What is SD-WAN?
Software-Defined Wide Area Network (SD-WAN) is a virtual wide area network architecture that allows enterprises to use any combination of transport services, including MPLS, LTE, and broadband Internet services, to securely connect users to applications.
Explanation of SD-WAN
The traditional model of transporting traffic from branch offices to the data center for robust security verification is no longer optimal because it wastes bandwidth and adds latency, ultimately reducing efficiency. There is a real need for a better way to send traffic directly over the Internet from branch offices to secure SaaS and cloud applications while still meeting enterprise security requirements.
SD‑WAN technology is designed to provide high performance and resiliency for applications, automate traffic management based on business goals, improve network security, and simplify WAN architecture. SD-WAN uses a centralized management feature to securely and intelligently manage traffic across the WAN and directly to trusted SaaS and IaaS providers. This improves application performance and provides a high-quality user experience, which increases business productivity and flexibility and also reduces IT costs.
SD-WAN architecture
Traditional router-based WANs were never built for the cloud. They typically require all traffic, including cloud traffic, from branch offices to a hub or main data center where advanced security screening services can be applied. Latency caused by feedback degrades application performance, leading to poor user experience and reduced overall efficiency.
Unlike the traditional router-centric WAN architecture, the SD-WAN model is designed to fully support applications hosted in on-premises data centers, public or private clouds, and SaaS services such as Salesforce.com, Workday, Dropbox, Microsoft 365 and others, providing the highest level of application performance.
How does SD-WAN work?
A conventional (non-SD-WAN) router-centric model distributes the management function among all devices on the network and simply routes traffic based on TCP/IP addresses and ACLs. This traditional model is rigid, complex, inefficient and inconvenient for the cloud, resulting in a poor user experience.
SD-WAN enables cloud enterprises to deliver the highest quality of application experience (QoEx) to users. By identifying applications, SD-WAN provides intelligent routing across the WAN based on the type of application. Each class of applications receives appropriate quality of service controls and security policies according to business needs. Secure local internet breakout (the moment when data moves from a private network to the public internet) of IaaS and SaaS application traffic from a branch office provides the highest level of cloud efficiency while protecting the enterprise from threats.
Why SD-WAN?
Times have changed and businesses are embracing the cloud and moving to SaaS software. While users have traditionally connected to the corporate data center to access business applications, they are now better served by accessing applications in the cloud.
As a result, the traditional WAN is no longer suitable, mainly because transporting all traffic, including that destined for the cloud, from the branch office to the main office causes latency and degrades application performance. SD-WAN provides WAN simplification, lower costs, high bandwidth, and reliable cloud connectivity with high performance, especially for mission-critical applications, without compromising data security and privacy.
Basic SD-WAN vs. Business-Oriented SD-WAN
Many SD-WAN offerings are basic “good enough” solutions. But these solutions lack the intelligence, reliability, performance, and scalability needed to deliver great networking. Enterprise digital transformation initiatives rely on applications, which rely on services, which in turn rely on the network. SD-WAN is a key digital transformation tool and drives enterprise-wide strategic decisions.
So what is business-oriented SD-WAN and why is basic SD-WAN not good enough?
Life cycle orchestration and automation
Most basic SD-WAN offerings provide some level of zero-touch provisioning. However, basic SD-WAN solutions do not always provide full end-to-end orchestration of all edge WAN functions such as routing, security services, including linking services to advanced third-party security services, and WAN optimization. When enterprises deploy new applications or when QoS or security policy changes are required, business-managed SD-WAN supports centralized configuration, enabling the necessary changes to be deployed in minutes instead of weeks or months. Centralized orchestration greatly minimizes human error that can compromise performance or security.
Continuous self-learning
A basic SD-WAN solution manages traffic according to predefined rules, usually programmed using templates. business-oriented SD-WAN ensures optimal application performance under any network conditions or changes, including congestion and when impairments occur. Through continuous monitoring and self-learning, business-oriented SD-WAN automatically and in real-time reacts to any changes in network health, allowing users to always connect to applications without manual intervention from the IT team. For example, if a WAN transport service or a cloud security service experiences performance impairment, the network automatically adapts to support traffic while maintaining compliance with business policies.
