Learning objectives
- Explain enterprise connectivity layers
- Compare architectural tradeoffs without acronym bias
- Plan a reversible connectivity migration
The mental model
Enterprise connectivity connects people, offices, clouds, and applications under operational constraints. A VPN creates a protected logical connection over another network. MPLS forwards traffic using labels and is often associated with managed private WAN services. SD-WAN applies software-defined policy to WAN connectivity and can use multiple underlying links. SASE combines networking and security functions in a cloud-delivered architectural model. These terms describe different layers and choices, not a simple ladder where every newer acronym replaces every older one. A branch may need predictable connectivity, local survivability, device management, and application-specific policy. The right design starts with those requirements and the traffic flows they create.
How it works
Separate the underlay from the overlay. The underlay is the transport that actually carries packets, such as an Internet circuit or private WAN. An overlay builds logical connectivity and policy over it. A VPN can encrypt traffic across an untrusted underlay, but its reachability model may grant broader network access than an individual application requires. MPLS labels support forwarding within a provider network; MPLS alone is not equivalent to end-to-end encryption. SD-WAN can steer traffic across available transports using policy and observed conditions, but cannot create capacity that the underlying links lack.
SASE combines WAN and security capabilities conceptually, often including secure web gateway and identity-aware access. Evaluate exact service capabilities rather than assuming every vendor bundle is identical. Build a requirements matrix covering users, sites, private applications, Internet egress, identity, device posture, performance, resilience, and operations. Include migration coexistence and failure scenarios: what happens when the identity provider fails, a branch loses one circuit, or a client cannot install an agent? A phased design can preserve a legacy path while validating new policies for a small population. Commercial value should reflect operational simplification and useful access, not acronym consolidation alone.
Applied example · hypothetical
Hypothetical example: a retailer wants to replace a hub-and-spoke WAN because branches send cloud application traffic through headquarters. Direct local egress could reduce the detour, but the security team requires consistent filtering and visibility. The design compares existing circuits, an SD-WAN policy layer, and cloud-delivered security. A pilot branch tests application performance, failover, and policy enforcement. Stores with special payment or operational requirements may need a different transition plan. The decision is based on workload and resilience evidence rather than assuming one architecture fits every location.
In a customer engagement
For Cloudflare One discussions, map the customer's users, sites, and applications before describing a target architecture. Separate private application access from employee Internet security and site connectivity. Confirm supported connection methods and operational requirements in current documentation. A migration recommendation should include coexistence, identity dependencies, monitoring, and a reversible pilot, not just a before-and-after vendor diagram.
Interview relevance
Interviewers want to know whether you can translate enterprise acronyms into a practical design. Define each briefly, identify the layer it affects, and ask about traffic and constraints. Mention that a private transport and encryption are separate properties. Explain why a phased migration often reduces organizational and technical risk.
Common mistakes
- Calling MPLS inherently encrypted
- Assuming SD-WAN fixes inadequate underlay capacity
- Treating SASE bundles as identical across vendors
Key terminology
VPN — A logical private connection over another network, commonly using encryption to protect traffic.
MPLS — A forwarding method that uses labels through a network; it does not inherently provide end-to-end encryption.
SD-WAN — Software-defined policy and management for wide-area connectivity across available transports.
SASE — An architecture combining wide-area networking and cloud-delivered security capabilities.
Explain it without the page
- Which application flows should bypass a headquarters detour?
- What identity failure behavior must a remote-access design define?
Further reading
Sources explain the underlying concepts; examples and practice answers are original course material. Recheck current limits and plan eligibility before a real proposal.