operational risk

2. Why Direct Internet Access Is the Biggest Risk

When SD-WAN introduces:

$$ Direct\\ Internet\\ Access\\ (DIA) $$

the entire security architecture changes.

New Traffic Pattern

Instead of:

$$ Store \rightarrow MPLS \rightarrow DC $$

traffic becomes:

$$ Store \rightarrow Internet $$

This fundamentally changes:

• Trust boundaries
• Threat exposure
• Security policy enforcement
• Monitoring visibility
• Compliance architecture

💡 Critical CCDE Insight

SD-WAN decentralizes traffic.

Therefore:

$$ Security\\ Must\\ Also\\ Decentralize $$

Why This Is Dangerous

Without local policy enforcement:

• Malware filtering disappears
• URL filtering disappears
• Threat inspection disappears
• Compliance controls disappear
• User monitoring disappears

Enterprise Risk Formula

$$ Risk \propto Exposure - Security\\ Controls $$

If:

$$ Exposure \uparrow $$

and:

$$ Controls \downarrow $$

then:

$$ Risk \uparrow\uparrow $$

3. Centralized Proxy Security Architecture

Jacobs currently uses:

$$ Centralized\\ Proxy\\ Security $$

This is extremely common in traditional MPLS architectures.

Traditional Enterprise Security Model

Store LAN
   |
MPLS WAN
   |
Central DC Firewall
   |
Proxy
   |
Internet

Why Enterprises Historically Used This Model

• MPLS was expensive but trusted
• Internet security tools were centralized
• Branch appliances were limited
• Cloud adoption was lower

This model creates:

$$ Centralized\\ Control $$

but also:

$$ Hairpinning $$

where Internet traffic unnecessarily traverses the DC.

Latency Formula

$$ Latency = WAN + DC + Proxy + Internet $$

This explains why:

• Office 365 performance suffered
• Cloud SaaS performance degraded
• User experience became inconsistent

4. How SD-WAN Changes Security Boundaries

SD-WAN enables:

• Local Internet breakout
• Application-aware routing
• Cloud optimization
• Dynamic path selection

However:

$$ Every\\ Branch\\ Becomes\\ an\\ Internet\\ Edge $$

🎯 Enterprise Architecture Impact

The security perimeter moves:

$$ From\\ the\\ Data\\ Center $$

to:

$$ Every\\ Branch $$

Operational Implications

• Local firewalls may be required
• Cloud security services may be required
• ZTNA models may be required
• SASE adoption may become necessary

5. SASE and Zero Trust Concepts

Modern SD-WAN architectures often evolve toward:

$$ SASE $$

which stands for:

Secure Access Service Edge

SASE combines:

• SD-WAN
• Cloud security
• CASB
• ZTNA
• FWaaS
• Secure web gateways

Why This Matters

Without centralized proxies:

$$ Security\\ Must\\ Follow\\ the\\ User $$

Zero Trust Formula

$$ Trust = 0 $$

Verification becomes:

$$ Continuous $$

Related Security Architecture Articles

• Modern Web Filtering with Cisco ASA
• Enhancing IKE Phase 1 Security
• SSL VPN on Cisco IOS – Simplifying Secure Remote Access
• Enhancing Packet Inspection with Cisco Security Features
• The Evolution of Cisco IPS from Legacy Architectures

6. Why PKI Is Not the Primary Concern

PKI is extremely important in SD-WAN.

It enables:

• Tunnel authentication
• Certificate validation
• Device identity
• Encrypted overlays

However:

PKI is an implementation detail, not the primary architectural risk.

The real strategic problem is:

$$ Distributed\\ Internet\\ Exposure $$

not certificate deployment.

