Wide area network connecting two enterprise sites and a cloud service

A local area network connects devices within a limited area such as a room, building, or campus. A wide area network (WAN), by contrast, connects geographically separated sites through carrier, public, or private infrastructure. Modern organizations rarely operate a single type of network. A branch office may use a leased line or broadband access, employees may connect through cellular networks, applications may run in cloud data centres, and sensors may communicate through low-power wireless systems. These environments must interoperate while meeting requirements for scalability, security, availability, and quality of service (QoS).

This chapter examines WAN services, virtual private networks (VPNs), broadband, cellular and satellite communication, cloud networking, and Internet of Things (IoT) architectures. The emphasis is not merely on identifying technologies, but on selecting and combining them for practical deployments.

Learning Objectives

1. WAN Foundations

A WAN provides communication between networks that are separated by significant distance. It generally includes customer premises equipment (CPE), an access link, a provider network, and a remote site or service. The provider may be a telecommunications operator, Internet service provider, satellite operator, or cloud connectivity provider.

Figure: A WAN connecting enterprise sites and cloud services through shared or private transport.

1.1 WAN topologies

A point-to-point WAN connects two sites directly. It is simple and predictable but becomes expensive when many sites must communicate. A hub-and-spoke design connects branches through a central hub. It simplifies policy enforcement, although branch-to-branch traffic may take a longer path. A full mesh provides direct paths between all sites, but the number of potential links grows rapidly. For n sites, a full mesh requires:

where L is the number of bidirectional logical links and n is the number of sites. This relationship assumes that every pair of sites has one direct logical connection. With 10 sites, L = 10 × 9 ÷ 2 = 45 links, illustrating why large networks commonly use hierarchical, hub-based, or dynamically controlled designs.

A partial mesh provides direct connections only where performance or availability justifies them. Modern SD-WAN systems often create an overlay that can use several underlay transports while selecting paths dynamically.

1.2 Circuit switching and packet switching

Traditional circuit-switched services reserve a dedicated path and capacity for the duration of a session. This offers predictable performance but may waste capacity during silence or inactivity. Packet-switched networks divide information into packets and statistically share links. They use capacity efficiently for bursty data but may introduce variable delay, jitter, congestion, and packet loss.

The Internet, Ethernet WANs, IP VPNs, and MPLS services are packet-oriented. A provider may offer traffic classes, traffic engineering, and service-level agreements (SLAs), but these do not eliminate the need for monitoring and capacity planning.

2. WAN Services and Access Technologies

2.1 Leased lines

A leased line is a dedicated point-to-point circuit supplied for continuous use. Common benefits are stable bandwidth, low variation in delay, service-provider support, and clear demarcation. Disadvantages include high recurring cost and limited flexibility when sites or bandwidth requirements change. Leased lines remain useful for financial institutions, data-centre interconnection, and critical sites requiring deterministic connectivity.

2.2 Ethernet and MPLS services

Carrier Ethernet extends familiar Ethernet concepts across a provider network. Ethernet private lines can provide point-to-point connectivity, while virtual private LAN services can connect several locations at Layer 2. They are convenient for organizations already using Ethernet but require careful attention to broadcast domains, failure isolation, and provider responsibilities.

Multiprotocol Label Switching (MPLS) forwards packets using labels and provider-defined paths. MPLS can support Layer 3 VPNs, traffic classes, and predictable service characteristics. It is not automatically encrypted; confidentiality normally requires IPsec or another security mechanism. MPLS may be more expensive than Internet access, but it can offer stronger operational guarantees and provider-managed QoS.

2.3 Broadband access

Broadband includes digital subscriber line (DSL), cable, fibre, fixed wireless, and other high-speed access technologies. Fibre generally offers high capacity, low signal loss, and symmetrical service options. Cable networks may offer high downstream capacity but shared neighbourhood capacity. DSL performance depends strongly on copper-loop length and quality. Fixed wireless can be rapidly deployed but is affected by radio conditions, spectrum, and line-of-sight constraints.

