WAN, VPN and Cloud Connectivity

Introduction and Context

A wide area network (WAN) connects offices, users, data centres, suppliers and cloud services across geographic distances. Unlike a local area network (LAN), a WAN commonly depends on telecommunications carriers, Internet service providers (ISPs), mobile operators or cloud-network providers. WAN design therefore involves more than selecting routers: it requires decisions about service availability, performance, security, cost, resilience, governance and operational responsibility.

Modern organisations rarely use one WAN technology exclusively. A branch may use a primary leased line, a broadband connection for Internet access, 4G/5G as backup and an encrypted tunnel to a cloud provider. Software-defined WAN (SD-WAN) may then select among these paths according to application requirements and measured link quality.

Learning Objectives

By the end of this chapter, you should be able to:

• compare leased lines, broadband, cellular, MPLS and SD-WAN;
• explain PPP, tunnelling and the purposes of VPN technologies;
• distinguish IPsec VPNs from SSL/TLS-based remote-access VPNs;
• evaluate connectivity for branches, remote users, data centres and cloud environments;
• identify design, security, governance and operational trade-offs.

1. WAN Foundations

A WAN provides connectivity between networks that are separated by distance and usually administered by different organisations. A customer premises router connects to an access circuit, a provider network transports traffic, and a remote router, firewall or cloud gateway terminates the connection.

Important performance measures include:

• Bandwidth: the nominal capacity of a link, commonly measured in bit/s.
• Throughput: the useful rate actually achieved by applications.
• Latency: the time required for a packet to travel between endpoints.
• Jitter: variation in packet delay, significant for voice and interactive video.
• Packet loss: packets discarded or corrupted in transit.
• Availability: the proportion of time that a service is operational.
• Symmetry: whether upload and download capacities are equal.
• Service-level agreement (SLA): contractual commitments concerning performance, repair and availability.

A useful approximation for the bandwidth-delay product is:

Here, BDP is the amount of data that may be in transit, in bits; C is link capacity in bit/s; and RTT is round-trip time in seconds. The approximation assumes a continuously transmitting flow and is useful when considering TCP window sizes and long-distance links. For example, a 100 Mbit/s path with a 40 ms round-trip time has BDP = 100,000,000 × 0.040 = 4,000,000 bits, or 0.5 MB. This is not a prediction of application throughput because congestion, protocol overhead, loss and endpoint limits also matter.

2. Comparing WAN Access Technologies

2.1 Leased Lines

A leased line is a dedicated telecommunications circuit supplied to one customer, often with symmetrical capacity and a defined SLA. Ethernet private circuits and dedicated Internet access are common examples. The carrier manages the access network, while the customer normally manages its router, firewall and internal routing.

Advantages include predictable performance, business-grade repair commitments, static addressing options and reduced contention. Disadvantages include higher recurring cost, installation lead time and dependence on physical infrastructure. A leased line is appropriate for a headquarters, data centre interconnection or a branch carrying critical real-time traffic.

2.2 Broadband

Broadband includes fibre, cable and digital subscriber access. It is widely available and inexpensive, but capacity may be shared and upload performance may be asymmetric. Consumer-grade services may have dynamic addresses, restrictive terms and weaker fault-management commitments.

Business broadband can be suitable as a primary link for small offices or as a secondary path. Encryption should be used when traffic crosses the public Internet. Organisations should verify the provider's contention policy, service restoration target, public addressing and support model rather than judging a service only by its advertised speed.

2.3 Cellular WAN

4G and 5G networks provide rapid deployment and geographic flexibility. A cellular router can use a SIM or embedded subscriber identity and can fail over when a fixed circuit fails. Cellular performance varies with radio coverage, congestion, signal quality, subscription limits and antenna placement.

Cellular is valuable for temporary sites, vehicles, rural branches, emergency connectivity and backup. It may be unsuitable as the sole link for high-volume or latency-sensitive workloads. Private cellular networks can offer greater control, but require spectrum, infrastructure and specialist management.

2.4 MPLS

Multiprotocol Label Switching (MPLS) is a provider technology that forwards packets using labels and established paths. Customers commonly receive Layer 3 VPN services in which the provider separates customer routing tables. MPLS can offer predictable classes of service, any-to-any connectivity and managed support without exposing internal traffic directly to the public Internet.

