Why SD-WAN Is Taking Over Enterprise Networks?
One of the fastest-growing enterprise networking technologies, SD-WAN can simplify network management and optimize connections to cloud services.
Leased-line and MPLS connectivity can serve your head office well, but for small branch offices and remote workers using SaaS applications, the public internet is often the only option. They could be customer service agents working from home, first responders on scene, or travelling executives all using latency-sensitive voice and video services – something traditional enterprise WANs struggle to support.
The promise of SD-WAN is “more agile, dynamic, and cheaper branch-office connectivity without losing the quality of service,” Ovum distinguished analyst Roy Illsley explained to Data Center Knowledge. But to date, the main business driver for SD-WAN adoption has been the opportunity to save money on access costs.
Broadband services have become more reliable with new fiber laid in the ground, and 5G promises more mobile bandwidth that is also more reliable. “These become serious, cost-effective alternatives to expensive MPLS links,” he said. SD-WAN isn’t going to replace MPLS in the immediate future, but routing what you can over the public internet frees up those expensive circuits for the enterprise’s most critical traffic.
“The transition is from private leased lines and MPLS to some flavor of broadband internet, either in a hybrid fashion or eventually all internet,” Atchison Frazer, head of worldwide marketing at Versa Networks, told us.
It’s not just that broadband connections are cheaper than MPLS circuits; it’s also the ancillary costs. “To accommodate MPLS I have to deploy five different very expensive hardware devices from different vendors that don’t integrate,” Frazer said.
SD-WAN replaces a big integration project with greater network control and flexibility. Ovum’s Illsley explained: “Where previously MPLS was the corporate WAN, and so by necessity all WAN traffic traversed it, SD-WAN enables the enterprise to determine which types of traffic should have priority and when: payroll traffic should be prioritized in the runup to payday, for instance, or a department store's toy section might need more guaranteed bandwidth before Christmas than after it. Priorities can be ratcheted up and down according to such constraints, with traffic routing made to reflect such ad hoc changes.”
That flexibility is what Versa customers are looking for, Frazer said. “Almost everyone we work with tells us ‘we moved from the aggregation of links to cost arbitrage, from MPLS to broadband,’ and that was phase one. Now we're at ‘I need SaaS acceleration, I need to move my data centers, I need to move my apps across, I need to accommodate mobile users.’ They want to extend their SD-WAN fabric to the cloud. The legacy WAN was never designed for that.”
Unusually, Versa’s SD-WAN is software that can run on a variety of hardware or in the cloud. (“We can be deployed on white box, grey box, bare metal, you name it.”) It’s also available through managed service providers who can set policies and offer SLAs.
Versa’s software can replace multiple pieces of network infrastructure, such as wireless access points, firewalls, routers, and so on.
Policy and SLAs promise redundancy and resiliency, even for challenging network workloads like voice and video for geographically dispersed locations: “We can replicate packets, we can do forwarding, we can establish fast-failover high-availability at every single branch, so the likelihood of a brownout of your voice is significantly minimised. Now, you've got an SLA on every user, every app that user uses and every WAN link with their enterprise apps. And it can all be changed on the fly by adjusting a policy. You can set up a policy that looks at bit rates across a WAN link, so you deliver the app to the user close to where the user actually is.” That will be increasingly important as edge and 5G networks arrive.
More Security in SD-WAN, Not Less
In the recent market trends survey, IDG conducted for Masergy improving network security was also a high priority for enterprises moving to SD-WAN.
Regulated organizations, such as ones in the financial services, are moving to SD-WAN so they can use traffic routing and segmentation. Separating the traffic that contains sensitive customer data and PII from routine traffic helps with PCI compliance.
With most SD-WAN solutions that means partnerships and integrations. “Most of what we call the traditional SD-WAN vendors – those who came into existence to deliver SD-WAN functionality in its own right – tend to partner with security specialists, even if many of their customer premises equipment (CPE) devices come with some basic firewalling capabilities,” Illsley explained. “Similarly, the WAN optimization vendors that have moved into SD-WAN do not count security among their core competencies and so partner with security specialists.”
Versa is the exception, he said, a “traditional” vendor that has built security into its infrastructure and will be offering WAN optimization this year.
