Reference
WAN & VPN Services
FIA, DIA, MPLS, MetroE, Broadband, Dark Fiber, SD-WAN & VPN types explained
WAN Connectivity & VPN Services
When you need to connect locations that are too far apart for your own cables, you buy a WAN service from a provider. This guide explains every major WAN service type so a new tech can understand what they do, when to use them, and how they compare.
WAN Services Comparison
| Service | What It Is (Simple) | Speed Range | SLA? | Cost | Best For |
|---|---|---|---|---|---|
| Broadband | Shared internet (cable/DSL/fiber-to-home) | 25 Mbps – 1 Gbps | No | $ | Small offices, backup links |
| FIA | Fixed Internet Access — business-grade shared internet | 50 Mbps – 10 Gbps | Basic | $$ | SMB with moderate needs |
| DIA | Dedicated Internet Access — your own private pipe | 10 Mbps – 100 Gbps | Yes | $$$ | Mission-critical internet, cloud-heavy orgs |
| MPLS | Private carrier network connecting your sites | 1 Mbps – 10 Gbps | Yes | $$$$ | Multi-site with strict QoS requirements |
| Metro Ethernet | Carrier Ethernet within a metro area | 10 Mbps – 100 Gbps | Yes | $$$ | High-bandwidth links between nearby sites |
| Dark Fiber | Raw fiber strands — you supply the optics | 1G – 400G+ (your choice) | Fiber only | $$$$ | Maximum control, long-term high-bandwidth |
| SD-WAN | Smart software layer across any WAN links | Depends on underlay | Varies | $$ | Replacing MPLS with cheaper smart routing |
| P2P / Leased Line | Dedicated circuit between exactly 2 sites | 1.5 Mbps – 100 Gbps | Yes | $$$$ | Studio-to-transmitter, DC interconnect |
| Site-to-Site VPN | Encrypted tunnel over the internet | Depends on internet | No | $ | Budget inter-office connectivity |
Which WAN Service Should I Use?
| If You Need... | Choose | Why |
|---|---|---|
| Cheapest option for basic internet | Broadband | Low cost, good enough for non-critical use |
| Reliable internet with guaranteed speed | DIA | Dedicated bandwidth with SLA |
| Connect 3+ offices with QoS for voice | MPLS | Built-in traffic prioritization, any-to-any |
| Same thing but cheaper and more flexible | SD-WAN | Uses cheaper links + smart routing |
| High-speed link between 2 nearby locations | Metro Ethernet | Low latency, high bandwidth within a city |
| Maximum bandwidth, full control, long-term | Dark Fiber | You own the optics, scale by swapping SFPs |
| Dedicated link between exactly 2 sites | P2P Leased Line | Guaranteed bandwidth, zero sharing |
| Secure connection over internet (permanent) | Site-to-Site VPN | Encrypted tunnel, low cost, needs internet |
| Remote worker needs access to office network | Remote Access VPN | AnyConnect/WireGuard from home |
Common Real-World Combinations
Broadband
What it is: The same type of internet service you have at home — cable, DSL, or fiber delivered by an ISP. Your traffic shares bandwidth with other customers in your area.
- Asymmetrical speeds: Download faster than upload (e.g., 500 Mbps down / 50 Mbps up)
- Shared bandwidth: Speed can vary based on neighborhood congestion
- No SLA: Provider doesn’t guarantee uptime or speeds
- Best use: Low-priority backup link, small remote offices, guest Wi-Fi
FIA — Fixed Internet Access
What it is: A step up from basic broadband — a business-grade internet service with better reliability and basic support, but still shared bandwidth in the provider network.
- Business SLA: Basic uptime commitment (e.g., 99.9%), faster repair times than residential
- Higher speeds: 50 Mbps to 10 Gbps depending on technology and location
- Shared last mile: Still contended in the provider network, just with fewer users
- Middle ground: More reliable than broadband but less expensive than DIA
DIA — Dedicated Internet Access
What it is: A private internet connection just for you. Unlike broadband where you share a pipe with neighbors, DIA gives you guaranteed, symmetrical bandwidth that nobody else touches.
