Skip to content

Scope & Prerequisites

Project Boundaries and Technical Requirements

Project Scope

This section defines what is included and excluded from the multi-cloud connectivity initiative to ensure clear expectations and proper resource allocation.

In Scope

Infrastructure Components:

  • ✅ Cisco SD-WAN fabric deployment and optimization
  • ✅ GCP Vertex AI platform setup and Webex CC integration
  • ✅ Azure ExpressRoute circuits and Virtual WAN configuration
  • ✅ SD-WAN Cloud OnRamp for SaaS, IaaS, and SASE
  • ✅ Cisco Umbrella SASE integration
  • ✅ ISE-based network access control and segmentation
  • ✅ Multi-cloud monitoring and analytics platform

Connectivity Services:

  • ✅ GCP Cloud Interconnect (10 Gbps dedicated)
  • ✅ Azure ExpressRoute (3 circuits: Mumbai, London, Virginia)
  • ✅ DIA circuits at all 19 sites
  • ✅ BGP routing across all cloud platforms
  • ✅ Private endpoints for Azure PaaS services
  • ✅ Direct peering to Office 365 via ExpressRoute

Security Services:

  • ✅ Zero-trust network access (ISE + Duo MFA)
  • ✅ DNS security and web filtering (Umbrella)
  • ✅ VPC Service Controls (GCP)
  • ✅ Azure Firewall and network security groups
  • ✅ Encrypted tunnels (IPsec, TLS)

Testing & Validation:

  • ✅ Component-level testing for all integrations
  • ✅ End-to-end integration testing
  • ✅ Failover and chaos testing
  • ✅ Performance benchmarking
  • ✅ User acceptance testing

Documentation:

  • ✅ Architecture design documents
  • ✅ Implementation procedures and runbooks
  • ✅ Configuration templates and standards
  • ✅ Troubleshooting guides
  • ✅ Operations and maintenance procedures

Out of Scope

Infrastructure Components:

  • ❌ Data center migration (existing workloads remain on-premises)
  • ❌ Legacy application modernization
  • ❌ End-user device management (BYOD, MDM)
  • ❌ Physical cabling or site construction
  • ❌ Telephony infrastructure (SIP trunks, PBX)

Cloud Services:

  • ❌ AWS connectivity (may be added in future phases)
  • ❌ GCP Compute Engine / VM migrations
  • ❌ Azure Virtual Machines deployment
  • ❌ SaaS application procurement or licensing
  • ❌ Database migration to cloud platforms

Applications:

  • ❌ Webex Contact Center platform deployment (assumes already deployed)
  • ❌ Office 365 tenant setup or migration
  • ❌ Application performance tuning (non-network)
  • ❌ Custom application development

Operations:

  • ❌ 24/7 NOC staffing or support services
  • ❌ Help desk or end-user support
  • ❌ Change management process definition
  • ❌ ITIL process implementation

Technical Prerequisites

Existing Infrastructure Requirements:

SD-WAN Platform:

  • vManage cluster (3 nodes minimum) running version 20.15.x or later
  • vSmart controllers (2 minimum) for control plane
  • vBond orchestrator for zero-touch provisioning
  • Hub routers: Cisco Catalyst 8500-12X with IOS-XE 17.15.x
  • Branch routers: ISR 4331 or ISR 1100 series with supported IOS-XE

Security Infrastructure:

  • Cisco ISE 3.x deployment with Policy Services Nodes at hubs
  • Cisco FTD appliances (if used for internet egress)
  • Cisco Umbrella licenses for all users
  • Cisco Duo licenses for MFA
  • Valid SSL certificates for all management platforms

Network Connectivity:

  • DIA circuits provisioned at all 19 sites (minimum 100 Mbps per site)
  • Hub sites: 1 Gbps or greater DIA circuits
  • Branch sites: 200 Mbps or greater DIA circuits
  • Backup circuits for hub sites (optional but recommended)
  • Public IP address allocations for cloud peering

Cloud Accounts:

  • GCP Organization-level access with billing enabled
  • Azure Enterprise Agreement with appropriate subscriptions
  • Webex Contact Center tenant (production)
  • Microsoft 365 tenant with appropriate licenses
  • Valid cloud support contracts

Skills & Expertise Prerequisites

Required Team Competencies:

Network Engineering:

  • Advanced knowledge of Cisco SD-WAN (vManage, policies, templates)
  • BGP routing and AS path manipulation
  • IPsec VPN and encryption
  • QoS and traffic shaping
  • Network troubleshooting and packet capture analysis

Cloud Engineering:

  • GCP networking (VPC, Cloud Interconnect, Cloud Router)
  • Azure networking (ExpressRoute, Virtual WAN, Private Link)
  • Cloud IAM and security policies
  • Infrastructure-as-code (Terraform preferred)
  • API integration and automation

