Why SD-WAN Is Taking Over Enterprise Networks

One of the fastest growing enterprise networking technologies, SD-WAN can simplify network management and optimize connections to cloud services.

Leased-line and MPLS connectivity can serve your head office well, but for small branch offices and remote workers using SaaS applications the public internet is often the only option. They could be customer service agents working from home, first responders on scene, or travelling executives all using latency-sensitive voice and video services – something traditional enterprise WANs struggle to support.

The promise of SD-WAN is “more agile, dynamic, and cheaper branch-office connectivity without losing quality of service,” Ovum distinguished analyst Roy Illsley explained to Data Center Knowledge. But to date, the main business driver for SD-WAN adoption has been the opportunity to save money on access costs.

Broadband services have become more reliable with new fiber laid in the ground, and 5G promises more mobile bandwidth that is also more reliable. “These become serious, cost-effective alternatives to expensive MPLS links,” he said. SD-WAN isn’t going to replace MPLS in the immediate future, but routing what you can over the public internet frees up those expensive circuits for the enterprise’s most critical traffic.

Related:VMware Rethinks Load Balancing, Takes Dead Aim at NGINX

“The transition is from private leased lines and MPLS to some flavor of broadband internet, either in a hybrid fashion or eventually all internet,” Atchison Frazer, head of worldwide marketing at Versa Networks, told us.

It’s not just that broadband connections are cheaper than MPLS circuits; it’s also the ancillary costs. “To accommodate MPLS I have to deploy five different very expensive hardware devices from different vendors that don’t integrate,” Frazer said.

SD-WAN replaces a big integration project with greater network control and flexibility. Ovum’s Illsey explained: “Where previously MPLS was the corporate WAN, and so by necessity all WAN traffic traversed it, SD-WAN enables the enterprise to determine which types of traffic should have priority and when: payroll traffic should be prioritized in the runup to payday, for instance, or a department store's toy section might need more guaranteed bandwidth before Christmas than after it. Priorities can be ratcheted up and down according to such constraints, with traffic routing made to reflect such ad hoc changes.”

That flexibility is what Versa customers are looking for, Frazer said. “Almost everyone we work with tell us ‘we moved from aggregation of links to cost arbitrage, from MPLS to broadband,’ and that was phase one. Now we're at ‘I need SaaS acceleration, I need to move my data centers, I need to move my apps across, I need to accommodate mobile users.’ They want to extend their SD-WAN fabric to the cloud. The legacy WAN was never designed for that.”

Related:Need a Bigger and Badder Network? Try Using Microsoft’s

Unusually, Versa’s SD-WAN is software that can run on a variety of hardware or in the cloud. (“We can be deployed on white box, grey box, bare metal, you name it.”) It’s also available through managed service providers who can set policies and offer SLAs.

Versa’s software can replace multiple pieces of network infrastructure, such as wireless access points, firewalls, routers, and so on.

Policy and SLAs promise redundancy and resiliency, even for challenging network workloads like voice and video for geographically dispersed locations: “We can replicate packets, we can do forwarding, we can establish fast-failover high-availability at every single branch, so the likelihood of a brownout of your voice is significantly minimised. Now, you've got an SLA on every user, every app that user uses and every WAN link with their enterprise apps. And it can all be changed on the fly by adjusting a policy. You can set up a policy that looks at bit rates across a WAN link, so you deliver the app to the user close to where the user actually is.” That will be increasingly important as edge and 5G networks arrive.

More Security in SD-WAN, Not Less

In the recent market trends survey IDG conducted for Masergy improving network security was also a high priority for enterprises moving to SD-WAN.

Regulated organizations, such as ones in the financial services, are moving to SD-WAN so they can use traffic routing and segmentation. Separating the traffic that contains sensitive customer data and PII from routine traffic helps with PCI compliance.

With most SD-WAN solutions that means partnerships and integrations. “Most of what we call the traditional SD-WAN vendors – those who came into existence to deliver SD-WAN functionality in its own right – tend to partner with security specialists, even if many of their customer premises equipment (CPE) devices come with some basic firewalling capabilities,” Illsley explained. “Similarly, the WAN optimization vendors that have moved into SD-WAN do not count security among their core competencies and so partner with security specialists.”

Versa is the exception, he said, a “traditional” vendor that has built security into its infrastructure and will be offering WAN optimization this year.

That’s interesting, because SD-WAN also means a major shift in how you handle network security, especially for branch offices. “In a traditional WAN based on MPLS links a branch office's entire data traffic, including their internet access, is routed through head office in a hub-and-spoke connectivity model. While this can have implications for the user experience in the branch (in that it may result in increased latency on the internet connection), it has distinct advantages in terms of security, because head office can see and impose security controls on all traffic to and from the internet for the branches as well as for HQ,” Illsley said.

Backhauling all that traffic to the data center is highly inefficient, Frazer claimed, and it just doesn’t work when it comes to supporting remote employees.

Plus, the extra information available through the SD-WAN environment gives you extra visibility, meaning that the switch to using broadband connections can help you improve security. “You can make a better risk assessment using SD-WAN because we can tell you what bandwidth capacity apps are using as well as what apps users are using at what time of day.” As machine learning-based security tools become more common, having that kind of detailed baseline for normal network behavior will be key to spotting attacks as soon as they start.