Advertised access speed is not the same as application performance. A design must consider upload speed, contention, latency, jitter, packet loss, data caps, installation time, and repair commitments. Broadband is often excellent as a primary or secondary SD-WAN transport, but a low-cost connection may provide a weaker SLA than a dedicated service.

2.4 SD-WAN

Software-defined WAN separates centralized policy and control from forwarding devices. Edge devices establish encrypted overlays over one or more underlays, such as MPLS, fibre broadband, 5G, or satellite. A controller distributes policy, while the edge may select a path according to measured latency, loss, jitter, cost, or application identity.

SD-WAN does not make an unreliable underlay reliable by itself. It can steer traffic, use multiple links, and automate configuration, but it requires accurate telemetry, resilient controllers, secure key management, and well-defined policies. Direct Internet breakout may improve cloud performance but increases the importance of firewalling, identity control, DNS security, and endpoint protection at branch locations.

3. VPNs and Secure Interconnection

A VPN creates a logical private connection across a shared or untrusted network. Tunnelling encapsulates one packet inside another. Encryption provides confidentiality; integrity mechanisms detect alteration; authentication verifies the communicating endpoint; and anti-replay controls reject reused packets.

IPsec is widely used for site-to-site and remote-access VPNs. Its components include security associations, cryptographic algorithms, authentication, key exchange, and tunnel or transport operation. In tunnel mode, the original IP packet is encapsulated and a new outer IP header is added. SSL/TLS-based VPNs are common for browser-oriented or application-oriented remote access. WireGuard is another modern tunnel technology designed for a small configuration and contemporary cryptography.

A VPN is not equivalent to a complete security architecture. A compromised authenticated device can still threaten internal services. Zero-trust approaches therefore evaluate user, device, application, and context rather than trusting a device solely because it is inside a tunnel.

4. Quality of Service and WAN Performance

Important WAN measures include throughput, goodput, latency, jitter, packet loss, availability, and recovery time. Throughput is the rate at which bits are transferred; goodput excludes retransmissions and protocol overhead. Latency includes propagation, transmission, processing, and queuing delay.

where tₜ is transmission time in seconds, S is packet size in bits, and R is link rate in bits per second. This formula assumes a single link and excludes propagation, processing, and queueing delay. For example, a 1,200-byte packet on a 10 Mb/s link has S = 1,200 × 8 = 9,600 bits, so tₜ = 9,600 ÷ 10,000,000 = 0.00096 s, or 0.96 ms.

The bandwidth-delay product estimates the amount of data that can be in transit:

R is the link rate in bits per second and RTT is round-trip time in seconds; BDP is measured in bits. A 100 Mb/s path with a 60 ms RTT has BDP = 100,000,000 × 0.060 = 6,000,000 bits, or 750,000 bytes. TCP windows and buffers must be large enough to use such a path efficiently, but excessive buffering can produce bufferbloat and increase delay.

QoS commonly classifies traffic, marks packets, queues them, and applies scheduling or policing. Voice and interactive video are sensitive to delay and jitter; bulk backup is usually delay-tolerant. QoS cannot create additional capacity. It allocates scarce capacity and protects selected traffic during congestion. Misclassification or excessive priority traffic can harm the whole network.

5. Cellular and Mobile Networking

Cellular networks divide a service area into cells served by radio base stations. Frequency reuse allows many cells to operate with limited spectrum. Mobility management includes device registration, authentication, location tracking, handover, and bearer or session management.

Generation	Main emphasis	Typical networking significance
2G	Digital voice and basic data	Voice, SMS, low-rate telemetry
3G	Mobile packet data	Wider Internet access and multimedia
4G LTE	All-IP broadband	High-speed mobile data and scalable packet core
5G	Enhanced broadband, massive IoT, low-latency applications	Flexible radio, edge computing, and service differentiation

Actual performance depends on spectrum, signal strength, cell loading, device capability, backhaul, subscription policy, and radio conditions. A theoretical peak rate should never be treated as a guaranteed user rate.