Security Engineering:

  • Cisco ISE administration (TrustSec, profiling, authorization policies)
  • Zero-trust architecture principles
  • Firewall policy management
  • Certificate management and PKI
  • Security monitoring and incident response

Project Management:

  • Multi-vendor coordination
  • Risk management and mitigation
  • Change management procedures
  • Stakeholder communication
  • Budget tracking and reporting

Access & Permissions

Administrative Access Required:

System Access Level Purpose
vManage Admin SD-WAN policy and template management
GCP Console Organization Admin Project creation, IAM, networking
Azure Portal Subscription Owner Resource provisioning, ExpressRoute
Cisco ISE Super Admin Policy configuration, troubleshooting
Umbrella Dashboard Full Admin DNS policies, reporting
ThousandEyes Organization Admin Test configuration, dashboards

External Vendor Coordination:

  • GCP Partner Interconnect provider (if applicable)
  • Azure ExpressRoute connectivity provider
  • DIA circuit providers (may vary by location)
  • Webex Contact Center support team

Budget & Resource Allocation

Capital Expenditure (CapEx):

  • SD-WAN hardware: $850,000
  • Cloud connectivity (circuits, cross-connects): $420,000
  • Professional services (implementation): $650,000
  • Tools and monitoring platforms: $120,000

Operational Expenditure (OpEx) - Annual:

  • GCP Vertex AI licenses: $180,000
  • Azure ExpressRoute circuits: $240,000
  • DIA circuits (19 sites): $570,000
  • Support and maintenance: $150,000

Human Resources:

  • Network engineers: 4 FTE (full-time for 12 months)
  • Cloud engineers: 3 FTE (full-time for 12 months)
  • Security engineers: 2 FTE (50% allocation)
  • Project manager: 1 FTE (full-time for 18 months)
  • Technical writer: 1 FTE (25% allocation)

Timeline Constraints

Critical Milestones:

  • Month 3: Architecture design approval
  • Month 6: SD-WAN fabric operational
  • Month 9: GCP Vertex AI pilot with 25 agents
  • Month 12: Azure ExpressRoute production cutover
  • Month 18: Full production deployment (175 agents)
  • Month 24: Project closure and knowledge transfer

Dependency Awareness:

  • ExpressRoute circuit provisioning: 90-120 day lead time
  • GCP Dedicated Interconnect: 60-90 day lead time
  • Hardware procurement: 45-60 day lead time
  • DIA circuit provisioning: 30-45 day lead time

Compliance & Governance

Regulatory Requirements:

  • GDPR compliance for EU user data
  • SOC 2 Type II certification required
  • PCI DSS for payment processing (contact center)
  • HIPAA compliance if handling healthcare data
  • Data residency requirements per jurisdiction

Internal Policies:

  • Change management approval for production changes
  • Security review for all cloud integrations
  • Disaster recovery and backup procedures
  • Incident response and escalation procedures
  • Configuration management and documentation standards

Tools & Platforms

Required Software & Licenses:

Monitoring & Analytics:

  • ThousandEyes Enterprise Agents (6 minimum)
  • AppDynamics APM licenses
  • Splunk Enterprise Security
  • GCP Cloud Monitoring
  • Azure Monitor + Log Analytics

Development & Automation:

  • Terraform Cloud or Terraform Enterprise
  • Ansible or Python for automation
  • Git repository for configuration management
  • CI/CD platform (Jenkins, GitLab, or Azure DevOps)

Documentation:

  • Confluence or SharePoint for documentation repository
  • Visio or Lucidchart for network diagrams
  • Microsoft Office suite for reports and presentations

Risk Acceptance

Known Risks Accepted:

  • Limited rollback capability once ExpressRoute is in production
  • Circuit failures during implementation may impact users
  • Learning curve for cloud-native services may slow initial delivery
  • Integration issues between platforms may require vendor escalation
  • BGP route propagation delays during testing may affect connectivity

Mitigation Strategies:

  • Phased deployment with extensive testing at each stage
  • Maintain parallel MPLS connectivity during transition
  • Comprehensive failover testing before production cutover
  • 24/7 vendor support contracts for critical platforms
  • Documented rollback procedures for all major changes

Readiness Assessment Checklist

Pre-Project Validation:

  • Executive sponsorship and budget approval obtained
  • Technical teams identified and trained on prerequisites
  • All prerequisite infrastructure deployed and operational
  • Cloud accounts provisioned with appropriate permissions
  • Vendor contracts signed and support activated
  • Network diagrams and IP addressing documented
  • Change management process defined and approved
  • Communication plan established with stakeholders

Next Steps

After confirming all prerequisites are met, proceed to Chapter 2: Architecture Design for detailed technical architecture.

Prerequisites define the foundation for successful project execution.