MPLS does not automatically encrypt data. Confidential traffic may still require IPsec encryption, particularly across provider or regulatory boundaries. MPLS is also less flexible than Internet-based designs when sites are distributed globally or connected directly to cloud services. Its principal limitations are cost, contract dependence and slower service change compared with Internet access.

2.5 SD-WAN

SD-WAN is an architecture in which centralised policy and edge devices use multiple underlay networks—such as broadband, leased lines and cellular—to create an application-aware overlay. An SD-WAN controller distributes policy, while edge devices measure loss, delay and jitter and select a path.

SD-WAN does not replace physical connectivity. It coordinates connectivity and commonly provides encryption, segmentation, central management, dynamic failover and direct Internet or cloud breakout. Its benefits depend on sound underlay links, secure controller design, compatible equipment and skilled operations. Vendor implementations differ, so claims about features should be tested against documented requirements.

3. Point-to-Point Protocol and Link Encapsulation

Point-to-Point Protocol (PPP) was designed to transport network-layer protocols across point-to-point links. It provides framing, link establishment and optional authentication. Its major components include:

1. PPP framing: identifies and carries a payload over a serial or logical point-to-point link.
2. LCP (Link Control Protocol): negotiates link parameters and detects some link failures.
3. NCPs (Network Control Protocols): configure network-layer protocols, such as IP.
4. Authentication: commonly Password Authentication Protocol (PAP) or Challenge Handshake Authentication Protocol (CHAP).

PAP sends credentials in a comparatively weak form and should not be preferred where stronger alternatives exist. CHAP uses challenge-response exchanges and avoids sending the password directly, although its security depends on the cryptographic design and deployment context. PPP itself is not a complete modern security architecture; encryption, strong authentication and secure management must be considered separately.

PPP over Ethernet (PPPoE) remains common in some broadband access networks. In enterprise WANs, Ethernet, IP and carrier-specific technologies have reduced the visibility of PPP, but its concepts remain important for understanding authentication and point-to-point service establishment.

4. Tunnelling and VPN Concepts

A tunnel carries one protocol or logical network through another network. A tunnel has an ingress endpoint, an encapsulated packet and an egress endpoint. The outer header enables delivery across the transit network; the inner packet preserves the logical communication between tunnel endpoints.

Tunnelling alone does not imply confidentiality. For example, an unencrypted GRE tunnel can carry routing protocols and multicast but may expose payloads. A secure design may combine GRE with IPsec, although this adds overhead and operational complexity. Tunnelling may also reduce effective maximum transmission unit (MTU), because additional headers consume space and can cause fragmentation or packet loss if path MTU discovery is ineffective.

A VPN creates a controlled logical network over a shared or untrusted infrastructure. It normally addresses three security goals:

• Confidentiality: unauthorised parties cannot understand protected data.
• Integrity: alteration in transit can be detected.
• Authentication: endpoints or users can verify one another.

A VPN does not automatically guarantee endpoint security, authorisation, availability or lawful processing. A compromised endpoint can send legitimate-looking traffic through a perfectly encrypted tunnel.

5. IPsec VPNs

IPsec operates at the network layer and protects IP traffic. It is widely used for site-to-site connections between branch firewalls, routers, data centres and cloud gateways.

Important IPsec concepts include:

• Security Association (SA): a negotiated set of algorithms, keys, lifetimes and parameters.
• IKE (Internet Key Exchange): authenticates peers and negotiates SAs and keys.
• ESP (Encapsulating Security Payload): provides confidentiality, integrity and authentication when configured appropriately.
• Tunnel mode: protects the original IP packet and adds a new outer IP header; common for gateway-to-gateway VPNs.
• Transport mode: protects the payload of an existing IP packet; used in more specialised host-to-host arrangements.

Modern deployments should use strong, supported algorithms, secure key exchange, certificate-based authentication where manageable, and carefully controlled security policies. Pre-shared keys should be long, unique and protected. Deprecated algorithms and weak hashes should be disabled according to current organisational standards and vendor guidance.

IPsec is transparent to many applications because it protects IP packets below the application layer. However, incompatible proposals, NAT traversal, route overlap, asymmetric routing, MTU problems and unclear ownership can cause failures. Monitoring must include tunnel state, negotiation errors, traffic selectors, packet loss and encryption-domain changes.

6. SSL/TLS-Based Remote-Access VPNs

Remote-access VPN products commonly use TLS, the security protocol used by HTTPS, to create an authenticated connection between a user device and a VPN gateway. Some operate through a browser portal; others install an agent that provides full or selective network access.