5G introduces improved support for network slicing, private cellular networks, and industrial automation. A private 4G or 5G network can provide controlled coverage and identity management on a campus, factory, mine, or port. However, private cellular deployment requires spectrum authorization, radio planning, core-network operation, device compatibility, and skilled support.

Mobile networks are useful as primary connectivity for temporary sites and as backup for fixed WANs. They may have variable public IP addressing, carrier-grade NAT, data quotas, and variable latency. Critical designs should test failover, authentication, antenna placement, and traffic costs rather than assuming that signal bars indicate service quality.

6. Satellite Communication

Satellite networks are valuable where terrestrial fibre, cable, or cellular coverage is unavailable. Geostationary Earth orbit (GEO) satellites provide broad coverage but involve substantial propagation delay. Low Earth orbit (LEO) constellations reduce path distance and can provide lower latency, but require many satellites, electronically or mechanically managed tracking, and complex handover.

Satellite links are affected by rain fade, obstruction, antenna alignment, spectrum regulation, capacity sharing, and terminal power. They support maritime communication, aviation, disaster recovery, rural broadband, environmental monitoring, and emergency response. For interactive applications, latency and weather-related degradation must be included in the service design. Forward error correction and adaptive modulation can improve link robustness, but they trade capacity or complexity for reliability.

7. Cloud Networking

Cloud networking uses virtualized and software-defined resources to connect workloads, users, branches, and external services. A virtual private cloud or virtual network normally contains subnets, route tables, security groups or network security rules, gateways, load balancers, and monitoring services.

A common architecture separates public-facing components from private application and database components. Internet-facing traffic may enter through a web application firewall and load balancer. Application servers communicate with databases through private subnets. Network address translation can provide outbound access without exposing private addresses. Identity and access management controls who may create, modify, or access network resources.

Hybrid cloud networking must account for routing, overlapping address spaces, DNS, encryption, egress cost, resilience, and operational ownership. A cloud region or availability zone is not automatically immune to failure. Applications requiring high availability should use suitable redundancy, health checks, backup, and tested recovery procedures.

Cloud networking also introduces an important shared-responsibility model. The provider usually operates the physical facilities and core platform, while the customer remains responsible for identities, virtual network rules, workload configuration, data protection, and often operating-system security. Exact responsibilities vary by service and contract.

8. IoT Networking Architectures

The Internet of Things connects physical objects that sense, measure, control, identify, or actuate. IoT devices may have restricted memory, processing power, energy, and bandwidth. They often operate unattended and may remain deployed for many years.

This is a conceptual model rather than a mandatory protocol stack. Some devices connect directly to the cloud, while others communicate through a gateway. Edge processing reduces bandwidth and latency and can allow essential control to continue during cloud disconnection.

Common connectivity choices include Wi-Fi, Bluetooth Low Energy, Zigbee, Thread, Ethernet, industrial fieldbus, LoRaWAN, NB-IoT, LTE-M, and 4G/5G. Selection depends on range, throughput, battery life, mobility, topology, spectrum, cost, and regulatory restrictions.

MQTT uses a publish-subscribe model in which clients publish messages to topics through a broker. It is efficient for telemetry and supports quality-of-service levels. CoAP is a lightweight request-response protocol designed for constrained devices and commonly uses UDP with security provided by DTLS. HTTP is widely interoperable but may create greater overhead for very constrained devices. Protocol choice should reflect device capability and application semantics rather than popularity alone.

IoT security must begin with device identity and secure provisioning. Important controls include secure boot, signed firmware, encrypted communication, credential rotation, least privilege, network segmentation, vulnerability management, and secure decommissioning. A device that cannot receive updates can become a long-term vulnerability.

9. Interoperability, Scalability and QoS

Interoperability occurs at several levels. Physical interoperability concerns radios, connectors, and frequencies. Network interoperability concerns addressing, routing, and transport. Syntactic interoperability concerns message formats such as JSON, CBOR, or binary industrial formats. Semantic interoperability concerns whether systems interpret a value in the same way—for example, whether a temperature is expressed in Celsius, Fahrenheit, or Kelvin.

