The Path to SDN Begins with SD-WAN
So you want to get started with SDN but want a low-risk, incremental approach. Starting with SD-WAN may be the path to take.
SD-WAN is like a smart WAN accelerator. It features centralized control of WAN traffic flows over multiple network paths, including MPLS, Internet VPN, and cellular data services like LTE (see the image below). The SD-WAN controller makes the multiple links look like one logical link, much like Ethernet Link Aggregation that we've used for years. The more expensive links, like LTE, could be reserved for those times when the primary MPLS and Internet VPN circuits are down. The SD-WAN controllers also incorporate WAN optimization functionality to maximize the efficiency of each path.
How It Works
The SD-WAN controller decides which physical path each packet should take, based on user-defined policy as well as measurement of latency, jitter, and packet loss over each of the paths. There are two ways that SD-WAN controllers measure path characteristics. The first is to add an encapsulating header to the normal network traffic that transits each of the links. The added header includes sequence numbers and time stamps that allow the receiving SD-WAN controller to determine the latency, jitter, and packet loss of that path. The second measurement mechanism is to send synthetic traffic that contains sequence numbers and time stamps that allow the same measurement of packet loss, latency, and jitter. Both mechanisms use network bandwidth. The second method doesn't depend on normal traffic flows in order to perform measurements. Smart SD-WAN controllers will use a combination of the two mechanisms to avoid a dependency on normal network traffic.
The SD-WAN administrators configure policies that group network traffic into different classes and identify the path characteristics that are preferred for each traffic class. For example, UC&C traffic would be identified by a small fixed UDP packet size, potentially using well-known UDP ports. The path selection policy could be designed to prefer paths with low jitter as the primary criteria, then low latency, and finally low packet loss. This policy might cause packets to take the MPLS path. Another policy could be created for important business applications, selecting low latency and low packet loss paths. Less important traffic could be relegated to another policy that uses the Internet VPN path.
Most SD-WAN controllers can handle more than the three circuits seen in the above image. Important branch sites could have multiple Internet VPN connections via different carriers to provide a high level of resilience against problems with a single carrier. Backup paths via LTE virtually guarantee that service to a branch cannot be interrupted.
This sounds good, but what about having another set of appliances to manage? And isn't creating these policies and applying them like creating and deploying a consistent QoS policy? Fortunately, the SD-WAN vendors are working hard to make their products easy to manage, especially for organizations that have hundreds of remote sites. The SD-WAN controllers communicate with a centralized control system that handles all the work of propagating the policies to the appliances (an appliance is typically physical but may be a virtual instance that runs on a compute blade in a branch router). Some vendors use a cloud system for this orchestration function while other vendors have an on-premises solution.What Are the Benefits?
SD-WAN allows you to incrementally transition to an SDN-style network for the WAN, while simultaneously performing WAN optimization. The centralized control of equipment at many remote branches allows the network staff to learn network automation basics and become comfortable using it. By starting with SD-WAN, you can begin to change your processes and procedures in ways that are applicable to SDN on the rest of the network.
Traffic to cloud providers can take a VPN over the Internet directly to the provider instead of routing over an expensive MPLS network to the home office to get to the Internet. The centralized control makes it easier to manage, increases agility, and automatically adapts to changes in business because it is based on policy, not hard-coded packet-processing rules.
Multiple paths and policies for selecting them create a highly resilient system. Any single path can go down and the applications continue to work, perhaps at a reduced performance level. The centralized management system automatically detects when a single link has failed and will notify you of the problem.
Watch out for TCP and out-of-sequence packets. Make sure the SD-WAN controller reassembles TCP data streams in the proper order. When TCP receives packets out of order, it triggers resending ACKs, which in turn causes the sender to resend packets that are in flight. The effect is to send packets twice, which reduces the effective network bandwidth. In the worst case, every packet gets sent twice, which effectively halves the bandwidth of the path.
You get to use all the bandwidth that you purchased. Traditionally, organizations would purchase a primary and a backup circuit for each remote branch. The routing was setup such that the backup circuit wasn't used until a failure occurred.
In a Talari whitepaper "Eight Questions You Must Ask When Considering an SD-WAN," David Rahbany, Director of IT Infrastructure at The Hain Celestial Group, said "For many of our WAN connections where we had redundancy, we were paying for bandwidth we weren't using."
But if you're buying just bandwidth, you should understand how well the network will function when a link goes down. Let's say that the Internet connection at an important branch goes down while your MPS VPN links continue to work. Your Internet traffic now has to traverse the MPLS VPN to the datacenter, where it can then reach the Internet. You need to have an infrastructure that will correctly prioritize the different types of traffic. Since some business-critical traffic is destined to cloud-based SaaS providers, your SD-WAN system will need to handle it.
Multiple links from a variety of sources (MPLS VPN, Internet VPN, LTE) greatly increases network resilience. If one link fails or must be taken out for maintenance, the remaining links can carry the traffic, albeit at a potentially reduced bandwidth.Getting Started
There are many SD-WAN vendors, so getting started can be daunting. Fortunately, getting information is easy. Begin by researching the technology and understanding the features offered by each vendor. Determine which features are important to your organization. Then you can start with one link to see how well your chosen solution works, and expand the system as needed (and as you can afford). Learn how to use the centralized management system to create policies and push them to all the systems. Then begin updating your procedures to incorporate the new automation practices. You'll then be on your way to handling the world of software-defined networking.