SOLUTION GUIDE. Hybrid WAN Solutions with FortiWAN. The cost-effective way to deliver the WAN bandwidth and redundancy your organization demands

Transcription

1 SOLUTION GUIDE Hybrid WAN Solutions with FortiWAN The cost-effective way to deliver the WAN bandwidth and redundancy your organization demands

2 Overview Almost every organization faces the need for increased WAN bandwidth for its data center and branch office networks. The recent explosive growth in cloud-based applications and video is significantly impacting the ability for traditional WAN networks to handle the load and in many cases is adding increased latency. MPLS and metro Ethernet can easily be upgraded in most cases to handle the load, however at a very steep price that most organizations can t afford. There are many other technologies that offer high-speed bandwidth such as DSL, Cable and LTE, however integrating them into a seamless business-class WAN has proven challenging in the past. Link Load Balancers have evolved significantly in the past few years into intelligent WAN optimization tools that can manage multiple links from virtually any technology and from multiple carriers. This multi-technology, multi-carrier approach is called the Hybrid WAN and is enabled by WAN Link Load Balancers such as Fortinet s FortiWAN product line. In this solution guide we ll take a look at the drivers behind the need for increased bandwidth, introduce you to the key technologies in our FortiWAN products and how they are applied to WAN bandwidth management, provide information on the top use cases for Hybrid WAN implementations, and briefly discuss the integration of the Hybrid WAN into Software Defined Networking (SDN). Everyone Needs More Bandwidth It s tough to find a business that says it has just enough WAN bandwidth to meet its needs and that s content with its monthly fixed line, MPLS or Metro Ethernet bills. Each year business Internet traffic usage is growing at a 20% rate and is expected to reach over 22 exabytes of traffic by 2017 from 16 exabytes in To put that in perspective, 1 exabyte is 1 billion gigabytes or roughly equivalent to 3,000 times all the text, audio and video stored in the U.S. Library of Congress. Behind this are the growth of video for business use, cloud-based applications and the consolidation of virtual devices centrally driven by virtualization technologies. Some organizations have more specific drivers for increased WAN bandwidth. For example, hotel properties with guest Wi-Fi services find that networks optimized for content delivery are stressed when guests are uploading video to YouTube or syncing photos to cloud-based servers. An unfortunate few are in areas where they ve hit the maximum bandwidth available to deliver business connectivity and don t have easy or inexpensive options without having to pay their telco carrier to run new higher-capacity WAN links to their locations. 2

3 Old WANs, New Problems Years ago if you needed to connect a remote location to your data center you added a leased line from your telco carrier. If you added more locations, you added more leased lines ranging from T1s to DS3s and fractions thereof depending on your needs. Technologies like Frame Relay cropped up and faded away giving way to the predominant technology today, Metro Ethernet, usually with MPLS. Metro Ethernet is a very flexible IP-based technology that connects your locations to a carrier s Ethernet network and can easily be bridged to the Internet. MPLS is an overlay technology that creates virtual private networks at the layer 2 level that isolates traffic between locations to make it appear that any remote location is directly connected to your data center or other location. Carriers offer the ability to bridge MPLS networks to the Internet for a fee or that can be done at your data center with various routing options. These technologies continue to work well for organizations that need dedicated SLAs, guaranteed uptime and have deep pockets to pay for bandwidth upgrades as their traffic volumes grow. There are some limitations though. Metro Ethernet with MPLS will generally only work within the geographic boundaries of a telco carrier. This means if you have a remote location in an area not served by the carrier, you ll need to look to dedicated leased lines or use a secondary MPLS from another carrier. Also, although Metro Ethernet and MPLS have very high SLAs, usually ranging from 99 to % uptime, there still exists the possibility of outages from a few hours to a few days each year. Depending on the needs of your organization that can represent significant losses. You can deploy a secondary backup MPLS network, but that isn t practical in many situations and will be very cost prohibitive except for large organizations. Many smaller organizations have successfully deployed VPNs over Internet services as a less expensive DIY option for remote connectivity. Usually tied to a firewall, they bypass the need for carrier-managed services, but it can be challenging to bridge multiple VPNs for traffic expansion and to add additional bandwidth to an existing platform The greatest challenge facing traditional WAN technologies is pricing. Any of the traditional WAN technologies can provide you virtually unlimited bandwidth for your needs, however that comes at a very high price. For example, Metro Ethernet typically is a tiered pricing model where if you only need a few hundred extra megabytes of throughput, you may have to jump to a higher tier for a full gigabyte, which in some cases may double or even triple your monthly service bill. Challenges to Traditional WANs Growth in bandwidth is driven by Internet-based applications like video and hosted applications strains traditional networks. MPLS and other carrier-based networks are expensive and don t always serve all your locations. 3

