What Is SD-WAN?

How Does SD-WAN Work?

A software-defined WAN uses application-aware routing protocols to improve application performance. Most SD-WAN solutions create virtualized overlays in the form of encrypted tunnels, and a centralized management function intelligently steers network traffic across the WAN, through these tunnels, in the most efficient way available. Traffic is prioritized by business case and policy, offering optimal quality of service (QoS).

Software-defined networking (SDN) technology is a critical element of SD-WAN, allowing for on-the-fly network management and configuration to suit the needs of moment-to-moment traffic or specific use cases, such as maintaining uptime for critical applications.

The software-based secure tunnels an SD-WAN creates enable users and entities to connect directly to software as a service (SaaS) and infrastructure as a service (IaaS) providers, offering lower costs for additional infrastructure, improving connectivity and user experience, and reducing the attack surface compared to traditional or hybrid WAN.

Why Is SD-WAN Important?

Traditional WAN architectures fall short as organizations migrate more of their apps and data to the public cloud. Security is more important than ever, but backhauling traffic from remote users and branch offices over private networks—such as MPLS or VPN—to a centralized internet gateway and back again introduces latency and creates a poor user experience.

Hybrid WANs can see to some of these issues, and they’re still a compelling alternative to the expense and inflexibility of traditional WAN connections. However, they don’t necessarily use SDN technology—in which case they can’t dynamically route traffic to ensure the best path. This alone puts hybrid WAN at a distinct disadvantage compared to SD-WAN.

By taking advantage of software-defined policies to determine optimal paths, SD-WAN makes it easy to establish local internet breakouts, which bring cloud-based applications and other cloud services as close to users as possible. What’s more, combining SD-WAN with high-performance, cloud-delivered security allows an organization to bring policy as close as possible. We’ll look at that in more detail shortly.

What’s the Difference Between WAN and SD-WAN?

Here are some of the ways SD-WAN separates itself from traditional wide-area networking:

Benefits of SD-WAN

SD-WAN creates the shortest bridge between two points, regardless of where those points are located. This makes it easy to see how SD-WAN offers a variety of benefits over traditional WAN:

1. Lower costs: Most organizations’ WAN traffic has spiked massively with increased use of the cloud, driving up costs—especially if they bought new hardware to accommodate the higher bandwidth needs. SD-WAN reduces these costs by letting you take advantage of cost-effective options like the public internet.
2. Higher performance: Intelligent traffic steering gives priority to critical application traffic (e.g., VoIP and other network services) and creates direct tunnels to eliminate backhauling, reduce latency, and enhance productivity and the user experience.
3. Greater simplicity: Driven by intelligent automation, the most advanced SD-WAN solutions let you take advantage of zero-touch provisioning, removing the need to configure devices ahead of time. ZTP can automatically provision and configure any router in the WAN.
4. Stronger security: SD-WAN simplifies branch office operations and efficiently connects your branches to the internet, making it easy to establish local breakouts—but these connections still need to be secured. Cloud-based security is the natural fit here, as part of a complete SASE framework.
5. Gateway to segmentation: SD-WAN allows organizations to build up to a segmentation-based networking and/or security model, which is fundamentally designed on the principle of least-privilege. This is a precursor to a zero trust model, which grants users access to only the resources they need and prevents lateral threat movement.

Watch

SD-WAN Security and SASE

Secure access service edge (SASE) is a network architecture framework that brings cloud native security technologies—SWG, CASB, ZTNA, and FWaaS in particular—together with WAN capabilities to securely connect users, systems, and endpoints to apps and services anywhere. To support agile operations, these technologies are cloud-delivered and can be managed centrally.

Zero trust, a core tenet of SASE, asserts that no user can be trusted by default. A SASE architecture enforces zero trust policies in the cloud to safeguard sensitive data and protect organizations from web-based threats.

So how does SD-WAN fit into all of this? As a central element of a SASE framework, it supports cloud-first strategies and secure digital transformation initiatives. Rather than being backhauled to your data center for security functions, end user device traffic is inspected at a nearby point of presence and sent to its destination from there. This means more efficient internet access as well as improved access to apps and data, making it the far better option for protecting distributed workforces and data in the cloud.A

Next-Generation SD-WAN

SD-WAN optimization has much to offer today’s agile, distributed operations. Even so, with cloud adoption still trending upward, some legacy SD-WAN systems struggle to keep up due to insufficient scale and bandwidth. This is driving demand for the next generation of SD-WAN.

In a next-gen SD-WAN architecture, branch services such as network security can all be delivered from cloud platforms over any internet connection. Harnessing the power of machine learning and automation, it can boost WAN edge bandwidth, enable an improved user experience, and offer superior security.

Benefits include:

1. Application-centric security, rather than packet-centric, enhancing security in distributed environments
2. Minimal manual intervention required, enabling a more agile approach to DevOps and API management
3. Real-time orchestration and enforcement delivered from the cloud

SD-WAN with Zscaler

Zscaler Zero Trust SD-WAN provides branches and data centers fast, reliable access to the internet and private applications with a direct-to-cloud architecture that provides strong security and operational simplicity. It eliminates lateral threat movement by connecting users and IoT/OT devices to applications through the Zscaler Zero Trust Exchange™ platform.

Branch traffic can be securely forwarded directly to the Zero Trust Exchange, where policies can be applied for full security inspection and access identity-based control of branch and data center communications. Trusted application traffic can be sent directly across the internet with direct internet breakout. 

SD-WAN Partnerships

Zscaler partners with the world’s leading SD-WAN vendors to provide comprehensive security, visibility, control, and data protection for branch users going directly to the internet. Together, we make it easy for your organization to migrate from a hub-and-spoke network to a cloud-delivered architecture by enabling secure local internet breakouts for your branch offices.

With the power of Zscaler Internet Access™ and leading SD-WAN service providers, you’ll be able to:

• Reduce the cost and complexity of routing traffic locally and securely
• Simplify branch operations for greater efficiency and user experience
• Provide identical protection no matter where or how your users connect
• Easily and instantly scale deployment to meet your business needs

Zscaler seamlessly integrates with more than a dozen leading SD-WAN providers, including Aruba, Cisco, Juniper, VMware, and more, to offer you secure, fast, and reliable access to apps from any device, anywhere.

Watch