- Symmetrical speeds: Upload = Download (e.g., 500 Mbps both ways)
- Guaranteed bandwidth: If you pay for 100 Mbps, you get 100 Mbps 24/7
- SLA included: Uptime guarantees (99.99%), repair time commitments
- Delivery: Over dedicated fiber, Ethernet, or T1/T3 (legacy)
MPLS — Multiprotocol Label Switching
What it is: A private carrier network that connects your sites together. Your traffic never touches the public internet — it travels on the provider’s private backbone using “labels” to route packets efficiently.
- How it works: The provider puts a “label” on your packets at the edge and switches them through their network based on that label (faster than reading full IP headers)
- QoS (Quality of Service): Can prioritize voice/video over data — critical for real-time applications
- Any-to-any: All sites can talk to each other directly (hub-and-spoke or full mesh)
- Private: Your traffic is isolated from other customers (like a VPN but at the provider level)
Metro Ethernet (MetroE)
What it is: High-speed Ethernet-based connectivity within a metro area, delivered over carrier fiber. It extends your LAN across the city as if both locations were plugged into the same switch.
- Layer 2 service: Operates at the data link layer — transparent to your routers
- Service types (MEF standard):
| MEF Service | Name | Topology | Description |
|---|---|---|---|
| E-Line | EPL / EVPL | Point-to-Point | Dedicated or virtual private line between 2 sites |
| E-LAN | EP-LAN / EVP-LAN | Multipoint-to-Multipoint | All sites talk directly to all other sites (like a big switch) |
| E-Tree | EP-Tree / EVP-Tree | Hub-and-Spoke | Branches talk to HQ but not to each other |
| E-Access | Access EPL/EVPL | Inter-carrier | Extends service across provider boundaries |
Dark Fiber
What it is: You lease raw, unlit fiber optic strands from a provider. The fiber has no electronics on it — you supply your own optics (SFPs/QSFPs) and equipment on each end. “Dark” means the fiber has no light/signal until YOU light it up.
- Maximum control: You choose the speed, protocol, and equipment
- Scalable: Upgrade speed by swapping optics, not the fiber (1G → 10G → 100G → 400G)
- Low latency: Direct physical path, nothing in between
- Your responsibility: You maintain the electronics; provider maintains the physical fiber
P2P / Leased Lines
What it is: A dedicated, always-on, private circuit between exactly two locations. You get guaranteed bandwidth that nobody else shares. This is the oldest and most reliable form of WAN connectivity.
- Technologies: T1 (1.5 Mbps, legacy), T3 (45 Mbps, legacy), Ethernet Private Line (EPL), wavelength/DWDM
- Symmetrical: Same speed in both directions
- Always on: No dialing, no tunnels — circuit is permanently up
- Layer 1 or 2: Provider gives you a transparent pipe; you run whatever protocol you want
SD-WAN — Software-Defined WAN
What it is: A smart software layer that sits on top of your WAN links (broadband, DIA, MPLS, LTE) and automatically picks the best path for each type of traffic in real-time.
- How it works: SD-WAN appliances at each site monitor link quality (latency, jitter, loss) and dynamically steer traffic to the healthiest link
- Uses multiple links: Can combine broadband + DIA + LTE for redundancy and load balancing
- Cloud-friendly: Can send cloud traffic (Microsoft 365, Zoom) directly to the internet instead of backhauling through HQ
- Centralized management: Configure policies for all sites from one dashboard
- Built-in encryption: Creates IPsec tunnels between sites automatically
VPN as a WAN Service
VPNs are often used as a low-cost alternative to dedicated WAN circuits. Instead of paying for MPLS or a leased line, you encrypt traffic over the internet.
Site-to-Site VPN
Connects two entire networks (office LANs) over the internet with a permanent encrypted tunnel. A VPN gateway/firewall at each site handles the encryption.
- Always-on tunnel between two firewalls/routers
- All devices on both LANs can communicate through the tunnel
- Uses IPsec (IKEv2) or GRE over IPsec
- No software needed on individual PCs — the router handles it
Remote Access VPN
Connects a single user (laptop/phone) to the corporate network from anywhere. The user runs VPN client software that creates a temporary tunnel.
- User initiates connection; authenticates with credentials/MFA
- Common clients: Cisco AnyConnect, Palo Alto GlobalProtect, WireGuard, OpenVPN
- Full tunnel (all traffic through VPN) or split tunnel (only corporate traffic through VPN)
- Essential for work-from-home and traveling staff