TLS VPNs are useful where users connect from varied networks, including hotels, home broadband and mobile networks. They can provide application-level access, clientless portals, posture checks and integration with identity providers and multi-factor authentication. Their limitations include dependence on endpoint software or browser features, gateway capacity, policy complexity and the risk of granting broad network access to unmanaged devices.

IPsec and TLS VPNs are not mutually exclusive choices. IPsec is often preferred for stable site-to-site tunnels, while TLS-based access is common for individual users and application portals. The correct choice depends on identity, device management, required applications, traffic volume, network restrictions and operational capability.

7. Connectivity Patterns

Branch Connectivity

A branch design begins with business requirements: applications, user population, voice needs, recovery objectives, compliance and acceptable outage duration. A typical resilient design uses two diverse access services, separate provider paths where feasible, automatic failover and central monitoring. Critical traffic may receive priority, but QoS cannot create bandwidth that the access link does not possess.

Segmentation should separate corporate users, voice, guest access, payment systems, operational technology and management traffic. Internet breakout may reduce latency to cloud applications, but firewalls, DNS security, web controls, logging and identity policy must remain effective.

Remote Users

Remote access should follow least privilege. Instead of placing every user on the entire corporate network, organisations can publish only required applications, use device certificates and multi-factor authentication, assess endpoint posture and log access decisions. Split tunnelling may improve performance by sending ordinary Internet traffic directly to the Internet, but it can reduce central inspection and complicate incident investigation. Full tunnelling improves central control but increases gateway load and may degrade user experience.

Data-Centre Interconnection

Data centres may connect through private circuits, carrier Ethernet, MPLS, IPsec overlays or provider interconnects. Designers should consider latency, replication bandwidth, failure domains, routing convergence, encryption requirements and whether workloads are active-active or active-standby. A second circuit that shares the same duct, exchange or provider may not provide genuine resilience.

Cloud Connectivity

Cloud connectivity generally falls into four patterns:

1. Public Internet with encrypted VPN: rapid and economical, but performance follows Internet conditions.
2. Dedicated cloud interconnect: private carrier or exchange connectivity with more predictable performance and often higher capacity.
3. Provider-managed WAN integration: cloud gateways participate in an enterprise WAN, commonly through MPLS or SD-WAN.
4. Cloud-native transit architecture: a central transit hub, virtual WAN or transit gateway connects virtual networks and on-premises sites.

Cloud connection design must include routing advertisements, overlapping address spaces, egress control, identity integration, logging, key management and regional resilience. A private interconnect is not automatically encrypted; sensitive traffic may require encryption over the private path as well.

8. Worked Design Example

An organisation has 20 branches. Each branch requires voice, an enterprise resource planning application and Internet access. The headquarters currently uses one expensive leased line per branch. Management requires lower cost and continuity during a circuit failure.

A practical design is a hybrid SD-WAN architecture. Each branch receives business broadband as the primary underlay, a leased line where voice and transaction requirements justify it, and 5G backup where radio coverage is adequate. SD-WAN edges establish encrypted overlays to regional hubs and cloud gateways. Voice traffic is assigned an application policy, but admission control and capacity planning remain necessary.

Suppose the branch requires 80 Mbit/s peak aggregate traffic and the design target is 30% spare capacity. The planning capacity is:

where C_peak is expected peak traffic, s is the spare-capacity fraction, and C_required is the minimum planned capacity. Thus, C_required = 80 × 1.30 = 104 Mbit/s. This is a planning estimate, not a guarantee: encryption overhead, burst behaviour, future growth, provider contention and application inefficiency must also be assessed.

The organisation should pilot representative branches, test failover during active calls, confirm cloud route behaviour, measure jitter and packet loss, and verify that security policies remain enforced during local Internet breakout. It should also document who owns the access circuit, SD-WAN overlay, firewall, identity service and cloud gateway.

9. Illustrative Case Study: Regional Retailer

Background. A fictional retailer has 60 stores, a central data centre and workloads in two public-cloud regions. Stores use point-of-sale systems, voice, inventory services and guest Wi-Fi.

Problem. The existing MPLS network is reliable but costly. Cloud applications experience avoidable backhaul delay, and several stores have only one physical access route.

Analysis. Business-critical point-of-sale traffic requires confidentiality, stable reachability and rapid recovery. Guest traffic must not reach payment systems. Cloud traffic should avoid unnecessary traversal of the data centre. The retailer also discovers that two supposedly diverse circuits share the same local duct.

Approach. The retailer deploys SD-WAN-capable firewalls with fibre broadband and retained MPLS at larger stores. Smaller stores use broadband plus 5G. Encrypted overlays connect stores to regional security hubs and cloud transit gateways. Payment, corporate, voice and guest segments are separated. Multi-factor authentication is required for administrators and remote support. Cloud and WAN logs are sent to a security monitoring platform.

Outcome. The design reduces dependence on MPLS, improves cloud path selection and provides tested failover. It does not eliminate outages: a regional provider failure and incorrect policy deployment remain possible risks. The retailer therefore introduces configuration approval, staged changes, quarterly failover tests and supplier-diversity reviews.

Learning points. Cost reduction is not the same as resilience. SD-WAN improves control of multiple paths but requires governance. Encryption must be assessed independently from private routing. Physical diversity, identity security and operational testing are as important as bandwidth.

10. Security, Governance and Operational Practice

Effective WAN security combines architecture, technology and process. Recommended practices include:

• use strong authentication and multi-factor authentication for administrative and remote access;
• separate management, user, guest and sensitive workloads;
• use least-privilege VPN policies and short, documented access paths;
• protect keys, certificates and device backups;
• maintain accurate inventories, diagrams and ownership records;
• monitor tunnel status, routing changes, authentication events, flow records and provider performance;
• patch edge devices and disable unused services;
• test backup circuits, configuration restoration and incident procedures;
• review supplier SLAs, data location, lawful interception obligations and breach notification terms.

Privacy and regulatory requirements may restrict where traffic is processed or logged. Monitoring should collect enough information for security and service assurance without retaining unnecessary personal data. Administrators must understand that encryption can affect lawful inspection, malware detection and evidence collection; these concerns should be addressed through documented, proportionate controls rather than by routinely weakening encryption.

Artificial intelligence can assist with anomaly detection, capacity forecasting and incident triage. However, automated recommendations may reflect incomplete telemetry or learn normal but insecure behaviour. AI systems should therefore operate with human approval for high-impact changes, protected training data, audit logs and clear rollback procedures.

11. Contemporary Developments and Limitations

Current WAN practice increasingly combines Internet underlays, cloud-native networking, zero-trust access, secure access service edge (SASE) functions and automated policy. Zero trust shifts the question from “Is the user inside the network?” to “Is this authenticated user, on this device, authorised for this resource under current conditions?” SASE combines networking and security functions delivered partly from distributed cloud points of presence.

These approaches are not universal replacements. They may introduce dependence on a provider's control plane, subscription costs, complex policy interactions and data-processing concerns. Legacy applications may require broad network reachability, while modern application access can often be narrower. Good design therefore starts with requirements and risk, not with a fashionable product category.

Chapter Summary

WANs connect geographically separated networks through carrier, Internet, wireless and cloud infrastructure. Leased lines provide predictable dedicated service; broadband offers economical access; cellular provides mobility and backup; MPLS supplies managed private routing; and SD-WAN coordinates several underlays through policy-driven overlays. PPP explains point-to-point framing, negotiation and authentication, while tunnelling carries logical traffic through another network without necessarily encrypting it.

IPsec is commonly used for secure site-to-site connectivity, whereas TLS-based VPNs are frequently used for remote users and application portals. Branch, remote-user, data-centre and cloud designs differ in performance, routing, security and operational requirements. Resilience requires genuine path diversity, tested failover and clear ownership. Private connectivity is not automatically encrypted, and encryption alone does not provide endpoint security or authorisation. Sound WAN engineering combines technical controls with monitoring, governance, regulatory awareness and disciplined change management.

Key Terms

WAN: A network connecting geographically separated networks.

Leased line: A dedicated telecommunications circuit supplied to one customer.

Broadband: High-speed access service that may use shared provider infrastructure.

Cellular WAN: WAN access using a mobile radio network such as 4G or 5G.

MPLS: Provider technology that forwards traffic using labels and supports managed VPN services.

SD-WAN: Policy-controlled architecture that manages multiple WAN underlays through an overlay.

PPP: Point-to-Point Protocol for framing, negotiation and transport across point-to-point links.

LCP: PPP protocol that negotiates and controls the link.

NCP: PPP protocol that configures a network-layer protocol.

Tunnel: A logical path carrying encapsulated traffic through another network.

VPN: A controlled logical network over shared or untrusted infrastructure.

IPsec: Network-layer security framework for authenticating and protecting IP traffic.

