1 SD-WAN

1.1 SD-WAN Introduction

A software-defined wide-area network (SD-WAN), is a virtualized network overlay that provides

organizations with remotely manage and quickly scale over large geographical distances. An SD-WAN
can connect several branch locations to a central headquarter or over multiple locations such as large
retail chain stores This architecture is abstracted form hardware, which means more flexible and
available than a traditional WAN architecture.

SD-WAN provides a wide range of benefits for distributed organizations.

 Taking full advantage of the idle backup links to increase bandwidth through dynamic load-
balancing
 Improving the user experience on cloud-native apps by enabling direct internet access at the
branch.
 Reducing deployment and management costs through cloud-based zero touch provisioning and
centralized management
 Lowering WAN costs through the use of less expensive internet or LTE connectivity in place of
MPLS.

1.2 SD-WAN Components

Three key components to an SD-WAN, The SD-WAN edge, the controller, and the orchestrator.

 The SD-WAN edge is where it gives an enterprise access to a carrier network

 The SD-WAN Orchestrator is the virtualized manager for network, which provides IT
professionals a single pane of glass to analyse traffic and apply policy.

 The SD-WAN Controller provides physical or virtual device management for all SD-WAN
Edges associated with the controller

1.3 SD-WAN Architecture

Three main types of SD-WAN architecture: on-premises, cloud-enabled, and cloud-enabled with a
backbone.
 On-premises SD-WAN
SD-WAN boxes are deployed directly at customers’ site, connecting to the other sites and
performs real-time traffic shaping at each site.

 Cloud-enabled SD-WANs
In a cloud-enabled SD-WAN architecture, the on-site SD-WAN box connects to a virtual cloud
gateway over the internet, which result in the overall improvement in the performance of cloud-
native applications

 Cloud-Enabled with Backbone SD-WANs

This approach offers organizations with an extra backup by connecting the network with a
nearest point of presence (PoP), where your traffic is redirected onto provider’s backbone. This
extra link guarantees those real-time and latency-sensitive apps reduced levels of latency, packet
loose and jitter.
1.4 SD-WAN Deployment scenario

 SD-WAN service tunnelled over Multiple ISPs

In this Scenario, ISPs can be a broadband service using DSL or Cable Internet or a Dedicated
Internet Access or a mix of all three. SD-WAN provides WAN redundancy and increase the
bandwidth by the activation of idle backup circuit.

 Direct Internet access for cloud-based app access and MPLS WANs

The SD-WAN solution provides direct Internet access (DIA) and application visibility, branch access
to cloud does not need to traverse to headquarter, which eliminate the backhaul and improve the
user experience on cloud-native apps. In addition to this, application steering on SD-WAN enables
those business critical applications traverse through MPLS with a less latency, packet loss and
jitter; None critical applications traverse through IPsec VPN or Internet.
1.5 Comparison of SD-WAN architecture and Legacy WAN architecture

Legacy WAN solution model, commonly considered as a single hub and spoke model. In this traditional
WAN design, branch traffic may traverse to headquarter for management or security purpose, as a result,
the user experience on cloud-native apps will degrade dramatically.

Difference between MPLS and SD-WAN

MPLS SD-WAN
Full Form Multiprotocol Label Switching Software Defined – Wide Area
Network
Provisioning High Very Low
time
Configuration Manual Configuration Zero Touch Provisioning
Management Decentralized control over Centralized control of devices
variety of devices
Cost Impact High Low
Security Good Very High
Application Low application visibility Deep application visibility
Level
Visibility
Bandwidth Time consuming Immediate
Scaling
Packet Traditional routing Application steering
Forwarding
Geographical Limited to reach of provider Much wider spread and highly
Reach MPLS Cloud scalable than MPLS

1.6 SD-WAN Security

As the traffic between branch and headquarter are transmitted across public Internet, SD-WAN has
introduced IPsec, next-generation firewalls, and micro-segmentation of application traffic to ensure the
protection of user traffic from internet threats.

1.6.1 Visibility
Visibility is the one of the most significant features that SD-WAN provides, which enables IT operators
to set up a set of policies based on each application.

1.6.2 IPsec VPNs

IPsec-based VPNs provides secure connections and ensures data integrity for organizations by
encrypting traffic.
1.6.3 SSL inspection
The hidden malware in the encrypted traffic can pose a potential threat to organizations. Take SSL
inspection as part of SD-WAN solution is effective approach to discover and eliminate this type of
attack.

