As cloud-based application adoption continues to accelerate, geographically distributed enterprises increasingly view the wide area network (WAN) as critical to connecting users to applications.
As enterprise applications migrate from the corporate data center to the cloud, private line connections such as multi-protocol label switching (MPLS) have proven to be overly rigid and expensive. With greater reliance on the internet, the opportunity to achieve “cloud speed” is better served by integrating broadband services into the WAN transport mix.
The Silver Peak Unity EdgeConnect™ SD-WAN edge platform enables enterprises to dramatically reduce the cost and complexity of building a WAN by leveraging broadband to connect users to applications. By empowering customers to use broadband connections to augment or replace their current MPLS networks, Silver Peak improves customer responsiveness, increases application performance, and significantly reduces capital and operational expenses by up to 90%.
Unity EdgeConnect Solution
Three components comprise the Unity EdgeConnect SD-WAN solution:
- Unity EdgeConnect physical or virtual appliances (supporting any common hypervisors and public clouds) deployed in branch offices to create a secure, virtual network overlay. This enables customers to move to a broadband WAN at their own pace, whether site-by-site, or via a hybrid WAN approach that leverages MPLS and broadband internet connectivity.
- Unity Orchestrator™, included with the EdgeConnect solution, provides unprecedented levels of visibility into both legacy and cloud applications with the unique ability to centrally assign policies based on business intent to secure and control all WAN traffic. Policy automation speeds and simplifies the deployment of multiple branch offices and enables consistent policies across applications.
- Unity Boost™ WAN Optimization is an optional WAN optimization performance pack that combines Silver Peak WAN optimization technologies with EdgeConnect to create a single, unified WAN edge platform. Boost allows companies to accelerate performance of latency-sensitive applications and minimize transmission of repetitive data across the WAN in a single, fully integrated SD-WAN solution.
EdgeConnect Key Features
- Zero-Touch Provisioning: A plug-and-play deployment model enables Unity EdgeConnect to be deployed at a branch office in seconds, automatically connecting with other Silver Peak instances in the data center, other branches, or in cloud Infrastructure as a Service (IaaS) such as Amazon Web Services, Microsoft Azure, Oracle Cloud Infrastructure and Google Cloud Platform.
- Virtual WAN Overlays: The EdgeConnect SD-WAN edge platform is built upon an application-specific virtual WAN overlay model. Multiple overlays may be defined to abstract the underlying physical transport services from the virtual overlays, each supporting different QoS, transport, and failover characteristics. Applications are mapped to different overlays based upon business intent. Virtual WAN overlays may also be deployed to extend micro-segmentation of specific application traffic from the data center across the WAN to help maintain security compliance mandates.
- Tunnel Bonding: Configured from two or more physical WAN transport services, bonded tunnels form a single logical overlay connection, aggregating the performance of all underlying links. If a link fails, the remaining transport links continue to carry all traffic avoiding application interruption. Network traffic traversing an EdgeConnect SD-WAN can be tuned for availability, quality, throughput and efficiency. This is accomplished on a per-application basis through the use of Business Intent Overlays. Multiple business intent policies can be created, each with its own specific bonding policy. As part of this policy definition, the service provider customers have the ability to customize the link prioritization and traffic steering policies based on multiple criteria, including physical performance characteristics, link economics, link resiliency characteristics and customer-definable attributes.
- Dynamic Path Control (DPC): Real-time traf- fic steering is applied over any broadband or MPLS link, or any combination of links based on company-defined policies based upon business intent. In the event of an outage or brownout, EdgeConnect automatically continues to carry traffic on the remaining links or switches over to a secondary connection.
- WAN Hardening: EachWANoverlayissecured edge-to-edge via 256-bit AES encrypted tunnels. No unauthorized outside traffic can enter the branch. With the option to deploy EdgeConnect directly onto the internet, WAN hardening secures branch offices without the appliance sprawl and operating costs of deploying and managing dedicated firewalls.
- Zone-based Firewall: Centrally visualize, define and orchestrate granular security policies and create secure end-to-end zones across any combination of users, application groups and virtual overlays, pushing configuration updates to sites in accordance with business intent. Using simple templates to create unique zones that enforce granular perimeter security policies across LAN-WAN-LAN and LAN-WAN-Data Center use cases.
