4 Tangible Reasons for Considering SD-WANs

POSTED on April 19, 2017

With any new technology there’s “fake news” and SD-WANs are no exception. It’s true, SD-WANs probably won’t reduce your WAN costs by 90 percent or make WANs so simple a 12-year old can deploy them. But there are plenty of reasons to be genuinely excited about the technology — and we’re not just talking about cost savings. Often these “other” reasons get lumped into the catechisms of greater “agility” and “ease of use,” but here’s what all of that really means.

Align the Network to Business Requirements

When organizations purchase computers for employees we try to maximize our investment by aligning device cost and configuration to user function. Developers receive machines with fast processors, plenty of memory, and multiple screens. Salespeople receive laptops and designers get great graphics adapters (and Apples, of course).

SD-WANs allow us to do the same with the WAN. We can maximize our WAN investment by aligning the type of connectivity to business requirements. Connectivity can be tweaked based on availability options, types of transport, load balancing options, and more. Examples include:

Mission critical locations, such as datacenters or regional hubs, can be connected by active-active, dual homed fiber connections managed and monitor 24×7 by an external provider — and with a price tag that approaches MPLS.
At the other extreme, small offices or less critical locations can be connected with a single, xDSL connection for significant savings as compared against MPLS.
Short-term connections can be set up with 4G/LTE and, depending on the service, mobile users can be connected with VPN clients.

All governed by the same set of routing and security policies used on the backbone. By adapting the configuration to location requirements, we’re able to improve our return on investment (ROI) from SD-WANs.

Easy and Rapid Configuration

For years, WAN engineering has meant learning CLIs and scripts, mastering protocols like BGP, OSPF, PBR, and more. It was an arcane art and CCIEs were the master craftsman of the trade. But for many companies, managing their networks in this way is too expensive and not very scalable. Some companies lack the internal engineering expertise, others have the expertise, but far too many elements in their networks.

SD-WANs may not make WANs simple, but they do allow your networking engineers to be more productive by making WANs much easier to deploy and manage The “secret sauce” is extensive use of policies. Policy configuration helps eliminate “snowflake” deployments, where some branch offices are configured slightly differently other offices. Policies allow for zero-touch provisioning and deployment Policies also guide application behavior, making it easier to deliver new services across the WAN without adversely impacting the network. With an SD-WAN, you really can drop-ship an appliance to Ittoqqortoormiit, Greenland and have just about anyone install the device.

Limit Spread of Malware

SD-WANs position the organization to stop attacks from across the WAN. The MPLS networks that drive most enterprises were deployed at a time when threats predominantly came from outside the company. Security meant protecting the company’s central Internet access point and deploying endpoint security on clients. Once inside the enterprise, though, many WANs are flat-networks with all sites being able to access one another. Malware can move laterally across the enterprise easily, as happened in the Target breach that exposed 40 million customer debit and credit card accounts.

SD-WANs start to address some of these challenges by segmenting the WAN at layer three (actually, layer 3.5, but let’s not get picky) with multipoint IPsec tunnels. The SD-WAN nodes in each location map VLANs or IP address ranges to the IPsec tunnels (the “overlays”) based on customer-defined policies. Users are limited to seeing and accessing the resources associated with that overlay. As such, rather that being able to attack the complete network, malicious users can only attack the resources accessible from their overlays. The same is true with malware. Lateral movement is limited to other endpoints in the overlay not the entire company.

Don’t Sweat the Backhoe

As much as MPLS service providers manage their backbones, none of that would protect you from the errant backhoe operator, the squirrels, or anyone of a dozen other “mishaps” that break local loops. Redundant connections are what’s needed.

With MPLS that would normally mean connecting a location with an active MPLS line and a passive Internet connection that’s only used for an outage. Running active-active is possible, but can introduce routing loops or make route configuration more complicated. Failover between lines with MPLS is based on DNS or route convergence, which takes too long to sustain a session. Any voice calls, for example, in process at the moment of a line outage will be disrupted as session switch onto a secondary line.

With SD-WANs use of tunneling, running active/active is not an issue. The SD-WAN node will load balance the connections, maximize their use of available bandwidth. Determination to use one path or another is driven by the same user-configured traffic policies that drive the SD-WAN. Should there be a failure, some SD-WANs can failover to secondary connections (and back) fast enough to preserve the session. The customer’s application policies continue to determine access to the secondary line with the additional demand.

Bottom Line

Conventional enterprise wide area networks are a hodge podges of routers, load balancers, firewalls, next generation firewalls (NGFW), anti-virus and more. SD-WANs change all of that with a single consistent policy-based network, making it far easier configure, deploy, and adapt the WAN. As SD-WANs adapt to evolve and include security functions as well, the agility and usability of SD-WANs will only grow.

Tags: Backhaul, Cato Cloud, Cato Networks, Cato Networks Blog, Firewall, malware, MPLS, Network Security as a Service, NGFW, SD-WAN, Secure SD-WAN, WAN