4 WAN Connectivity with a Hybrid WAN In most cases the old school WAN backhauled most if not all traffic to the data center. In some cases today that is still needed in certain industries, but for most it s overkill. Not only does Internet traffic strain your backhaul to the data center, in most situations it introduces a significant amount of latency for things like video and cloud-based applications like SalesForce.com and even Google Docs. If you really take a good look at your Internet traffic, you ll most likely find there are many applications that don t need the guaranteed throughput and SLAs of a carrier-based WAN. There s a great opportunity to get this off your core network and route it directly from a branch to the Internet without having to go all the way back to your data center to only be sent to the Internet from there. There are also many low-cost options for Internet connectivity like DSL and Cable modem services. These can be up to 1/20th the cost and offer speeds that are comparable to the lower pricing bands of Metro Ethernet. The question is how can you leverage lower cost Internet options without the complexity of managing various point solutions for your WAN? A Hybrid WAN can take your existing WAN infrastructure and seamlessly combine it with other lower-cost Internet technologies to give you the bandwidth you need on a platform that is easy to manage. Virtually any Internet technology such as MPLS, Metro Ethernet, leased lines, DSL, Cable Modems, LTE and Satellite can be implemented to add links to your WAN to either add bandwidth or to provide redundancy and resilience to your network. Hybrid WAN can also link multiple MPLS or VPN networks together into one large network that can span multiple geographies and ensure almost 100% network availability. 4

5 The Evolution of the Link Load Balancer The Hybrid WAN is built on the technology of the humble Link Load Balancer. Most IT professionals today still think of a Link Load Balancer as a tool to provide backup link redundancy should a primary WAN link go down. And yes, there are still many that are sold today expressly for that purpose. There are also many firewalls, routers and application delivery controllers that also include basic link backup and link load balancing. An advanced WAN Link Load Balancer uses basic link health checking, failover and link restoration functionality and adds many advanced features that take full advantage of the links coming in and out of your data center and remote locations to create a dynamic Hybrid WAN. There are 5 key features to a WAN Link Load Balancer that enable a Hybrid WAN and separate it from basic link monitoring and failover: Optimum Routing: Monitoring performance and directing traffic to the best available link. Policy Based Routing: Configurable business rules that use traffic and application type to route traffic to specific links. Quality of Service: Prioritization by traffic type to ensure latency-vulnerable traffic (such as voice and video) is provided the bandwidth it needs to minimize disruptions. Link Aggregation (tunnel routing): The ability to assign individual links to create a larger virtual tunnel that appears and acts as a single link between sites. DNS Multihoming: Inbound traffic management and IP reassignment of URLs to ensure seamless access to internal resources from external users. These features enable you to easily add almost any Internet technology and bandwidth to your WAN by simply adding new links. As long as there s an Ethernet port to plug into, they can be added to your network and be configured to add backup capabilities, offload Internet traffic from your data center backhaul, or create larger private links without the need for additional investments in your MPLS infrastructure. Can t a Firewall or ADC Support Hybrid WANs? There are many appliance solutions that offer some degree of link load balancing. The most common are available in firewalls and Application Delivery Controllers (ADCs). Most firewalls offer an all or nothing failover option where if a link goes down, all traffic is automatically routed to the remaining link. This is great for redundancy, however you re paying for a live link that s only used for backup. A WAN link load balancer like FortiWAN lets you use the bandwidth of all links you re paying for. If one fails, traffic is routed to the remaining healthy links with no disruption to your users, other than a possible slowdown in response times. Once the link is restored, FortiWAN automatically starts routing traffic back to that link. ADCs provide the same type of functionality as a firewall, and some offer a few more features such as Quality of Service and Optimum Routing. Even with these features, they re generally capped at 4-16 links as to not interfere with the core ADC tasks of managing traffic to backend servers. FortiWAN offers up to 50 links for high-bandwidth situations and has additional capabilities of tunnel routing to aggregate multiple links into a single pipe to seamlessly add capacity to private networks. 5