1.6.4 NGFW protection for SD-WAN

 Use in-built NGFW

The use of in-built next-generation firewall (NGFW) ensures consistent monitoring and protection
throughout the network, in the meanwhile, this architecture simplifies the network deployment and
day-to-day manager work

 Integrate NGFW with existing architecture

The deployment of NGFW at branches as well as headquarters can contribute to the improvement
of security for a SD-WAN network. NGFW provides organizations with the ability to defence known
and unknown threats through application awareness, next-generation instruction detection and
prevention, Web filtering, malware detection, antivirus, sandbox. The cloud-base deployment is
increasingly taken into consideration by organization.

1.7 SDN vs SD-WAN

SND and SD-WAN today are changing the traditional network architecture. These two latest
technologies are quite similar on some of aspects, in terms of decoupling network control and forwarding
functions, which makes it possible for customer to directly program the network control.

SDN SD-WAN
Abbreviation for Software-Defined Networking Software-Defined Wide Area Network
Target Area LAN or Data Centre Software-Defined routing over WAN
Programming Configuration and management Configuration and management are
are performed by customer itself performed by Service provider
Chronology Was developed first and is Based on SND technology
foundation for SD-WAN
Key Vendors  Open Daylight  Silver peak
 VMware  Cisco
 Juniper  Fortinet
 Context ream  Citrix
 Big Switch Networks  Fat Pipe
 Cyan  GloudGenix
 Alcatel-Lucent/Nokia  Riverbed
 Cisco  Talari
1.8 Design Consideration for recommended SD-WAN solution

1.8.1 Save money

Many organizations need a high bandwidth connection between headquarter and branch for
business data transmission. The deployment of the SD-WAN is flexibly based on DSL, cable,
Ethernet, wireless and other means of internet links.

1.8.2 Improving reliability

SD-WAN provides traffic control and application steering, so the organizations can have the
diversity of WAN connection to enhance the reliability to branches by contracting with various IPS.

1.8.3 Traffic identification and prioritization

The hub-and-spoke WAN architecture brings backhaul issue when accessing to a central data
centre or headquarter. Many organizations are adopting direct point-to-point connection between
branch and the direct Internet access to cloud or SaaS applications. SD-WAN can ensure business
critical applications by user-driven policies

1.8.4 Fast deployment

Zero touch provisioning provides organizations with plug-and-play to set up branches. The SD-
WAN hardware appliance is typically shipped to the branch, plugged into AC power and WAN
connections, and then remotely configured through cloud.

1.8.5 Multi-cloud access

Many organizations have a mix of internal data centres, application in public clouds and SaaS
application access needs. SD-WAN solutions can accelerate traffic to cloud by providing a nearest
point of presence (PoP).

1.8.6 Management, automation and network orchestration (MANO)

There are two options for most SD-WAN solutions to set up the management, orchestration and
automation, on-premises or cloud-based.

1.9 SOFTWARE-DEFINED ACCESS (SD-ACCESS)

Software-defined access is an intent-based networking solution for the Enterprise to address the
operational challenges that many organizations today are experiencing. This agile infrastructure
represents a fundamental shift in network design, build and management, and enables organizations
to reduce Operating Expenditures.

The benefits of SD-Access.

 Consistent management of wired and wireless network provisioning and policy.

 Automated network segmentation and group-based policy.
 Contextual insights for fast issue resolution and capacity planning.
 Open and programmable interfaces for integration with third-party solutions.

1.9.1 SD-WAN vs SD-Access

SD-WAN and SD-Access are both the ways to approach SDN terminology. SD-WAN is designed for
WAN architecture whereas SD-Access is for address traditional LAN architecture issues.

SDN-WAN SD-Access
Abbreviation for Software-Defined Wide Area Software-Defined Access
Network
Target Area Software-Defined routing over LAN
WAN
Programming Configuration and management Configuration and management are
are performed by Service performed by customer itself
provider
Chronology Based on SND technology Based on SND technology
Key Vendors  Silver peak  Cisco
 Cisco
 Fortinet
 Citrix
 Fat Pipe
 Cyan
 Alcatel-Lucent/Nokia
 Cisco