That’s interesting because SD-WAN also means a major shift in how you handle network security, especially for branch offices. “In a traditional WAN based on MPLS links a branch office's entire data traffic, including their internet access, is routed through the head office in a hub-and-spoke connectivity model. While this can have implications for the user experience in the branch (in that it may result in increased latency on the internet connection), it has distinct advantages in terms of security, because head office can see and impose security controls on all traffic to and from the internet for the branches as well as for HQ,” Illsley said.
Backhauling all that traffic to the data center is highly inefficient, Frazer claimed, and it just doesn’t work when it comes to supporting remote employees.
Plus, the extra information available through the SD-WAN environment gives you extra visibility, meaning that the switch to using broadband connections can help you improve security. “You can make a better risk assessment using SD-WAN because we can tell you what bandwidth capacity apps are using as well as what apps users are using at what time of day.” As machine learning-based security tools become more common, having that kind of detailed baseline for normal network behavior will be key to spotting attacks as soon as they start.
Industry: Telecommunications / Data Center / Data Centre
- SOC Manager. SC Clearance. Immediate opportunity.
Permanent SOC Manager. SC cleared / clearable, London / Birmingham. SOC Manager needed to replace a SOC contractor I placed into a client who is due to complete their assignment at the end of March. The ability to achieve SC clearance is essential. Looking for someone that is a blend of strategic stakeholder engagement with strong technical skills. The role will sit in a relatively new SOC environment. The position is to setup, implementation and management of resources to help with the initial and on-going stages of a new SOC. Experience engaging with and managing client stakeholder relationships as well as 3rd party relationships is critical. The role will involve; setting up, implementing and fine tuning the various initial stages of a SOC environment. Experience establishing and building out technical process / operational capability, managing of technical teams (analysts, engineers and architects, creation of policy / playbooks, fine turning is key. SPLUNK is the tooling of choice… Interviewing immediately. Set up a call with me today on https://calendly.com/chris-holt/arranged-call-with-chris-holt-soc-manager-role Direct contact details Chris.Holt@dclsearch.com or 07884666351
- Security engineer. Financial Services. UK. Permanent
CH7863 Security engineer. End User . Financial Services Security Engineer needed to monitor and manage a security suite of tools within an End User environment. The Security Engiener will be responsible monitoring, configuring, fine tuning, incident management and generally improving the security tool capability. Specific experience with CyberArk, Tripwire Log Center and Tripwire Enterprise is highly desirable). Current experience with Vulnerability management and penetration testing is highly desirable. Specifically the ability to effectively manage 3rd party pen tests. You will be working within a specialist security team reporting to the CISO. Experience working within an end user environment within financial services is highly desirable. Flexible location. This is an exclusive role to DCL Search & Selection. To book a call please use my Calendy link https://calendly.com/chris-holt/arranged-call-with-chris-holt-soc-role-
- DevSecOps - Security design / review consultant. SC Clearance. London
CH7858 London £70,000 DevSecOps - Security design / review consultant. DevSecOps - Security design / review consultant will ensure that newly created, public facing apps are secure by design and by default by aligning them to current / best practice security policies and standards into the design phases. The individual must have a technical software / application development background with specalist experinece in secure architecture design. (Frameworks, processes, best practice etc) Practical experience translating and ensuring that the OWASP top 10, ISO27001, HMG frameworks requirements are reviewed and embedded into project designs which are implemented is essential. Experience working projects through a full development lifecycle is key. You will work along side the design and project teams to idenitfy and mitigate risks throughout the design phases. This is a permanent role. SC clearance is essential as is the ability to get to the London office. (When appropiate #covid) Security DevSecOps consultant. To arrange a discreet call book via https://calendly.com/chris-holt/devsecopp--security-design-review-consultant
- CONTRACTOR Cyber Vulnerability Analyst, NESSUS, Rapid 7, SC clearance required.
Cyber Vulnerability analyst NESSUS, Rapid 7, needed for IMMEDIATE 3 month contract MUST have / be able to achieve UK SC clearance role to work within a live environment within a public sector department. The individual must have experience in using various security methods and tools such as Rapid7 and NESSUS scan for / identify vulnerabilities, prioritise them according to risk and raise appropriate tickets for remediation / follow up. In depth experience utilising Nessus highly beneficial. Current cyber public sector experience highly desirable.