6 FortiWAN WAN Link Load Balancers Fortinet s FortiWAN appliances provide the tools you need to manage and integrate WAN links into your network to create a Hybrid WAN using almost any ISP technology. Need back up connectivity? Want to add more bandwidth to your data center, remote offices, VPN or support free Wi-Fi for guest users? Need to expand your backhaul but don t want to add to your MPLS costs? FortiWAN Features: nmanage up to 3 Gbps of combined WAN throughput and up to 50 WAN links on a single device. nsupport multiple link types from one or multiple carriers. nseamlessly manage link outages with soft failover and automatic recovery. nmonitor link performance and route traffic to best links. nsecurely aggregate multiple links into larger virtual private tunnels. nprovide inbound traffic routing with multihoming. FortiWAN WAN Link Load Balancers are based on over 10 years of proven technology and experience that offer the latest in WAN Link Load Balancing features. From simple link back up capabilities that provide redundant connections to patented Tunnel Routing that creates secure virtual private lines out of multiple links, FortiWAN delivers the features you need to support today s complex Hybrid WAN environments. The best way to showcase these features is to illustrate how they solve your problems. In the next section we ll cover the top use cases for FortiWAN s Hybrid WAN technologies to give you examples of how they can help solve your bandwidth and redundancy problems. FortiWAN WAN Link Load Balancers 6

7 Common FortiWAN Use Cases In this section we ll cover the top use cases for FortiWAN. Although a top use case is simple link backup for WAN connection redundancy, it s generally understood by most IT professionals as a fundamental feature of a link load balancer. It will be referenced in the use cases below, but not highlighted as a use case by itself. FortiWAN Use Cases: nadd Bandwidth to a Single Location or Data Center nsecurely Connecting Multiple Locations nmpls Bridging (Multiple MPLS) ndeliver Cost-effective Wi-Fi Access nadding Wireless to Your WAN Add Bandwidth to a Remote Location or Data Center As mentioned earlier, almost every organization needs more bandwidth than it has today. Be it a data center or remote location, adding more bandwidth can be an expensive proposition using traditional WAN links such as Metro Ethernet or leased lines. FortiWAN can utilize lower cost links like DSL, Cable or even LTE to add capacity, and with intelligent Policy Based Routing, can offload Internet traffic from your backhaul links providing them more bandwidth for core applications. In Figure UC1, FortiWANs are deployed at both the data center and at branch offices to offload general Internet and cloud-application traffic from the private backhaul network. The orange and blue links can be virtually any ISP technology ranging from leased lines to inexpensive DSL or Cable modems. In this situation we ve put FortiWANs at both locations, however if more bandwidth and offloading is only required at a branch office, only one FortiWAN would be needed. FIGURE UC1 Offloading Internet Traffic with FortiWAN FortiWAN can manage multiple links to offload general Internet traffic (blue) and Cloud Applications (orange) from core backhaul traffic (green) providing increased bandwidth for all users either from the branches or the data center. 7

8 Securely Connecting Multiple Locations When you need more backhaul bandwidth from a remote location to your data center, it s easy to upgrade your MPLS network or upgrade to a higher-capacity Metro Ethernet tier. With that ease, comes a lot of extra cost, usually requiring you to jump to a new usage tier for your network. If you only need a few extra megabits of bandwidth, FortiWAN can let you add less expensive options like DSL and Cable to your private network by aggregating them with Tunnel Routing. In Figure UC2, three links are aggregated together into a larger virtual private line that backhauls to the data center. These lines can be any combination of links, including your existing MPLS, additional leased lines or less expensive DSL and Cable. FortiWAN does the heavy lifting of managing the links so that all you see is one large virtual link connecting your locations. If an individual link goes down, private traffic is routed to the remaining links seamlessly. When the link is restored, traffic automatically begins routing to that link again. Please note that in order to use Tunnel Routing, a FortiWAN is required at each end, here at the data center and the branch office. FIGURE UC2 Securely Bridging Locations with Tunnel Routing FortiWAN s patented Tunnel Routing used to bridge multiple links into a single secure virtual private line between the data center and remote location. 8