PKI Formula

$$ Identity + Encryption = Trusted\\ Overlay $$

7. Why DDoS Is Not the Main Problem

Jacobs already operates:

• Public websites
• Online retail services
• Internet-facing applications

Therefore:

$$ DDoS\\ Exposure\\ Already\\ Exists $$

SD-WAN migration does not fundamentally introduce:

• New public web exposure
• New Internet-facing services

The major change is:

$$ Store\\ Internet\\ Breakout $$

8. Enterprise Security Mathematics

Threat Surface Formula

$$ Threat\\ Surface \propto Internet\\ Exposure \times Endpoints $$

Distributed Security Complexity

$$ Security\\ Complexity \propto Branches \times Policies $$

Visibility Formula

$$ Visibility = Logs + Telemetry + Analytics $$

SASE Efficiency Formula

$$ Efficiency = Cloud\\ Security + Local\\ Breakout $$

Operational Risk Formula

$$ Operational\\ Risk = Exposure - Governance $$

9. SD-WAN and Security CLI Examples

Code Example – DIA Policy

policy-map type inspect INTERNET-POLICY

policy-map type inspect INTERNET-POLICY

 class type inspect WEB-TRAFFIC

  inspect

 class class-default

  drop

Code Example – Local Internet Breakout ACL

ip access-list extended INTERNET-ACCESS

ip access-list extended INTERNET-ACCESS

 permit tcp any any eq 80
 permit tcp any any eq 443

 deny ip any any log

Code Example – SD-WAN DIA Route Policy

sdwan
 policy

sdwan

 policy

  app-route-policy CLOUD-TRAFFIC

   sequence 10

    match application office365

    action accept

     set local-tloc-color biz-internet

Why Office 365 Suffers Without DIA

Cloud applications are latency-sensitive.

If traffic hairpins through the DC:

$$ User \rightarrow MPLS \rightarrow DC \rightarrow Internet $$

latency increases dramatically.

DIA solves performance issues but introduces:

$$ Security\\ Distribution $$

10. Machine Learning and Security Analytics

Modern SD-WAN and SASE environments rely heavily on:

• Anomaly detection
• Traffic classification
• Behavioral analytics
• Threat intelligence correlation

Machine learning becomes increasingly important for:

• Threat detection
• Traffic prediction
• Capacity planning
• Security automation

Relevant machine learning concepts:

• Time Series Forecasting Beginners Guide
• How to Evaluate and Ensure Your Data
• Stationary vs Nonstationary Data
• Understanding Perplexity
• RandomizedSearchCV Beginners Guide

11. Key Architectural Takeaways

✅ Correct Answer

Direct Internet Access from stores

Why This Is Correct

• Security policies currently rely on centralized proxies
• SD-WAN decentralizes Internet access
• Branches become Internet edges
• Threat exposure increases dramatically
• Security architecture must fundamentally change

Why Other Answers Are Suboptimal

Option	Why Suboptimal
Encryption Ciphers	Implementation detail, not strategic priority
PKI Infrastructure	Important but operationally secondary
DDoS Protection	Already required before SD-WAN migration

12. Related Articles

CCDE Enterprise Case Study Series

• CCDE Enterprise Case Study Part 1 – Enterprise Architecture
• CCDE Enterprise Case Study Part 2 – Main Issues Facing Jacobs
• CCDE Enterprise Case Study Part 3 – Scalability and Management Overhead
• CCDE Enterprise Case Study Part 4 – MPLS Architecture
• CCDE Enterprise Case Study Part 5 – MPLS Operational Analysis
• CCDE Enterprise Case Study Part 6 – DMVPN Analysis
• CCDE Enterprise Case Study Part 7 – Enterprise Architecture Decisions
• CCDE Enterprise Case Study Part 8 – SD-WAN Transformation
• CCDE Enterprise Case Study Part 10: Fully Managed vs Self-Managed SD-WAN Design Analysis

Related CCIE Enterprise and Security Articles

• Complete MPLS L3VPN Configuration Lab
• Complete MPLS QoS Configuration Lab
• Complete Cisco Nexus VXLAN EVPN
• Reliable BGP Peering Physical Connectivity
• Optimizing OSPF Timers for Faster Convergence

Final Conclusion

This question highlights one of the most important realities of modern enterprise networking:

SD-WAN is not just a WAN transformation.

It is also:

$$ A\\ Security\\ Transformation $$

Jacobs currently relies on:

• Centralized proxies
• Centralized inspection
• Centralized policy enforcement

Direct Internet Access fundamentally changes:

• Trust boundaries
• Threat exposure
• Policy distribution
• Visibility models

Therefore, from a CCDE architectural perspective:

✅ Direct Internet Access security must take priority.