Executive Summary¶
Business Objective¶
Abhavtech is deploying a multi-cloud hybrid architecture that combines:
- GCP Vertex AI Platform (Primary): AI-powered Webex Contact Center (WxCC) analytics for 175 agents
- Azure SASE Platform (Secondary): Secure Access Service Edge for Office 365 and global user access
- Existing Cisco Infrastructure: DIA-based SD-WAN with Umbrella SASE, ISE, FTD
Architecture Principles¶
| Principle | Implementation |
|---|---|
| Cloud-Native Services | Use purpose-built cloud services (GCP CCAI, Azure Virtual WAN) vs DIY |
| DIA-First Connectivity | Local internet breakout at branches, cloud-direct paths |
| Zero Trust Security | Identity-based access (ISE SGT, Azure AD, Duo MFA) |
| Cost Optimization | Avoid hair-pinning traffic through on-premise hubs |
| Operational Simplicity | Unified management via SD-WAN vManage + cloud consoles |
Key Architectural Decisions¶
┌─────────────────────────────────────────────────────────────────────────────┐
│ ABHAVTECH CLOUD CONNECTIVITY MODEL │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ CURRENT SD-WAN MODEL: ✅ DIA (Direct Internet Access) │
│ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ │
│ │
│ Branch Site │
│ ┌────────────────────┐ │
│ │ Users/Applications │ │
│ └─────────┬──────────┘ │
│ │ │
│ ▼ │
│ ┌────────────────────┐ ┌──────────────────┐ │
│ │ SD-WAN Edge │ │ Cisco Umbrella │ │
│ │ (C8500 / ISR) │──────────▶│ SASE (DIA) │ │
│ │ │ IPsec │ │ │
│ │ • Corporate → MPLS │ │ • DNS Security │ │
│ │ • SaaS → DIA │ │ • Web Filtering │ │
│ │ • Internet → DIA │ │ • Cloud Firewall │ │
│ └────────────────────┘ └──────────────────┘ │
│ │
│ CLOUD CONNECTIVITY STRATEGY: │
│ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ │
│ │
│ ┌────────────────────────────────────────────────────────────────┐ │
│ │ GCP VERTEX AI (WxCC Analytics) │ │
│ │ ───────────────────────────────────── │ │
│ │ • Connectivity: Direct from WxCC Cloud → GCP (cloud-to-cloud) │ │
│ │ • On-Prem Access: Via Umbrella SASE DIA tunnels │ │
│ │ • No dedicated circuits (use internet with TLS) │ │
│ └────────────────────────────────────────────────────────────────┘ │
│ │
│ ┌────────────────────────────────────────────────────────────────┐ │
│ │ AZURE SASE (Office 365 / Global Access) │ │
│ │ ──────────────────────────────────────── │ │
│ │ • Connectivity: Azure Virtual WAN (DIA-based SD-WAN hub) │ │
│ │ • Office 365: ExpressRoute for Microsoft Peering │ │
│ │ • Global Users: Azure Private Link via DIA │ │
│ └────────────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
Rationale for Design Choice:
| Decision | Reasoning |
|---|---|
| No GCP Dedicated Interconnect | WxCC is cloud-native, already on Cisco's network. No need for dedicated circuits to GCP. Internet-based connectivity with TLS sufficient. |
| Azure ExpressRoute for O365 | Office 365 is business-critical (email, Teams). ExpressRoute provides <5ms latency, 99.95% SLA. |
| Umbrella SASE for Internet | Already deployed, DIA-optimized. No need for duplicate Azure Firewall for internet traffic. |
| Azure Virtual WAN for SD-WAN | Hub for multi-branch connectivity to Azure services. No replacement for existing Cisco SD-WAN. |