Software-Defined WAN (SD-WAN)

Another technology that we can implement to help manage our network and also implement security is a software-defined wide area network, or SD-WAN.

What SD-WAN is

SD-WAN is a type of software-defined networking. Software-defined networking just means that we're setting up networking using software. The same thing applies when it comes to WAN technologies, but we call it an SD-WAN.

Many times when we're architecting things like routers, we're setting up a data plane and a control plane. The data plane is what the data moves along, and the control plane is what manages and controls where that data is supposed to go and where it's going to be sent to. We can think of this as, the data plane is going to be the construction worker that's on the site, and then the control plane is going to be the management of the company or the foreman on site.

When it comes to software-defined networking, what we're essentially doing is breaking apart this control layer. We're still using the routers for the data processing - we can't really get away from that - and so this is the data plane down here. But as far as the control plane, rather than having a separate control plane on each one of these routers, we're breaking it apart and controlling it separately with a separate piece of software.

What this looks like in practice is that we install software on each one of these routers, and what this does is it extends that control plane into a separate control center here. Then we use this control center in order to control what's happening on a very upper level here. So then we can control all of these routers through a central control spot.

Here we have a bunch of different routers. Normally we'd set these routers up and we'd have the data plane and control plane just exist on the routers themselves, but then what we have to do is configure each one of those routers and set them up all manually. But what we do with SD-WAN is install a separate piece of software that controls that control plane, and now we can manage all that from a central location. This makes it much more scalable and easier to manage.

I like to think of traditional WANs as, we'd have to go on each one of these routers and interconnect them. How do we want them to interconnect and connect together? This ends up being a lot of configuration. So instead, what we do is we create more of a cloud type of setting here where we install software on these devices. We control that software, and essentially what we do is we tell this controlling software how we want this communication to happen, where we want this communication to happen, what kind of flow we want to have happen, and then it does the figuring for us. You can imagine this is really scalable. Rather than making all of these individual connections, it will establish all those connections based off of what we program here, making it much more dynamic, scalable and easier to manage.

A traditional WAN, in practice

Here's a traditional wide area network. With this wide area network, what we do is we configure each of these routers, and maybe we set up some sort of routing protocol here, like maybe OSPF, so that way communication can happen and different networks can get passed along. Then we have a bunch of sites, so we connect these sites into these routers so that way they can be interconnected. We have some factories here, we've got some very tall buildings here, we've got some satellite campuses, and we want them all interconnected, so we connect them into our WAN right here, our wide area network.

But essentially what we're having to do is a lot of configuration on these individual routers. If we wanted to set something up like ACLs to control the traffic flow, then we visit each one of those routers and we do configurations on each one of those routers. SD-WAN replaces a lot of that manual labor. Instead, once again, we install the software and control it from a central location.

Example: VPNs between sites

Let's look at VPN as an example. We have a bunch of sites here - in fact, in total we have 14 sites here if we were to count all of these different sites up. Let's say we wanted to create a VPN between each one of these sites. What we'd have to do is configure both sides of those sites in order to establish that communication.

How many connections would we have to establish? We have a factory right here. It needs to connect to 13 other sites, so now we need to configure 13 different links, different VPN connections. Then we have this site right here and it needs to connect - it's already connected to this one, but it needs to connect to all the others, so there's another 12 connections. And then what we have right here is another site. It's already connected to two of the sites, but we need to connect it to another, so that's 11 sites. Then we keep doing this. If we follow this, it's going to be 13 + 12 + 11 + 10 + 9 + 8 and so on and so forth all the way down to one. What we end up with, if we equate this all out and follow it all the way through, is 260 VPN connections that we need to create. And that's crazy, that's a ton of connections.

But what we can do instead is set this up within our SD-WAN software, that we want to establish these connections, and then it would automatically figure out where these VPNs need to go and set those VPN connections up.

Example: access control lists

Let's look at an access control list as an example. I have a site right here that's connected into this router. We have to configure all of the ACLs on this router. Let's say I do some sort of configuration changes and I move it to another site, or maybe it's connected to both. Now I need to change the ACLs on both of these sites, and so there's some management of ACLs that needs to happen here. If I were to do this on traditional networks, I'd have to visit each one of those routers to set that up. But instead, with SD-WAN, I program what it is that I'm trying to achieve and what type of security I'm trying to implement, and then it figures out those ACLs and puts them in the proper location. So that would be another example of SD-WAN and how we can configure this in a very scalable way.

Connection independence

What's available at each one of these sites could be different technologies. For instance, maybe I have MLS available at one site here in the connection but not another site, so I have to use some sort of other connectivity here. What I end up with is all of these from a layer 2 perspective - all these connections here can be different. This can make it difficult to manage. So we're not doing away with the different types of connections, but having SD-WAN makes it so that it's connection independent. What that means is that it can be programmed and set up to go across any of these lines, and we can manage these things as a whole network rather than managing them on an individual link basis. We can do all that through this SD-WAN technology.

Let's look at another example here. Let's say we have our routers and they're connected into the internet, so they're all interconnected via the internet, and not only once, but maybe we have multiple connections to the internet. Maybe this is one ISP here and this is another ISP here, and so maybe we're using three different ISPs. Maybe on this site we're using both cellular and we're using a cable modem, and on this site right here maybe it's going to be a fiber connection and some sort of other type of connection. Anyway, we have lots of connections, and we want to make this so that way if one of the connections fails, then the other ones pick up, and maybe some of them don't perform as well and others do, or whatever the case may be.

One thing that some of this software-defined WAN can do is start testing those lines and figuring out what is your best connection, and then utilize that connection, and then you can even do some load balancing across these connections. So here again, just adding to a very fluid network, a network that can really kind of self-heal and merge things together and adjust and adapt. It is very adaptable and very changeable when you have this software-defined WAN.

Benefits

The benefits of SD-WAN are that it's scalable, it's flexible, it can increase performance, and it makes it very manageable. It can reduce cost, depending on how big of a network you're talking about, and it just makes it a lot easier to manage. And then it can also improve security.