Who Has the Best WAN Solution?

Today's WANs are complex to operate and are both time consuming and cumbersome to augment. With our SD-WAN solution Virtualized Network Services (VNS) we set out to completely change the way businesses deploy and manage their wide area environment.

Before I run through some of the key features of VNS I’d like to highlight four of the key pain points with todays WAN environments we identified.

• Maintaining a real time view of the running configuration, routes used, addresses/subnets/VLAN tags consumed and the firewall/ACL rules deployed; think about the many Excel spreadsheets the network team maintains…

• The management and monitoring of the ACL’s and firewalls at the branches, HQ and data centers and the care and feeding of the mix of in-router features and dedicated appliances that protect the business traffic and enforce security framework.

• The cyclic pressure to rip and replace the existing branch hardware when bandwidth is increased or new features are deployed.

• The day-to-day pressures to squeeze every last drop of the scarce bandwidth resources and deliver a consistent network experience to an ever changing IT application environment.

To address these issues we based VNS on a three tier SDN based solution set. There is a central policy manager where we store templates and policies for the network, a set of SDN controllers that manage the control plane of the WAN, and lastly the branch software that performs the data plane functions issued by the SDN controllers.

This solution architecture then addresses the pain points from above by:

• Site additions are automated by VNS via its centralized policy manager. All you do to set up a new site is to complete some basic information on the location and branch type, select the functionality to be deployed from your template of networking and security polices and ship the branch hardware to the site. As the information is stored centrally the network team has full visibility in to the running configuration (routing topology, L2 and L3 addresses in use and the security policies deployed).

• VNS provides a different model that increases the micro-segmentation of the security within and across the whole WAN environment. With its comprehensive policy framework, data and location security are centrally controlled and pushed to the branch as a core function of the WAN service. If sites require encryption, you simply enable it on the VNS policy manager and instantly the traffic to and from the site is encrypted. The same applies to firewall rules; if a new rule is required due to business policy change or a new application rollout, via the central manager you select the new rule, the sites to deploy and push the button.

• The branch hardware used with VNS is based on open compute. That’s the same x86 architectures you use in your data centers today, and you know the investment advantage you got from moving to open compute there. With VNS we bring the same investment flexibility to the branch. Since its based on standard off the shelf hardware you have the choice, use Nuage Networks branch hardware or deploy the software at the branch on any suitable x86 based compute you have on hand.

• With VNS you get the choice to augment that bandwidth with any connectivity available at the location. With our intelligent traffic steering you can set the branch (via our centralized policy manager) to send your business critical traffic via your premium circuit and to securely offload the more bursty non-critical traffic to another link including the Internet or even mobile broadband. Another area where VNS can utilize alternative bandwidth options at the branch is to improve the availability of your branches. As VNS can utilize any available access technology you can augment your primary branch connection with alternatives. In the event of a failure of the primary connection VNS will automatically invoke the backup circuit and reroute your branch back into the corporate network.

This is a limited view of the complete feature set of VNS but we think that resolving the key pain points of today's WAN including; adding sites, maintaining real-time documentation, enforcing security, and opening up alternative bandwidth options goes a long way to changing the way WAN’s are deployed and managed.

Viptela's SD-WAN solution is used by Mid to Large Enterprises and Global Top-10 Service Providers. The important features are:

1. The ability to build Unified Hybrid WAN over MPLS, Broadband and 4G/LTE, so all WAN infrastructure can be consolidated and managed using one centralized controller


2. A secure, encrypted fabric with Zero-trust Authentication so there is a consistently high security framework irrespective of whether its a public or private network


3. End-to-end network-segmentation with discreet topologies per segment. So enterprises can be different logical topologies per requirement, e.g.: full-mesh for video collaboration and voice, Regional exit for Guest WiFI, Hub-and-spoke for PCI or Financial transactions etc.


4. Real-time WAN Path Control for Application SLA, so important applications like PCI, Voice, ERP etc. will always be steered on high-quality links based on real-time brownouts or blackouts.


5. Centralized administration, visibility and troubleshooting with zero-touch, automated provisioning, so Operations is greatly simplified and there is consistent policy across all WAN types.

Cisco’s Intelligent WAN (IWAN) solution is designed to deliver an uncompromised user experience over any connection. IWAN is managed by a centralized controller APIC-EM (Application Policy Infrastructure Controller with Enterprise Module) which provides centralized automation and orchestration of your WAN using the following key features:

1. Transport independence allows provider flexibility and distribution of branch-office traffic over multiple transport options to lower costs.
2. Intelligent path control maximizes WAN usage based on policy and real-time path status and improves network availability.
3. Application optimization gives IT full visibility and control of network traffic, tunes the network for business-critical services, and quickly resolves network problems.
4. Secure connectivity enables IT to simplify VPN connections across all sites to deliver high performance with high security. It can also enable direct Internet access for better SaaS application performance, while protecting all branch-office endpoints and maintaining a centralized infosec policy management paradigm.

These key features help organizations optimize their WAN investments with consistency as the volume of content and applications traveling across networks grows exponentially. All of this is done without compromising performance, reliability, or security, while freeing up resources for new and innovative business services.

To learn more about Cisco IWAN, go to www.cisco.com/go/iwan.

Thanks for your comment.

I have to admit that I normally work in countries where the cost of Internet is much less than the cost of MPLS. Would you kindly educate me relative to a few countries in which the cost of Internet is much more than the cost of MPLS?

Also, can you help me understand what coordination has to occur, both technically and commercially, with the relevant service providers if an enterprise wants to implement a SD-WAN that is above and beyond the coordination that has to occur if the enterprise wants to use MPLS and the Internet in a more traditional fashion?