WAN Technologies Explained

WAN vs LAN — The Basics

A LAN (Local Area Network) connects devices within a single building or campus — you own and control all the infrastructure. A WAN (Wide Area Network) connects sites across cities, countries, or continents — you typically lease connectivity from a carrier rather than building it yourself.

The key WAN challenge is balancing cost, performance, and reliability. Dedicated private circuits deliver predictable performance but cost significantly more than shared internet. Modern enterprises use a mix of technologies — private MPLS for critical traffic and cheaper internet connections for general traffic, managed intelligently by SD-WAN.

MPLS — Multiprotocol Label Switching

MPLS is a carrier-provided WAN technology that routes traffic based on short fixed-length labels rather than performing complex IP address lookups at every hop. When traffic enters the MPLS network at an edge router (PE router — Provider Edge), the carrier assigns a label. Core routers (P routers — Provider core) forward packets purely by swapping labels, making forwarding extremely fast. When traffic exits the MPLS network, the label is removed and normal IP routing resumes.

MPLS supports traffic engineering — the ability to pre-determine the exact path packets take through the carrier's network, ensuring latency-sensitive traffic (voice, video conferencing) always takes the lowest-latency path. MPLS also supports multiple VPNs over the same infrastructure through MPLS VPNs (Layer 3 VPN), where each customer's traffic is completely isolated from other customers despite sharing the carrier's physical infrastructure.

SD-WAN — Software-Defined Wide Area Network

SD-WAN applies software-defined networking (SDN) principles to WAN connectivity. Instead of being locked into a single expensive MPLS circuit, SD-WAN creates an overlay network on top of any combination of underlying transport links — MPLS, broadband internet, LTE/5G, or satellite — and manages them through a centralised software controller.

SD-WAN constantly monitors the performance of every available link (latency, jitter, packet loss) and automatically routes each application's traffic over the best-performing path in real time. Latency-sensitive applications (VoIP, video conferencing) are sent over the lowest-latency link; bulk transfers (backups, software updates) can use cheaper broadband links. If a link degrades or fails, traffic is instantly rerouted to an alternate path — often without users noticing.

The result is a dramatic reduction in WAN costs (replacing expensive dedicated MPLS with commodity internet) while maintaining or improving performance for cloud-based applications. SD-WAN also provides centralised visibility and management — a single dashboard shows traffic flows, application performance, and security posture across all branch sites simultaneously.

Leased Lines

A leased line (also called a dedicated line or private circuit) is a dedicated, symmetric, point-to-point connection between two fixed locations, provided and maintained by a carrier. Unlike broadband, bandwidth is not shared with other customers — the full contracted capacity is available 24/7 with guaranteed uptime SLAs.

Common leased line standards include T1 (1.544 Mbps, North America) and E1 (2.048 Mbps, Europe), with higher-bandwidth options scaling through T3 (44.7 Mbps) and fiber-based services. Modern leased lines are typically delivered as Ethernet circuits (EoF — Ethernet over Fiber) at speeds from 10 Mbps to 10 Gbps.

Use cases: connecting headquarters to a data centre with guaranteed bandwidth, internet exchange connections for ISPs, point-to-point links between two buildings in the same city. Leased lines are significantly more expensive than broadband but provide the guaranteed performance and SLA that critical links require.

Other WAN Technologies

WAN Connectivity Concepts

Exam Scenarios

WAN Failover and Redundancy

Relying on a single WAN connection for business-critical connectivity is a significant availability risk. WAN outages — whether from carrier infrastructure failures, cable cuts, or equipment failure — are common enough that enterprise network design always accounts for redundancy. Understanding WAN failover concepts is directly relevant for Network+ exam scenarios.

Dual ISP connections (multihoming) is the standard approach for WAN redundancy. A company connects to two different ISPs, ideally using different physical paths and infrastructure. If one ISP fails, traffic automatically routes through the second. This is more effective than having two circuits from the same ISP, which may share physical infrastructure in the carrier's network. SD-WAN simplifies dual ISP management by monitoring both connections in real time and automatically routing traffic based on performance.

4G/LTE and 5G cellular failover provides a cost-effective backup for broadband internet connections. A cellular failover device (router with SIM card) acts as an automatic backup — when the primary connection fails, it switches to cellular. This is widely used in retail and branch office environments where even brief outages cost significant revenue. The limitation is that cellular bandwidth is typically lower and latency higher than fiber broadband, making it suitable for failover but not as a primary WAN for bandwidth-intensive applications.

For exam scenarios: if the question describes a company that needs WAN connectivity to remain operational even if their primary ISP fails, the answer involves dual ISP connectivity or WAN failover. If the question asks which technology provides real-time monitoring of multiple WAN links and automatic failover with intelligent path selection, the answer is SD-WAN.

WAN Routing and BGP

When packets travel across the internet or between large enterprise networks and service providers, BGP (Border Gateway Protocol) is the routing protocol that makes it possible. BGP is the protocol that runs between autonomous systems (AS) — large independently managed networks such as ISPs, enterprises, and cloud providers. Understanding BGP is important for Network+ because it explains how routing decisions are made at the internet scale.

