“Paying $3,000 per month for a 10Mbps legacy MPLS link is unsustainable in a cloud-first enterprise. SD-WAN overlays aggregate dual commodity broadband links into a 200Mbps encrypted fabric with sub-second Application-Aware failover.”

In January 2017, during my tenure as Lead Consultant at Wipro, we spearheaded an enterprise WAN modernization project for a major retail client.

The client operated 50 regional branch offices and retail stores across India.

Each branch was connected back to the corporate datacenter over a legacy 10Mbps MPLS circuit provided by a primary telecom carrier, costing over $3,000 per month per site.

As the enterprise migrated its core applications to Office 365, Salesforce, and cloud-hosted SAP, branch network performance collapsed.

---

The 10Mbps MPLS Bottleneck

A 10Mbps MPLS link designed in 2008 could not handle 2017 cloud traffic demands.

When store managers opened large Office 365 attachments or synced inventory databases, the 10Mbps pipe hit 100% saturation.

VoIP calls between store managers and regional directors stuttered with heavy packet loss, while point-of-sale (POS) credit card processing terminals timed out during peak weekend shopping hours.

The telecom carrier quoted six months lead time and a 3x price increase to upgrade the MPLS circuits to 50Mbps.

The business could not afford the cost or the delay.

---

The Mess: The 60-Second Failover Blackout

Before deploying an orchestrated SD-WAN solution, an internal network engineer tried a DIY workaround.

He ordered cheap dual 100Mbps local business broadband lines for two test store branches and configured traditional Cisco ISR routers with static IP SLA route tracking.

The configuration looked simple: Primary route via Broadband 1; Secondary route via Broadband 2; Backup route via 4G/LTE USB modem.

The DIY failover failed during its first real-world test:

# Cisco ISR IP SLA Tracking Delay during silent ISP degradation:
# IP SLA probe timeout: 10 seconds | Down-timer multiplier: 3
# Total Failover Window: 60 seconds of silent packet dropping!

When Broadband 1 experienced high packet loss (15% loss without dropping physical link state), IP SLA tracking took 60 seconds to declare the link dead and withdraw the static route.

For a full minute, POS credit card transactions failed at the checkout counter, and active customer phone calls disconnected.

Worse: store employees realized the backup 4G/LTE link provided fast unthrottled internet. They began streaming high-definition YouTube videos during lunch breaks, exhausting the branch’s monthly 20GB cellular data plan in three days!

DIY router scripts could not handle dynamic link quality steering or application-layer traffic shaping.

---

The Solution: Cisco Viptela SD-WAN Overlay & AAR Policies

We deployed Cisco Viptela vEdge appliances across all 50 branch offices, orchestrating the overlay network through vManage and vSmart controllers.

# Cisco Viptela SD-WAN Transport Aggregation

- **Transport Color 1 (`biz-internet`):** Primary 100Mbps Business Fiber Broadband ($150/mo)
- **Transport Color 2 (`public-internet`):** Secondary 100Mbps Broadband ($100/mo)
- **Transport Color 3 (`lte`):** Standby 4G/LTE Cellular Data (Metered Backup)

We enabled Application-Aware Routing (AAR) policies coupled with BFD (Bidirectional Forwarding Detection) probes running continuously across all transport color tunnels.

# Cisco Viptela vEdge Application-Aware Routing (AAR) Policy
policy
  app-route-policy AAR-VOIP-AND-POS
    vpn-list CORPORATE-VPNS
    sequence 10
      match
        app-list VOIP-AND-POS-APPS
      action
        sla-class VOIP-SLA preferred-color biz-internet fallback-to-lte
    sequence 20
      match
        app-list NON-CRITICAL-SaaS
      action
        sla-class DATA-SLA preferred-color public-internet

How AAR Policies Enforced SLA Resilience

1. Sub-Second Latency Steering: BFD probes sent latency, jitter, and packet loss metrics across biz-internet every 100ms. If packet loss exceeded 2% or latency crossed 150ms, Viptela shifted active VoIP and POS flows to public-internet in under 300 milliseconds—with zero dropped calls!
2. Metered LTE Protection: Low-priority non-business traffic (YouTube, social media) was strictly pinned to broadband transports and blocked from ever using the metered lte backup link.

---

The Impact

• 70% WAN Cost Reduction: Replaced $3,000/month 10Mbps MPLS circuits with dual $150/month business broadband lines, cutting annual WAN spend by over $1.5 Million USD.
• 20x Bandwidth Increase: Increased branch WAN throughput from 10Mbps to 200Mbps active-active.
• Sub-Second Failover: Delivered sub-300ms Application-Aware failover for POS terminals and voice calls during ISP brownout events.

Key Takeaway

Replace Static MPLS Circuits with Application-Aware SD-WAN Overlays.

Do not rely on static IP SLA route tracking scripts for branch office WAN failover. Deploy Cisco Viptela SD-WAN overlays to aggregate low-cost dual business broadband links, and enforce Application-Aware Routing (AAR) policies to dynamically steer latency-sensitive voice and transactional traffic based on real-time SLA probes.

---

Architecture and decisions: mine. Debugging sessions at odd hours: mine. AI assistance: structure, syntax, first draft. — Sachin