IKE: Protocol used to authenticate IPsec peers and negotiate keys and security associations.

ESP: IPsec protocol that can provide confidentiality and integrity.

TLS VPN: VPN access using Transport Layer Security, commonly for remote users.

Overlay: A logical network built over one or more physical underlay networks.

Underlay: The physical or provider network carrying an overlay.

SLA: Contractual commitment concerning service performance and restoration.

Zero trust: Security model requiring explicit, continuously evaluated authorisation.

Cloud interconnect: Connectivity between an organisation and a cloud provider through public, private or managed paths.

Review Questions

Short Answer Questions

1. What is the principal difference between bandwidth and throughput?
2. Why does MPLS not automatically provide confidentiality?
3. What are the roles of LCP and NCP in PPP?
4. Distinguish tunnel mode from transport mode in IPsec.
5. State two reasons why cellular connectivity is useful as a WAN backup.

Long Answer Questions

1. Compare leased lines, broadband, cellular, MPLS and SD-WAN for a distributed organisation.
2. Explain how a site-to-site IPsec VPN is established and operated.
3. Discuss the security and usability trade-offs between full and split tunnelling for remote users.
4. Describe the principal design issues in connecting an enterprise data centre to public-cloud regions.
5. Explain why resilience requires physical and provider diversity rather than merely two logical circuits.

Analytical / Application Questions

1. A branch has 60 Mbit/s peak traffic and requires 25% spare capacity. Calculate its planning capacity using C_required = C_peak × (1 + s), and identify two factors that could make the result insufficient.
2. Design a primary, backup and security architecture for a rural branch with unreliable fixed broadband and voice requirements. Justify each technology choice.
3. An enterprise wants to replace MPLS entirely with broadband Internet. Evaluate the proposal, including routing, encryption, cloud access, monitoring, supplier diversity and operational risk.

Multiple Choice Questions with Answers

Question 1

Which WAN technology normally provides a dedicated circuit with predictable performance and an SLA?

A. Leased line

B. Consumer broadband

C. Unmanaged Wi-Fi

D. Public DNS

Correct Answer: A. Leased line

Question 2

Which statement about MPLS is correct?

A. It always encrypts customer payloads

B. It uses labels and can provide managed private routing

C. It operates only over cellular networks

D. It is a remote-user browser protocol

Correct Answer: B. It uses labels and can provide managed private routing

Question 3

What is the main purpose of PPP's LCP?

A. To negotiate and control the point-to-point link

B. To encrypt every application message

C. To resolve domain names

D. To allocate cloud billing accounts

Correct Answer: A. To negotiate and control the point-to-point link

Question 4

Which IPsec mode is commonly used for gateway-to-gateway VPNs?

A. Broadcast mode

B. Tunnel mode

C. Application mode

D. Sessionless mode

Correct Answer: B. Tunnel mode

Question 5

What does tunnelling alone guarantee?

A. Confidentiality

B. Authentication

C. Encapsulation through another network

D. Protection from malware

Correct Answer: C. Encapsulation through another network

Question 6

Which technology is commonly suited to individual remote users connecting through varied networks?

A. TLS-based VPN

B. Unencrypted GRE only

C. Passive Ethernet hub

D. MPLS label switch alone

Correct Answer: A. TLS-based VPN

Question 7

A link has a peak requirement of 80 Mbit/s and 30% spare capacity. What planning capacity is indicated?

A. 56 Mbit/s

B. 80 Mbit/s

C. 104 Mbit/s

D. 130 Mbit/s

Correct Answer: C. 104 Mbit/s

Question 8

What is a principal function of SD-WAN?

A. Replacing all physical access circuits

B. Selecting and managing multiple WAN paths using policy

C. Eliminating the need for authentication

D. Converting IPv4 into electrical signals

Correct Answer: B. Selecting and managing multiple WAN paths using policy

Question 9

Why might an organisation use 5G at a branch?

A. It guarantees unlimited capacity

B. It provides a potentially rapid backup or temporary connection

C. It removes the need for routing

D. It automatically encrypts all MPLS traffic

Correct Answer: B. It provides a potentially rapid backup or temporary connection

Question 10

Which statement best reflects zero-trust access?

A. Anyone inside the office is trusted automatically

B. Access is explicitly authorised based on identity, device and context

C. Encryption is unnecessary after login

D. Users may access every internal subnet

Correct Answer: B. Access is explicitly authorised based on identity, device and context