- Path Conditioning: This feature provides private-line-like performance over the public internet. Includes techniques to overcome the adverse effects of dropped and out-of-order packets that are common with broadband internet and MPLS connections to improve application performance.
- First-packet iQ™ Application Classification: EdgeConnect First-packet iQ application classification identifies applications on the first packet to deliver trusted SaaS and web traffic directly to the Internet while directing unknown or suspicious traffic to the data center firewall or IDS/ IPS. Identifying applications on the first packet is especially important when branches are deployed behind Network Address Translation (NAT); the correct path must be selected based on the first packet to avoid session interruption.
- Local Internet Breakout: Granular, intelligent traffic steering enabled by First-packet iQ eliminates the inefficiency of backhauling all HTTP/ HTTPS traffic to the data center. The solution eliminates the potential for wasted bandwidth and performance bottlenecks for trusted SaaS and web traffic. Trusted traffic is sent directly across the Internet while unknown or suspicious traffic may be sent automatically to more robust security services in accordance with corporate security policies.
- Routing: EdgeConnect supports standard Layer 2 and Layer 3 open networking protocols such as VLAN (802.1Q), LAG (802.3ad), IPv4 and IPv6 forwarding, GRE, IPsec, VRRP, WCCP, PBR, BGP (version 4), OSPF.
- Cloud Intelligence: Real-time updates on the best performing path to reach hundreds of Software-as-a-Service (SaaS) applications, ensuring users connect to those applications in the fastest, most intelligent way available. Additionally, automated daily updates of the application IP address database to EdgeConnect appliances keep pace with SaaS and web address changes.
- Service Chaining: EdgeConnect supports simplified service chaining, using a drag-and-drop interface, to enable enterprises to automate and accelerate the integration of security partners’ advanced services like Check Point, Forcepoint, McAfee, Netskope, OPAQ, Palo Alto Networks, Symantec, Zscaler, and secure DNS (e.g. Infoblox) utilizing private secure encrypted IPsec tunnels.
- High Availability: The EdgeConnect HA cluster protects from hardware, software and transport failures. High Availability is achieved by providing fault tolerance on both the network side (WAN) and on the equipment side. The EdgeConnect appliances are inter-connected with a HA link that allows tunnels over each underlay to connect to both appliances.
Orchestrator Key Features
- Single Screen Administration: Enables quick and easy implementation of network-wide business intent policies, which eliminates complex and error-prone policy changes at every branch
- Real-Time Monitoring and Historical Reporting: Provides specific details into application, location, and network statistics, including continuous performance monitoring of loss, latency, and packet ordering for each enterprise customers’ network path. All HTTP and native application traffic are identified by name and location, and alarms and alerts allow for faster resolution of network issues
- Bandwidth Cost Savings Reports: Documents the cost savings for moving to broadband connectivity
Integration with Microsoft Azure Virtual WAN (vWAN) and AWS Transit Gateway Network Manager (TGNM)
By integrating the Microsoft Azure vWAN and AWS Transit Gateway Network Manager (TGNM) REST APIs, the Silver Peak Unity EdgeConnect platform enables customers to quickly build a cloud on-ramp and automate network deployments, removing the manual complexity of connecting branch offices to local Azure or AWS Points of Presence (PoPs).
The API integration enables EdgeConnect to identify the locations of branches in the network and determine the closest VPN Gateway (vWAN hub or headend gateway in AWS) to connect to. EdgeConnect automatically establishes standards-based IPsec tunnels and, configuring both of the tunnel endpoints for each branch to a VPN Gateway.
- > Automate branch connectivity to Azure and AWS Points of Presence (PoPs)
- > Simplify network expansion and troubleshooting
- > Faster onboarding to applications and workloads — both to and from Azure and AWS
- > Optimized routing within Azure or AWS network
- > Centralized Network Monitoring
- > Global Network Visibility
- > Cohesive policy configuration
Delivering the highest quality of experience for Microsoft O365
With the Microsoft Office 365 REST API integration, Silver Peak continuously learns and discovers new Office 365 end points and/or IP addresses and automatically re-configures EdgeConnect if a new, closer Office 365 end point becomes available. By doing so, users always achieve optimal Office 365 connectivity and performance by reducing the round-trip time (RTT). The EdgeConnect SD-WAN edge platform has been independently tested and certified to support the Microsoft Office 365 Connectivity Principles. As a result of the independent testing, the EdgeConnect platform has been inducted into the Microsoft 0ffice 365 Networking Partner Program and has been given the official “Works with Office 365” designation.
Advanced Segmentation with Virtual Routing and Forwarding (VRF)
Network managers can now configure and manage separate addressing, routing and security policies consistently with the EdgeConnect SD-WAN edge platform across end-to-end segments and microsegments for traffic traversing large-scale multinational enterprises and federations of independent companies. Advanced segmentation eliminates the arduous task of manually stitching together VRF, firewall and NAT policies in a consistent manner, dramatically simplifying the management of diverse scenarios and providing unprecedented flexibility when contending with overlapping IP address spaces.
Efficient DNS Query Resolution
A critical step in the DNS proxy is to resolve the DNS query quickly. With EdgeConnect, customers can reach DNS servers in close proximity to branch sites eliminating backhaul of the DNS request to the remote data centers where enterprise DNS servers are hosted. From the branch location itself, DNS requests can be made directly to Global DNS servers, which reduces the impact of latency in establishing a SaaS application session, thereby improving SaaS application performance.
Support for Custom User-Defined Applications
Many organizations continue to support applications customized for or internal to the company that are hosted in the corporate data center. Such custom applications are critical for the enterprise and with the EdgeConnect SD-WAN, customers can ensure optimal performance of these applications. From Orchestrator, IT can easily configure a custom application definition that enables EdgeConnect to identify it on the first packet.
Intelligent Internet Breakout
Often customers provision two or more WAN links from the remote branch site to increase network and application availability and performance. These links are used for breaking out traffic locally at each branch. Using the internet as an underlay transport is less expensive than provisioning private leased line connections like MPLS. To optimize utilization of the provisioned WAN internet links, EdgeConnect monitors the performance of all WAN links by contin- uously measuring packet loss, jitter, latency and mean opinion score (MOS) in real-time. EdgeConnect uses statistical learning to determine the optimal forward- ing link, ensuring maximum application performance.
Orchestrator Enables Faster SD-WAN Deployments
Unity Orchestrator, included with Unity EdgeConnect, enables zero-touch provisioning of EdgeConnect appliances in the branch. Orchestrator automates the assignment of business intent policies to ensure faster and easier connectivity across multiple branches, eliminating the configuration drift that can come from manually updating rules and access control lists (ACLs) on a site-by-site basis. Unity Orchestrator enables customers to:
- > Avoid WAN reconfigurations by delivering applications to users in customized virtual overlays
- > Align application delivery to business goals through virtual WAN overlays based on business intent
- > Simplify branch deployments with EdgeConnect Profiles that describe the virtual and physical configuration of the location
In addition to centralized and automated control of the entire SD-WAN topology (Figure 3), Unity Orchestrator provides specific detail into WAN performance, including:
- > Detailed reporting on application, location, and network statistics
- > Continuous performance monitoring of throughput, loss, latency, jitter and packet ordering for all network paths
- > Identification of all application traffic by name and location
- > Alarms and alerts to visualize and prioritize software and hardware issues within the WAN allow for faster problem resolution
- > Bandwidth cost savings report for documenting the cost savings of moving to broadband
Gain Control over the Cloud
Gain an accurate picture of how Infrastructure-as-a-Service (IaaS) and Software-as-a-Service (SaaS) and are being used within your organization.
- > Name-based identification and reporting of all cloud applications.
- > Tracking of SaaS provider network traffic.
- > Cloud Intelligence provides Internet mapping of optimal egress to SaaS services.
Strengthening WAN Security
Advanced capabilities provide cloud-first enterprises with the control to centralize and automate security policy governance and safely connect users directly to applications. They enable distributed enterprises to centrally segment users, applications and WAN services into secure zones and automate application traffic steering across the LAN and WAN in compliance with predefined security policies, regulatory mandates and business intent. For enterprises with multivendor security architectures, Unity Orchestrator offers seamless drag and drop service chaining to next-generation security infrastructure and service.
Boost Application Performance as Needed
Unity Boost WAN Optimization is an optional WAN Optimization performance that includes:
- > Latency Mitigation: TCP and other protocol acceleration techniques are applied to all traffic, minimizing the effects of latency on application performance and significantly improving application response times across the WAN.
- > Data Reduction: Data compression and deduplication eliminates the repetitive transmission of duplicate data. Silver Peak software inspects WAN traffic at the byte-level and stores content in local data stores. Advanced fingerprinting techniques recognize repetitive patterns for local delivery. Data Reduction can be applied to all IP-based protocols, including TCP and UDP.
Why Add Boost?
Silver Peak Unity EdgeConnect appliances alone provide enhanced application performance for broadband or hybrid WAN deployments, utilizing the included packet-based tunnel bonding, dynamic path control (DPC), and path conditioning for overcoming the adverse effects of dropped and out-of-order packets that are common with Internet connections.
However, sometimes additional performance is needed for specific applications or locations. As distance between locations increases over the WAN, application performance degrades.
This has less to do with the available bandwidth, and is more about the time it takes to send and receive data packets over distance, and the number of times data must be re-sent.
Boost Use Case Examples
- > Customers replicating to a disaster recovery (DR) site thousands-of-miles away might want to add Boost to ensure recovery point objectives (RPOs) are not compromised.
- > Enterprises with remote sites located in rural areas, or with sites that are exceptionally farther away from the company’s data center, might want to add Unity Boost to overcome the effects of high latency.
With Unity Boost, customers gain the flexibility to enable enhanced WAN optimization capabilities where and when it is needed in a fully integrated solution. Boost is licensed per-megabit-per-second, per-month, so customers do not have to pay for WAN optimization across the entire network.
Overcome Effects of Latency
The time it takes for information to go from sender to receiver and back is referred to as network latency. Since the speed of light is constant, WAN latency is directly proportional to the distance traveled between the two network endpoints. Silver Peak offers a variety of TCP acceleration techniques to mitigate WAN latency, including Window Scaling, Selective Acknowledgement, Round-Trip Measurement, and High Speed TCP.
Windows and other applications that rely on the Common Internet File System (CIFS) often take longer to perform common file operations over distance, such as retrieving and sharing files. Unity Boost helps these applications not only by improving the underlying TCP transport, but also by accelerating CIFS through CIFS read-ahead, CIFS write-behind, and CIFS metadata optimizations.
As packets flow through EdgeConnect appliances, Boost inspects WAN traffic at the byte-level and stores content in local data stores. As new packets arrive, Silver Peak computes fingerprints of the data contained within the packets, and checks to see whether these fingerprints match data that is stored locally.
If the remote appliance contains the information, there is no need to resend it over the WAN. Instead, specific start-stop instructions are sent to deliver the data locally.
>> Unity EdgeConnect Technical Support
Flexible Deployment Models
- > EdgeConnect Virtual (EC-V) – Download and install EdgeConnect from anywhere in the world. The software runs on all common hypervisors, including VMware ESXi, Microsoft Hyper-V, Citrix XenServer, and KVM. Silver Peak customers who have an IaaS presence in AWS, Microsoft Azure, Oracle Cloud Infrastructure or Google Cloud Platform can deploy EdgeConnect within their hosted cloud environment.
- > EdgeConnect Physical (EC) – For enterprises that are not virtualized in the branch, choose one-of-five EdgeConnect hardware appliance models for plug-and-play deployment.
Unity EdgeConnect Subscription Licensing
Silver Peak Unity EdgeConnect licenses are sold as a subscription, in either single or multi-year increments (1, 2, 3, 4, 5 and 7 years) at multiple bandwidth tiers.
EdgeConnect includes Unity Orchestrator™ that can be installed either on premise or in a customer’s virtual private cloud. An optional cloud-hosted Orchestrator license provides a highly reliable alternative deployment model supporting all Orchestrator features without the complexity of managing on premise virtual compute and storage resources. Unity Boost™ WAN Optimization is an optional WAN Optimization performance pack that may be ordered and deployed flexibly to sites that require application acceleration. Boost is offered in 100Mbps or 10G blocks.