Standards, open APIs, common identity systems, and documented data models reduce vendor dependence. Gateways are valuable for translating legacy protocols, but translation can lose timing, security, or semantic information. A design should therefore document the precise meaning and units of data.

A scalable IoT platform uses automated onboarding, hierarchical naming, rate controls, message retention policies, partitioning, and lifecycle management. A scalable WAN uses summarized routing, resilient controllers, repeatable templates, and centralized observability without creating a single point of failure.

QoS must be defined in application terms. For a control loop, maximum command delay and loss may matter more than average throughput. For video, sustained throughput and jitter may dominate. For environmental telemetry, occasional delay may be acceptable, but data durability and battery life may be essential. A service-level objective should specify measurable targets such as availability, latency percentile, packet-loss rate, recovery time, or message-delivery probability.

10. Applied Case: Connectivity for a Distributed Cold-Chain Company

Background

This illustrative case concerns a food-distribution company with a headquarters, 18 warehouses, refrigerated vehicles, and thousands of temperature sensors. The company uses a cloud-based inventory system and must demonstrate that products remain within permitted temperature ranges.

Problem

Warehouses have different access providers. Some have fibre, others have broadband or cellular service. Vehicles frequently move through regions with inconsistent coverage. The existing system sends all sensor data directly to the cloud, so a temporary outage causes data loss. Managers also report that video meetings are disrupted by large backups.

Analysis

The requirements are not identical. Warehouse applications need reliable cloud access and prioritization of business traffic. Vehicle sensors need low energy consumption, local storage, and delayed delivery when coverage disappears. Refrigeration alarms require rapid local action even if the WAN is unavailable. The organization also needs secure device identity and evidence that records were not altered.

Approach and solution

Each warehouse uses dual access: fibre or business broadband as the primary path and 4G/5G as backup. An SD-WAN edge measures loss, delay, and jitter and selects the appropriate path. Inventory and alarm traffic receive priority over backups and general video traffic. Site-to-site IPsec tunnels connect the warehouses to cloud gateways.

Vehicle sensors use a low-power radio to an onboard gateway. The gateway timestamps readings, stores them locally, encrypts them, and forwards batches through cellular service. A local rule triggers an alarm if temperature exceeds a threshold for a specified interval. The cloud platform receives telemetry through MQTT over a secured connection, while an IoT device-management service controls certificates and firmware updates.

The cloud design separates public ingress, application services, and databases. Monitoring records WAN status, tunnel state, message backlog, device health, and alarm delivery. A second cloud availability zone receives replicated application data. The company tests failover quarterly.

Outcome

The design prevents a temporary cellular or broadband interruption from immediately becoming a data-loss event. Local control protects goods during cloud outages, while SD-WAN protects essential business traffic during congestion. Operational costs are controlled by using high-capacity links where available and cellular only for backup or mobile operation.

Learning points

11. Challenges, Governance and Best Practices

WAN and IoT systems create governance concerns involving personal data, location information, surveillance, retention, and cross-border transfer. Organizations should collect only necessary data, explain its use, restrict access, and retain it for a justified period. Regulatory requirements differ by country and industry; telecommunications licensing, radio spectrum rules, data-protection law, critical-infrastructure regulation, and sector-specific standards may all apply.

Vendor lock-in is a technical and procurement risk. Contracts should define data portability, API access, exit assistance, incident notification, service credits, support boundaries, and secure deletion. SLA figures should be measurable and should identify whether they apply to the access link, provider core, cloud service, or complete application path.

Artificial intelligence can assist with anomaly detection, predictive maintenance, traffic forecasting, and automated path selection. However, AI-based decisions require reliable data, explainable thresholds, protection against poisoned telemetry, and human oversight for safety-critical actions. AI should improve network operations without becoming an uncontrolled single point of failure.

