CCDE SD-WAN Design Part 15: 5G, DIA, Firewall Placement, and Branch Security Architecture

CCDE Enterprise Case Study Part 15 – SD-WAN, 5G, DIA, and Firewall Placement Design

In this part of the Jacobs CCDE enterprise case study, the organization investigates using:

• SD-WAN
• 5G WAN connectivity
• Direct Internet Access (DIA)
• Integrated security services

to reduce WAN operational costs while improving cloud and SaaS performance.

However, the key architectural challenge becomes:

Should Jacobs deploy dedicated firewalls at every branch store if SD-WAN edge routers already include integrated security features?

This question appears simple initially.

But at CCDE level, this is actually a:

• Security policy problem
• Operational governance problem
• Compliance problem
• Architecture separation problem

---

Table of Contents

• 1. Business Context
• 2. Question Analysis
• 3. Correct Answer
• 4. Why Firewall Placement Matters
• 5. 5G and SD-WAN Architecture
• 6. Jacobs Security Policy
• 7. Traffic Visibility and Encryption
• 8. Security and WAN Mathematical Models
• 9. SD-WAN and Firewall CLI Examples
• 10. Machine Learning and Threat Analytics
• 11. Related Articles

---

1. Business Context

Jacobs currently operates:

• Multiple MPLS providers
• Centralized Internet breakout
• High WAN operational expenditure
• Legacy application dependencies

The company now wants to:

• Replace secondary MPLS links
• Use 5G Internet connectivity
• Enable Direct Internet Access
• Deploy SD-WAN

This design introduces major architectural advantages:

Benefit	Explanation
Lower WAN cost	Internet cheaper than MPLS
Better SaaS performance	Local breakout reduces latency
Cloud optimization	Direct access to Office 365
Faster deployment	5G circuits provision quickly

💡 Key Enterprise Insight

Traditional WAN:

$$ Branch \rightarrow MPLS \rightarrow DC \rightarrow Internet $$

SD-WAN DIA:

$$ Branch \rightarrow Internet $$

This dramatically reduces latency.

---

2. Question Analysis

The SD-WAN edge routers include:

• VRFs
• L7 Firewall
• IPS/IDS
• URL Filtering

At first glance, many engineers would conclude:

"No separate firewall is required."

However, Jacobs has a very important enterprise security policy:

Jacobs Security Policy

Infrastructure devices must be limited to:

$$ Single\\ Defined\\ Functionality $$

Separate functions must use:

$$ Separate\\ Physical\\ Infrastructure $$

This policy fundamentally changes the answer.

---

3. Correct Answer

Correct Answer:

B. Firewalls should be deployed physically behind the SD-WAN edge routers with the Internet/5G connections.

---

4. Why Firewall Placement Matters

Understanding Physical Placement

With wired Internet circuits:

$$ Internet \rightarrow Firewall \rightarrow Router $$

is possible.

But with integrated:

• 5G modem
• Cellular uplink
• Embedded WAN radio

there is no physical handoff before the SD-WAN router.

This means:

$$ 5G\\ Signal \rightarrow SDWAN\\ Edge $$

must occur first.

Therefore the firewall must be positioned:

$$ Store\\ LAN \rightarrow Firewall \rightarrow SDWAN\\ Router $$

---

5. 5G and SD-WAN Architecture

Proposed Jacobs Store Architecture

            +----------------+
            |   5G Provider  |
            +--------+-------+
                     |
                     |
             +-------+-------+
             | SD-WAN Edge   |
             | Router        |
             +-------+-------+
                     |
             +-------+-------+
             | Branch FW     |
             +-------+-------+
                     |
             +-------+-------+
             | Store LAN     |
             +---------------+

This design ensures:

• Routing handled by SD-WAN edge
• Security handled by firewall
• Policy compliance maintained
• Traffic visibility preserved

---

6. Jacobs Security Policy

The MOST important detail in this question is NOT:

• 5G
• DIA
• MPLS replacement

The most important detail is:

Security Governance

Jacobs already suffered:

• Vendor interoperability failure
• Major outage
• Operational instability

This caused the organization to adopt:

$$ Functional\\ Separation $$

Why Enterprises Do This

Reason	Benefit
Fault isolation	Limits blast radius
Security separation	Improves compliance
Operational ownership	Separate teams
Reduced interoperability risk	More stable architecture