Unlike interior routing protocols such as OSPF or EIGRP that optimize purely for shortest path, BGP uses path attributes to make routing decisions. Key attributes include AS-PATH (the list of autonomous systems a route passes through), LOCAL_PREF (preference used within an AS to select outbound paths), and MED (Multi-Exit Discriminator, used to influence how traffic enters your AS from a neighbour). BGP is a policy-driven protocol — network engineers can configure it to prefer certain routes for business reasons, not just technical ones.

For WAN exam scenarios, remember that BGP is the protocol used for internet edge routing and is often how enterprises connect to multiple ISPs (multihoming) for redundancy. If one ISP fails, BGP will failover traffic to the second ISP automatically.

Site-to-Site VPN as a WAN Alternative

Many organizations — especially smaller ones — avoid the cost of dedicated MPLS circuits by building site-to-site VPN tunnels across the public internet. A site-to-site VPN connects two entire networks (rather than a single remote user) by creating an encrypted tunnel between two VPN gateways, typically firewalls or dedicated VPN concentrators at each site.

The most common protocol for site-to-site VPN today is IPsec (Internet Protocol Security), which operates at Layer 3 and can run in two modes. Tunnel mode encapsulates the entire original IP packet inside a new IP packet — this is the standard mode for site-to-site VPNs because it hides the internal addressing. Transport mode only encrypts the payload, leaving the original IP header intact — used for host-to-host encryption within a single site.

IPsec itself is not one protocol but a suite of protocols. The two main components are AH (Authentication Header), which provides integrity and authentication but no encryption, and ESP (Encapsulating Security Payload), which provides both encryption and authentication. In practice, ESP is almost always used because encryption is the primary goal. IPsec uses IKE (Internet Key Exchange) — either IKEv1 or the more modern IKEv2 — to negotiate security parameters and exchange encryption keys before the tunnel is established.

WAN Optimization

Even with high-bandwidth WAN links, application performance can suffer due to latency, packet loss, and protocol inefficiency. WAN optimization technologies address these issues through several techniques that are worth understanding for the exam.

Compression reduces the amount of data that needs to traverse the WAN link by compressing repetitive data patterns. Deduplication (also called data reduction or caching) goes further — if the same data block has already been transmitted, only a hash reference is sent instead of retransmitting the full data. This can dramatically reduce WAN utilization for workloads involving large file transfers or backup replication.

TCP optimization addresses the problem that TCP's congestion control algorithms were designed for low-latency LAN environments. On high-latency WAN links, TCP window sizes become a bottleneck — the protocol has to wait for ACKs before sending more data. WAN optimizers use TCP spoofing (also called TCP proxying) to locally acknowledge data on behalf of the distant endpoint, allowing the sender to continue transmitting without waiting for round-trip delays.

Protocol optimization handles chatty protocols that generate many round trips. CIFS/SMB (Windows file sharing) is notorious for this — accessing a single file can generate dozens of round trips, which is tolerable on a LAN with sub-millisecond latency but causes terrible performance over a 50ms WAN link. WAN optimization appliances cache and pre-fetch data to reduce these round trips.

WAN SLAs and Performance Metrics

When purchasing WAN services from a carrier, the Service Level Agreement (SLA) defines the performance guarantees and remedies if the carrier fails to meet them. Understanding WAN SLA metrics is directly exam-relevant for Network+.

For exam scenarios involving WAN service selection, if the question mentions guaranteed performance, SLA, or contractual uptime, the answer typically involves a dedicated leased line or MPLS circuit rather than shared broadband. If the question mentions cost reduction while maintaining performance and the company already has MPLS, the answer is SD-WAN.

Common WAN Troubleshooting Scenarios

The Network+ exam tests practical troubleshooting as well as conceptual knowledge. For WAN links, common issues and their causes include the following. Intermittent connectivity drops on a broadband WAN link often indicate line quality issues — for DSL, the line may be too long or have bridge taps causing attenuation; for cable, the coaxial infrastructure may have signal noise. Tools such as checking SNR (Signal-to-Noise Ratio) margins on a DSL modem or signal levels on a cable modem help diagnose this.

High latency or jitter on an MPLS circuit that previously performed well may indicate that the carrier is experiencing congestion in their core network, or that traffic classes are misconfigured — bulk traffic may be using the same MPLS class of service queue as latency-sensitive voice traffic. Work with the carrier to review QoS markings and ensure DSCP values set by the enterprise are being honored by the carrier's network.

One-way audio on VoIP calls over a site-to-site VPN is a classic NAT/firewall issue — RTP (the voice media protocol) uses dynamically assigned UDP ports, and if the firewall or NAT device is blocking return traffic, audio flows in only one direction. The fix involves enabling SIP ALG (Application Layer Gateway) or using a session border controller that handles NAT traversal for SIP.

Related Articles