SD-WAN stands for software-defined WAN. Its an approach to using software to steer WAN traffic. SD-WAN is dynamic. What does this mean? It means it can steer traffic path based on Application-Awareness or Dynamic Link Selection.
- Application-Awareness -> This is where we are steering traffic based on the application. For example, we can decide if social media web traffic should go over the Internet link or the MPLS WAN link.
- Dynamic Link Selection -> This is where we basically decide where traffic egresses based on criteria we set. For example, if critical internet traffic goes above a certain latency parameter, it will fail over to using the MPLS path.
SD-WAN is all about controlling EGRESS traffic. It cannot control ingress traffic. Of course, sessions initiated from inside will be allowed back in and go via the preferred path, but anything originating from the outside will not. We do not control using SD-WAN ingress traffic.
Fortinet's implementation of SD-WAN is what they refer to as Secure SD-WAN. Secure because we are using the FortiGate FW as our SD-WAN device. FortiGate has inbuilt security tools that can be leveraged to secure and optimize WAN traffic. It uses IPsec/ADVPN to secure the WAN traffic.
We can also load-balance WAN traffic with SD-WAN. So this way we can have both resiliency as well as utilising all our available links.
Benefits of SD-WAN
- Effective WAN usage - With SD-WAN we can be efficient on our WAN. If we see traffic over a certain path is using a lot of bandwidth we can set it up to automatically load balance or fail over a link to a better available path with more bandwidth.
- Application Performance - Since we can decide on best path the critical applications can go over, it provides faster performance and more flexibility.
- Cost reduction - Cost is significantly reduced. With SD-WAN we can migrate away from using an expensive MPLS solution and we can steer traffic over cheaper links rather than more expensive links.
- Varied Underlays - SD-WAN allows for using various underlays. Underlay is the actual physical medium the data is travelling across. This can be broadband, LTE, MPLS, etc
- Steer traffic to various locations - We can steer traffic to the internet, public cloud, private cloud etc.
Hybrid WAN is the method of steering traffic using different links to different destinations.
Secure SD-WAN Architecture
Below is list of the core components of the SD-WAN architecture.
- 1FortiGate deploys SD-WAN
- 2FortiGate can use IPsec for SD-WAN
- 3FortiGate NGFW suite can be usedThis includes UTM features like SSL Inspection, Web filtering, IPS, Anti-Botnet, Antivirus etc
- 4FortiGate can use UTM, FortiGuard Labs, & FortiSandbox SD-WAN Integration
- 5FortiManager can be used for achieve ZTP for SD-WAN configuration
- 6Forti-Authenticator can be used to provide AAA of user traffic going over the SD-WAN
- 7FortiSwitch can be used to connect WAN-Edge and LAN-Edge devices of SD-WAN Branches
- 8Application Steering can be done - IPS can be usedApplications can be detected based on application detectors and not limited to L3/L4 PDU's enables easily deploying new applications at sites.
- 9ISDB can be used
Underlay & Overlay
The underlay is the underlying physical links. This can be cables provided by ISP or by a private company providing private links. E.g. dedicated MPLS links. Cables can be DSL, Ethernet, Fiber, MPLS, 4G/5G/LTE etc. Underlays are typically not encrypted. Even MPLS private links are not encrypted.
The overlay is a virtual link built on top of the underlay link. I explain this concept in great depth in my SD-Access and GRE blog posts. Please review them if you need to understand this concept.
SD-WAN overlay we can have IPsec/ADVPN, GRE and IP-in-IP.
Comments