---

7. Traffic Visibility and Encryption

One of the most important CCDE-level concepts here is:

$$ Traffic\\ Visibility $$

Firewall Before SD-WAN Edge

If firewall sits BEFORE SD-WAN edge:

$$ Firewall \rightarrow Encrypted\\ IPsec\\ Traffic $$

The firewall only sees:

• Encrypted tunnels
• Overlay packets
• Transport flows

It cannot inspect:

• Applications
• URLs
• User sessions
• Threat payloads

Firewall Behind SD-WAN Edge

If firewall sits AFTER SD-WAN edge:

$$ Firewall \rightarrow Decrypted\\ LAN\\ Traffic $$

Now the firewall can inspect:

• HTTP
• HTTPS
• SaaS traffic
• User sessions
• Threat signatures

🎯 This is the real architectural reason behind the design.

---

8. Security and WAN Mathematical Models

Latency Reduction Formula

$$ Latency = Transport + Inspection + Distance $$

Traffic Visibility Model

$$ Visibility \propto Inspection\\ Depth $$

Operational Complexity

$$ Complexity = Functions \times Devices \times Policies $$

Branch Security Risk

$$ Risk = Exposure \times Vulnerability $$

DIA Efficiency

$$ Efficiency = \frac{Direct\\ Access}{Backhaul\\ Latency} $$

---

9. SD-WAN and Firewall CLI Examples

Example – VRF Segmentation

vrf definition PCI

 rd 100:1

 address-family ipv4
 exit-address-family

Example – Zone Firewall Policy

zone security INSIDE

zone security OUTSIDE

zone-pair security IN-OUT source INSIDE destination OUTSIDE

 service-policy type inspect POLICY1

Example – IPSec Overlay

interface Tunnel10

 ip address 10.10.10.1 255.255.255.252

 tunnel source Cellular0/1/0

 tunnel mode ipsec ipv4

Example – URL Filtering

urlfilter profile INTERNET-POLICY

 block gambling

 block malware

---

10. Machine Learning and Threat Analytics

Modern SD-WAN and security platforms increasingly use:

• Machine learning
• Behavioral analytics
• Anomaly detection
• Threat prediction

for:

• DDoS detection
• Botnet analysis
• User behavior analytics
• Traffic classification

Useful Machine Learning Articles

• Time Series Forecasting Beginners Guide
• Stationary vs Nonstationary Data
• How to Evaluate and Ensure Your Data

---

11. Related Articles

CCDE Enterprise Case Study Series

• Part 1 – Enterprise Architecture
• Part 2 – Business Challenges
• Part 3 – Scalability Analysis
• Part 4 – MPLS Design
• Part 5 – MPLS Operations
• Part 6 – DMVPN Design
• Part 7 – Enterprise Evolution
• Part 8 – SD-WAN Migration
• Part 9 – SD-WAN Security
• Part 10 – WAN Modernization
• Part 11 – Self Managed SD-WAN
• Part 12 – SD-WAN Architecture Explained
• Part 13 – Best WAN Transport
• Part 14 – Internet Access and DIA
• CCDE SD-WAN Design Part 16 – Can Toolmate Remove Its Internet Edge?

Security Related Articles

• Modern Web Filtering with Cisco ASA
• Enhancing IKE Phase 1 Security
• SSL VPN on Cisco IOS
• Enhancing Packet Inspection with Cisco Security Features
• The Evolution of Cisco IPS

Final Conclusion

The key lesson from this CCDE scenario is:

$$ Architecture > Features $$

Even though the SD-WAN routers include:

• Firewalling
• IPS
• URL filtering

Jacobs enterprise policy requires:

$$ Single\\ Function\\ Infrastructure $$

Therefore:

• SD-WAN edge handles transport
• Firewall handles security
• 5G provides WAN access
• DIA improves SaaS performance

The correct enterprise-grade design is:

$$ LAN \rightarrow Firewall \rightarrow SDWAN\\ Edge \rightarrow 5G $$

This preserves:

• Security visibility
• PCI compliance
• Operational governance
• Traffic inspection capability