Unlocking the Power of SD-WAN and SASE

16 April 2024

Software-defined networking, known as SDN, is a familiar buzzword among professionals in today's world.SD-WAN entails the application of Software-Defined Networking (SDN) principles within Wide Area Network (WAN) solutions with a variety of vendors adopting it as part of their product offerings.  This article  will provide an overview of its advantages, use cases, and how the evolution to SASE will help to secure end-to-end access to resources both on-premises and in the cloud.

SD-WAN, or Software-Defined Wide Area Network, is a modern networking approach that enhances the performance, agility, and security of wide area networks (WANs ). Unlike traditional WAN architectures that rely heavily on hardware-based infrastructure and manual configuration, SD-WAN decouples networking hardware from the control plane.  It enables centralised management and dynamic optimisation of network traffic. Imagine having multiple carrier networks for branches, data centres, or headquarters, managing and maintaining these networks and the routing between them.  In addition to it, the security concerns and the management of various connectivity types (MPLS, VPLS, LTE, Internet, etc.) can be labour-intensive. SD-WAN, however, can provide a single point of configuration, management, and visibility for the whole network from pure connectivity to application performance and consequently reduce the Capex and Opex costs.

Adopting SD-WAN in networks brings numerous benefits such as:

• Leveraging all available connectivity types: Balancing traffic across all available circuit types (MPLS, Internet, LTE etc) on a per-flow or packet basis allows the utilisation of even redundant links.  This creates an active-active network that boosts bandwidth and fully utilises available capacity.
• App-aware routing capabilities: Allows load balancing of applications onto preferred links. For instance, voice and video applications on highly reliable MPLS circuits and system backups or batch jobs over internet links.
• Regional-specific routing topologies: Voice should use a full mesh design, while systems hosted from the data centre would require a hub-and-spoke design. Each application can have its unique topology, and this can be dynamically managed by an SD-WAN control plane.
• Centralised device management & policy administration: A central orchestrator provisions and pushes policies down to the data plane simplifying management and increasing scale. Templates and automation enable rapid branch deployments, security updates, and other policy changes besides zero-touch provisioning.
• High availability with automatic failovers: Devices with multiple connections or those deployed in high availability setups can self-heal from circuit impairment/loss or indeed hardware failure with no loss of state.  This means that users may not even be aware that a failure event occurred.
• Encryption on all transports, irrespective of link type: Traffic over MPLS, LTE, or the Internet is automatically encrypted without the complexity of IPsec configuration.

Using different SaaS services, a variety of carrier networks, and striving for cost reductions in our WAN solutions has led to SD-WAN as a solution.  There is however a key requirement missing, and that is security. The complexity of modern networks is growing due to multiple cloud service providers, remote work, and the rise of BYOD. Achieving a seamless, end-to-end secure solution for network management and maintenance seems increasingly challenging. 

Separately, SSE (Security Service Edge) has been created to support on-premises and cloud systems and users (wherever they are located), through cloud network security services such as secure web gateway (SWG), cloud access security broker (CASB), firewall as a service (FWaaS) and zero trust network access (ZTNA). 

By converging SD-WAN solutions with security capabilities from SSE, we arrive at Secure Access Service Edge (SASE) representing a transformative approach to networking and security in a cloud-native architecture.

In considering the benefits of SASE, one can appreciate its ability to offer a comprehensive solution that addresses various challenges of modern networking, including:

• Streamlined Security: SASE offers a complete security solution stack on top of the network layer (SD-WAN) into a single platform, therefore simplifying the management and reducing multi-point solutions.
• Reduced Cost: With centralised security and networking functions unified into a single platform, leads to cost savings by reducing the need for any additional hardware/licenses therefore showing a reduction in both CAPEX and OPEX cost.
• Scalability: Highly scalability solution to accommodate the changing demands of an organisation.
• Flexible access: With SASE, network resources can be accessed securely from anywhere and at any time, enabling a more flexible workforce.