4.1WAN and wide-area connectivity

For a network designer at a multi-site company, choosing a site-to-site connectivity method is a three-way tradeoff among cost, quality (bandwidth guarantee and latency stability), and security. Options range from a leased line—high quality and high security but expensive—to an Internet VPN, which is cheap but offers weak quality guarantees. The optimal choice shifts with requirements. This section builds the judgment needed to decide which WAN service to choose given concrete constraints such as site count, required quality, and budget.

4.1.1Leased lines and wide-area Ethernet

• A leased line is a circuit dedicated to a single subscriber on the carrier's facilities. Because it is not shared with other customers' traffic, bandwidth and latency are fully guaranteed and confidentiality is highest, but its chief drawback is that cost rises with distance (a full-mesh topology across many sites becomes prohibitively expensive).
• Wide-area Ethernet transparently carries Ethernet frames across the carrier's network, connecting sites at Layer 2. Even with many sites, hub-and-spoke or full-mesh topologies can be configured flexibly, and cost does not scale as sharply with distance as a leased line does. Because it is an L2 connection, it also offers leased-line-like freedom to design the IP addressing scheme across sites.

4.1.2MPLS (label switching) and IP-VPN

• MPLS (Multi-Protocol Label Switching) attaches a short label to a packet instead of relying on the IP address, and each LSR (label-switching router) along the path forwards based solely on the label, which is faster than repeatedly looking up the destination IP address in ordinary IP routing. It also allows flexible control of paths, bandwidth, and priority per FEC (forwarding equivalence class).
• IP-VPN is a service in which the carrier builds a per-subscriber virtual closed network (a VRF, or virtual routing and forwarding table) inside its MPLS network and connects sites at Layer 3 (IP). Because it traverses the carrier's network but never the public Internet, it is easier to guarantee bandwidth and apply QoS than wide-area Ethernet, making it a representative choice that balances cost and quality well for large, multi-site deployments.

4.1.3Internet VPN versus closed-network selection

• An Internet VPN builds a tunnel—typically with IPsec—over the public Internet and uses encryption to make it behave like a virtual leased line. It has the lowest circuit cost and makes adding or changing sites easy, but because it is subject to Internet congestion, its bandwidth/latency guarantee (SLA) is weak. The data itself is encrypted, so confidentiality is assured, but availability and quality lag behind IP-VPN.
• A closed network (a general term for wide-area Ethernet, IP-VPN, and similar services) stays entirely within the carrier's network and never traverses the public Internet. Being less exposed to attacks from unspecified parties and offering more stable quality, it suits mission-critical traffic such as settlement or control systems. In recent years, designs that route between a closed network and an Internet VPN using SD-WAN (detailed in Section 3) have become increasingly common.

Suppose a retail chain with 1 head office, 5 flagship stores, and 120 general stores is designing a network to aggregate POS data and payment traffic at the head office. Laying a leased line to all 120 stores is rejected first, since the cumulative distance-based pricing across 120 sites makes the cost unrealistic. Next, for the 5 flagship stores, where payment traffic requires high availability and confidentiality (e.g., under PCI DSS-type requirements), the design adopts IP-VPN, which is easier to bandwidth-guarantee and stays within a closed network, balancing cost and quality. For the 120 general stores, which only carry traffic such as a daily POS batch upload, the design adopts a low-cost Internet VPN (an IPsec tunnel) that makes adding or relocating stores easy, keeping both initial investment and operating cost down. The pitfall to avoid here is the misconception that "an Internet VPN is encrypted, so it is just as safe as a closed network"—encryption secures confidentiality, but because the traffic still traverses the public Internet, its availability/quality SLA remains weaker than a closed network's. Routing payment traffic with strict availability requirements onto an Internet VPN merely because it is convenient is therefore an inappropriate design decision; matching closed-network versus Internet-VPN choice to the actual requirements (not just confidentiality, but also availability and quality) is the key to balancing cost and quality.

4.1.4Section summary

• A leased line offers the highest quality but is costly due to distance-based pricing; wide-area Ethernet is an L2 closed network that scales well with site count
• MPLS forwards quickly via label switching; IP-VPN is an L3 closed network built on MPLS + VRF that is easy to bandwidth-guarantee
• An Internet VPN is low-cost but has a weak SLA since it traverses the public Internet—choose between it and a closed network based on requirements