Contemporary Developments

Current networking trends include edge computing, private 5G, multi-access edge computing, network automation, IPv6 adoption, programmable data planes, and convergence between security and networking. Satellite constellations are expanding broadband availability, while Wi-Fi and cellular systems increasingly coexist in enterprise designs. Cloud-native applications also encourage service meshes, API gateways, and application-aware observability.

These developments do not remove foundational principles. Engineers still need correct addressing, routing, authentication, capacity planning, fault isolation, and measurable service objectives. New technology should be adopted because it solves a defined problem, not simply because it is newer.

Chapter Summary

WANs connect geographically separated networks through dedicated circuits, packet-switched provider services, broadband, cellular, satellite, or Internet-based overlays. Leased lines provide predictable dedicated capacity, whereas packet services share infrastructure and may require QoS management. MPLS can provide managed traffic classes but is not inherently encryption. Broadband is flexible and economical, while SD-WAN can combine multiple underlays and steer traffic according to policy and measured conditions.

VPNs provide logical private connectivity through shared networks, but secure deployment also requires authentication, access control, lifecycle management, monitoring, and endpoint security. Cellular networks support mobility and temporary or backup connectivity; satellite systems extend coverage where terrestrial infrastructure is unavailable but may introduce latency, weather sensitivity, or capacity constraints.

Cloud networking uses virtual networks, subnets, routing, gateways, security controls, load balancers, and identity systems to connect distributed workloads. Hybrid designs must address routing, DNS, encryption, availability, cost, and shared responsibility. IoT architectures combine constrained devices, connectivity, gateways, edge processing, cloud platforms, and applications. Secure provisioning, updates, segmentation, and lifecycle management are essential.

Interoperability requires compatible physical systems, protocols, formats, and meanings. Scalability concerns endpoints, traffic, geography, and operations. QoS should be defined in application terms and supported by measurement, classification, scheduling, redundancy, and testing. Effective professional designs integrate these technologies according to business requirements, failure conditions, regulatory obligations, and total lifecycle cost.

Key Terms

MPLS: A provider technology that forwards packets using labels and supports engineered services.

Broadband: High-speed access delivered through technologies such as fibre, cable, DSL, or fixed wireless.

SD-WAN: Policy-controlled WAN overlay technology that can use multiple underlay links.

VPN: A logical private connection established across a shared or untrusted network.

IPsec: A suite of protocols that provides authenticated and protected IP communication.

QoS: Techniques for classifying, prioritizing, scheduling, and controlling network traffic.

Satellite link: A communication path using an orbiting satellite as part of the transmission system.

Cloud networking: Virtualized networking services used to connect cloud workloads and users.

Edge computing: Processing data near its source instead of sending all data to a central cloud.

Interoperability: The ability of independent systems to exchange and correctly use information.

Scalability: The ability to support increasing workload, devices, locations, or traffic.

Service-level agreement: A formal commitment defining service performance and responsibilities.

Review Questions

Short Answer Questions

Long Answer Questions

Analytical / Application Questions

Multiple Choice Questions with Answers

Question 1

Question 2

B. To select an appropriate underlay according to policy and measured conditions

Correct Answer: B. To select an appropriate underlay according to policy and measured conditions

Question 3

A 1,200-byte packet is transmitted on a 10 Mb/s link. What is its transmission time, ignoring other delays?

Question 4

Correct Answer: C. It can support provider-managed traffic classes and VPN services

Question 5

Correct Answer: A. Very broad coverage with potentially substantial propagation delay

Question 6

In an MQTT system, what component normally receives publications and distributes them to subscribers?

Question 7

Which IoT function is especially useful when cloud connectivity is temporarily unavailable?

Question 8

Question 9

Question 10

Correct Answer: C. Using unique identities, signed updates, and secure decommissioning

Chapter 11 WAN, Mobile, Cloud and IoT Networking

WAN, Mobile, Cloud and IoT Networking

Introduction