Consistent Quality of Experience (QoEx)
A key benefit of advanced SD-WAN solutions is the ability to actively use multiple forms of WAN transport simultaneously. A basic solution can route application-based traffic down a single path, and if that path fails or has poor performance, SD-WAN can dynamically reroute to a better-performing link. However, many basic solutions have crash recovery times of tens of seconds or longer, often leading to unpleasant application interruptions. Enterprise SD-WAN solutions intelligently monitor and manage all essential transport services. They can overcome packet loss, latency, and jitter to ensure the highest level of application performance and quality of experience for users, even when WAN transport services are disrupted. Unlike basic SD-WAN, business-oriented SD-WAN handles a complete transport outage seamlessly and provides sub-second failover that averts interrupting business-critical applications such as voice and video communications.
End-to-end segmentation
While basic SD-WANs provide the equivalent of a VPN service, a business-driven SD-WAN provides more comprehensive, end-to-end security capabilities. In addition to supporting a next-generation firewall, the SD-WAN platform should orchestrate and enforce end-to-end segmentation spanning the LAN-WAN-Data center and the LAN-WAN-Cloud. Centrally configured security policies are much more consistent with less human error than the device-centric WAN model or the basic SD-WAN model, which often require configuring policies on a per-device basis. If a policy requires a change, it is programmed centrally via business-managed SD-WAN and sent to 10, 100 or 1,000 nodes in the network, providing a significant increase in operational efficiency while reducing the overall attack surface and avoiding any security breaches.
Secure local Internet access for cloud applications
Many standard SD-WANs provide some application classification capabilities based on fixed definitions and manually created ACLs to route SaaS and IaaS traffic directly over the Internet. However, cloud applications are constantly changing. Business-oriented SD-WAN constantly adapts to changes and provides automatic daily application detection and IP address updates. This eliminates application interruptions and user performance issues.
Ideally, enterprise customers should migrate to a business-centric SD-WAN platform that integrates SD-WAN, firewall, segmentation, routing, WAN optimization, visibility and control functions all in one centrally managed platform.
Enhanced SD-WAN functionality for SASE
In 2019, Gartner coined the term Secure Service Branch Access, or SASE, which offers a more secure and flexible way to perform advanced security checks directly in the cloud, instead of routing application traffic to the data center before forwarding it into the cloud.
SASE combines SD-WAN with essential cloud-based security features, also known as Security Service Edge (SSE). SSE defines a set of security services that help implement the SASE security vision.
Ultimately, the goal of SASE is to provide the best quality of experience for end users in cloud applications without compromising security. After working with many enterprises that have designed and deployed their SASE architecture, we have learned that basic SD-WAN functionality is not enough. SASE requires an SD-WAN with advanced networking capabilities for full functionality. A modern enterprise SD-WAN provides the following features:
- Identify application traffic on the first packet and granularly steer it to enforce both QoS and security policies as defined by business intent
- Keep cloud application definitions and TCP/IP address ranges up to date, automatically, every day
- Automate orchestration between the SD-WAN and cloud-delivered security services from a single console to make it easy
- Automatically failover to a secondary cloud security enforcement point to avoid any application interruption
- Automatically reconfigure secure connections to cloud security enforcement points if a newer, closer location to the branch becomes available
- Enable customers to adopt cloud security services—and their SASE implementations—at their own pace
- And most importantly, provide the freedom of choice to deploy new security innovations as they become available from any vendor to easily address unknown future threats.
Leaders in business-oriented SD-WAN
Gartner, a leading IT research and consulting firm, called Prisma SD-WAN from Palo Alto Networks the most functional SD-WAN solution for businesses. Fortinet Secure SD-WAN and Aruba EdgeConnect SD-WAN received the status of “Customers’ Choice 2024” from the organization. Also among the leaders is VMware SD-WAN, having a very high rating and a large number of reviews.
Wise IT is an official partner of Palo Alto Networks, Fortinet, Aruba by HPE and VMware! Get an unbiased assessment of your business needs and create a customized path to the best possible SD-WAN network. Order a free consultation today: