As organizations embrace cloud and digital transformation initiatives – a trend that’s been accelerated by the recent pandemic – they’re coming to grips with the fact that traditional networks weren’t architected to handle the resulting complexities and workloads.
This in turn is driving growth in flexible and robust software-defined WAN (SD-WAN) deployments, a market which analysts predict will grow from $1.9B in 2020 to over $8.4B by 2025.
Changing your network architecture is a critical undertaking, so naturally you should understand and plan around the impact that will have on the overall network – sites, circuits, applications, etc. One best practice is to break the process into three phases:
- Baseline planning
- Deployment verification
- Ongoing operational insight
The planning phase is fairly straightforward, but requires diligence: you need to benchmark service performance parameters across end-user, application, network and multi-cloud services.
That in turn will help with policy design and service level agreements. Common requirements for this phase include inventorying and locating all internal applications, cataloging SaaS and IaaS applications, and adequately sizing the MPLS and internet connections to accommodate anticipated traffic. There are tools on the market to help NetOps teams to accomplish all this, as doing it manually is nearly impossible.
Once planning is complete, the actual deployment and operation starts – and this is where things can go very wrong, very quickly. The deployment phase allows visualization of SD-WAN policies for application performance, traffic segmentation, DSCP, and service provider tunnels, along with verification and monitoring of end-to-end application performance behaviors.
During this process, NetOps can also use bandwidth consumption, QoS marking, and SD-WAN policy verification to isolate problems, and identify root causes for fast resolution. The final phase operationalizes the deployment by spinning up rich visual analytics, custom dashboards, alerts, reports, along with the rapid troubleshooting needed to properly manage the SD-WAN.
Here are five common challenges that can trip you up during deployment and operation.
1. Patchwork of Undocumented Connections
MPLS and internet connections have been part of enterprise WANs for more than twenty years, resulting in a patchwork of legacy policies and technology. This can include things like statically built tunnels, open ports, network equipment with command lines no one remembers, etc. All of these undocumented changes can expose an organization to migration risk.
It’s important to realize that there are likely to be undocumented changes that will be missed during the deployment. This is where pre- and post-migration baselines – and good visibility tools – are critical to identifying traffic patterns and gathering the necessary analytics to judge post-migration integrity.
2. Poor Post-Migration Application Performance
Configuration or policy issues generally won’t surface until the network is stress tested, making verification a critical process during SD-WAN deployment. Traditionally, organizations will define SD-WAN policies based on site and traffic analytics from the legacy network. But SD-WANs can and do behave differently, and a good NPMD platform can be critical to visualizing the before and after patterns.
For example, employees might experience a significant drop-off in file sharing performance following an otherwise successful SD-WAN migration – perhaps because filesharing traffic was previously accelerated over the MPLS connection by the edge router, and when relegated to a standard internet circuit and deprioritized by the policy, came to a standstill. The verification process can help quickly isolate these types of issues; to spot problems fast, look for tools that deliver a complete end-to-end view of the SD-WAN overlay as compared to the transport underlays.
3. Inability to Verify Path Selection
SD-WANs rely on path selection, but it can be difficult to verify that policies are operating as intended. Traffic can get shifted in the background from one circuit to another without any obvious visible evidence. It will be necessary to use a tool that allows site-to-site traffic analysis to identify and verify appropriate path selection over time, and visualize when a different transport was chosen (and which traffic policy ruled that behavior).
4. Increase in Service Provider Connections
Operationally, one of the biggest challenges to SD-WAN migrations can be managing the sudden explosion in service providers – especially if you’re coming from a single provider in an MPLS model. With an SD-WAN, every remote site can have its own ISP (with or without an SLA).
Complicating matters is the fact that, while the virtual overlay might look great, it’s entirely possible that the physical underlay hides a large number of problematic links and real-world issues. As such, it’s important to make sure you’re using tools that provide the appropriate visibility – ideally per application, per site and per ISP – to determine how individual ISPs are performing, and drill down to diagnose and isolate specific issues. The metrics to be monitoring include packet loss, latency, jitter and ongoing WAN capacity utilization.
5. Changes in Security Policies
It’s inevitable that the new SD-WAN will allow (and require) different security policies than the legacy network it replaces. For instance, SD-WANs allow encryption as traffic moves from one site to another and network segmentation for layered protection. Thus, everything from employee and guest access to creating DMZs to internet access to architecting site-to-site connectivity (what’s meshed, what’s backhauled) may need review. Moreover, it will be important to ensure that you’re capturing audit data and performing policy validations to ensure the network is operating as intended from a security (and performance) perspective.
SD-WANs deliver unquestioned value to an organization when properly deployed and managed. Understanding the key stumbling blocks and having the proper tools in place to help circumvent those challenges, is vital to success.
About the Author:
David Izumo, Principal Engineer at LiveAction