Design and Simulation of a Secure Wide Area Network (WAN)

Design and Simulation of a Secure Wide Area Network (WAN)
Abstract
This project presents the design and simulation of a Secure Wide Area Network (WAN) that interconnects a headquarters facility with multiple branch offices over untrusted public infrastructure. The architecture integrates IPsec site-to-site VPN tunnels for encrypted inter-site communication, dynamic routing through OSPF and BGP for path redundancy and failover, and Access Control Lists (ACLs) for traffic policy enforcement. The design employs a resilient edge architecture with dual ISP connectivity at the headquarters, GRE over IPsec tunnels to support dynamic routing protocol exchange, and DMVPN (Dynamic Multipoint VPN) for scalable hub-and-spoke topologies. Simulation in Cisco Packet Tracer validates secure connectivity between sites, automatic failover during link failures, and enforcement of security policies restricting unauthorized traffic flows. The project demonstrates that a carefully designed WAN can achieve both high availability and strong security without reliance on expensive private MPLS circuits, making it suitable for small and medium-sized enterprises seeking cost-effective branch connectivity.
Keywords: Wide Area Network, IPsec VPN, GRE Tunnel, DMVPN, BGP, OSPF, Network Security
________________________________________
Chapter One: Introduction
1.1 Background of the Study
Wide Area Networks (WANs) form the backbone of geographically distributed enterprise operations, connecting headquarters, branch offices, data centers, and cloud resources across vast distances. Unlike Local Area Networks (LANs) that operate within controlled physical boundaries, WANs must transport sensitive organizational data over infrastructure that is often outside the organization's direct control. This fundamental characteristic creates significant security challenges that demand careful architectural consideration.
Traditional WAN implementations relied heavily on private leased lines or MPLS (Multiprotocol Label Switching) circuits from service providers. While these technologies offered inherent security through physical and logical separation from public networks, they came with substantial costs and limited flexibility. A study on SD-WAN strategies notes that organizations increasingly seek alternatives that reduce operational costs while improving network efficiency and security in cloud-driven enterprise environments .
The proliferation of broadband internet connectivity, combined with mature encryption technologies, has enabled organizations to build secure overlay networks over public infrastructure. IPsec (Internet Protocol Security) VPN tunnels provide the confidentiality, integrity, and authentication required for sensitive data transmission, effectively creating private network segments across untrusted transport . When combined with dynamic routing protocols and redundant connectivity, these overlay networks can match the reliability of traditional private circuits at a fraction of the cost.
1.2 Statement of the Problem
Organizations with distributed operations face a complex set of requirements when designing WAN connectivity. They must ensure that inter-site communication remains confidential and tamper-proof, that critical business applications maintain acceptable performance and availability, and that security policies governing traffic flows between sites are consistently enforced.
Many small and medium-sized enterprises lack the budget for dedicated MPLS circuits but cannot compromise on security or reliability. They require WAN designs that leverage affordable internet connectivity while providing the encryption, redundancy, and policy enforcement capabilities typically associated with private networks. Additionally, the increasing adoption of cloud services means that WAN traffic patterns are shifting, with branch offices requiring direct access to cloud resources rather than backhauling all traffic through headquarters .
The challenge is to design a WAN that is simultaneously secure, resilient, scalable, and cost-effective—achieving these objectives through appropriate protocol selection, topology design, and security configuration.
1.3 Aim and Objectives
The aim of this project is to design and simulate a Secure Wide Area Network that provides encrypted, resilient, and policy-controlled connectivity between headquarters and branch locations.
The specific objectives are:
1. To design a WAN topology that connects headquarters with multiple branch offices using affordable public internet connectivity secured by IPsec VPN tunnels.
2. To implement dynamic routing using OSPF for internal route distribution and BGP for external ISP peering, enabling automatic failover and load balancing.
3. To configure GRE over IPsec tunnels that support routing protocol exchange while maintaining encryption of all inter-site traffic.
4. To deploy Access Control Lists that enforce security policies, including isolation of sensitive departments from unauthorized zones.
5. To validate the design through simulation, demonstrating secure connectivity, path redundancy, and policy enforcement.
1.4 Significance of the Study
This project contributes a practical, validated reference architecture for secure WAN deployment using industry-standard protocols and commonly available equipment. The design demonstrates that organizations can achieve enterprise-grade security and reliability without proprietary WAN optimization appliances or expensive private circuits. The documentation of GRE over IPsec configuration, BGP multihoming, and ACL policy enforcement provides network engineers with a concrete implementation guide.
1.5 Scope and Limitations
The scope encompasses the design and simulation of a multi-site WAN topology including headquarters, two branch offices, and simulated ISP connectivity. The design covers IPsec VPN configuration, GRE tunneling, OSPF and BGP routing, and security policy implementation via ACLs.
Limitations include the focus on a simulated environment (Cisco Packet Tracer) rather than production deployment, the exclusion of SD-WAN controller-based architectures (though the design is compatible with SD-WAN overlay concepts), and the assumption of static public IP addresses for VPN endpoints (dynamic IP scenarios require additional configuration not covered here).
1.6 Definition of Terms
WAN (Wide Area Network): A telecommunications network that extends over a large geographic area, connecting multiple LANs across cities, countries, or continents.
IPsec (Internet Protocol Security): A suite of protocols for securing IP communications through authentication and encryption of each packet in a data stream .
GRE (Generic Routing Encapsulation): A tunneling protocol that encapsulates network layer protocols inside virtual point-to-point links, enabling routing protocols to operate across VPN tunnels .
DMVPN (Dynamic Multipoint VPN): A Cisco technology that enables dynamic establishment of VPN tunnels between branch sites without requiring permanent point-to-point configurations .
BGP (Border Gateway Protocol): The routing protocol used to exchange routing information between autonomous systems on the internet, enabling multihoming and ISP redundancy .
OSPF (Open Shortest Path First): A link-state interior gateway protocol used for routing within an autonomous system.
IKE (Internet Key Exchange): The protocol used to negotiate and establish IPsec security associations, operating in two phases .
Crypto Map: A Cisco IOS construct that binds together IPsec parameters (transform sets, ACLs, peer addresses) and is applied to an interface to trigger encryption .