9 MPLS Bridging (Multiple MPLS) Similar to our previous use case, Tunnel Routing also can be used to bridge multiple MPLS networks. We have numerous customers that have deployed this solution to take two separate MPLS networks and bridge them to create a seamless single network spanning multiple carriers and geographies. This can be used also for situations where you may need a second MPLS network for backup. With FortiWAN you can put the idle backup MPLS to use by creating one larger single network from both. If one should fail, the other seamlessly routes traffic without the need for manual intervention. In Figure UC3 FortiWANs are deployed at points where the two MPLS networks enter your network. Other locations with single MPLS links don t require FortiWAN appliances. FortiWAN takes MPLS 1 (red) and MPLS 2 (blue) and creates a single network for all locations. The Headquarters and Regional Office are able to take advantage of the increased bandwidth of both MPLS networks where Branches 1 and 2 are seamlessly connected to the broader network regardless of which MPLS network they are connected to. FIGURE UC3 Bridging Multiple MPLS Networks with FortiWAN FortiWAN used to bridge two separate MPLS networks (blue and red) into one seamless network for all locations. 9

10 Deliver Cost-effective Wi-Fi Access Many organizations offer guest Wi-Fi access to their customers. The most typical quoted scenario is the venerated local coffee house. Yes, coffee houses and chains offer their customers free Wi- Fi, however we also see this in many hospitality situations and businesses that offer free Wi-Fi for visitors. Adding Metro Ethernet for bandwidth is expensive for giving something away for free. DSL and Cable offer two low cost options to offload guest Wi-Fi and leave your business traffic on carrier links or MPLS. In Figure UC4, FortiWAN is deployed at the location where you need to provide guest access for Wi-Fi. Using its Policy-based Routing, guest Wi-Fi user traffic is routed to the DSL link (blue) and the back office users are only allowed access to the MPLS link. This also can be configured to provide backup should either link fail where FortiWAN will automatically restore traffic flows once the link is back online. FIGURE UC4 Add Cost-effective Wi-Fi Capacity with FortiWAN FortiWAN used to route guest Wi-Fi traffic to less expensive DSL (blue) while leaving MPLS bandwidth unaffected for office users. 10

11 Adding Wireless to Your WAN Wireless access like LTE and Satellite can be a great backup where terrestrial based links are unreliable or not readily available. FortiWAN can add wireless WAN for backup connectivity or bandwidth capacity depending on how it s configured. If you only need wireless WAN for backup at a remote location, FortiWAN can be configured to only use that link when there s an outage on the primary link. Although more specialized, FortiWAN can also combine multiple wireless links into larger virtual ones to provide up to 45 Mbps of speed for mobile applications (tradeshows, work sites, etc.). Figure UC5 shows both these scenarios. At the top, FortiWAN is configured to only use the LTE network (green) if the DSL and T1 (red) go down. At the bottom, a mobile tradeshow vehicle uses 3 LTE connections (from different carriers) to achieve near DS3 speeds as long as it can access the wireless networks. FIGURE UC5 Add Wireless for Backup and Mobile Locations FortiWAN can seamlessly failover to wireless only when it s required for link backup or can be used to combine multi-carrier LTE to create up to DS3 speeds for mobile applications. 11

12 SDN, WAN and SD WAN Just as SDN (Software Defined Networking) has impacted traditional LAN environment planning, Software Defined WAN (SD WAN) is being discussed more as the future of WAN networking. The goal of SD WAN is similar to SDN, to seamlessly manage traffic at the layer 2 level of the OSI model without the need to manage hardware-based switches or WAN controllers. The latest in SDN controllers are offering the ability to add WAN links to the controller so it can be managed centrally. Although FortiWAN does not offer direct SDN integration today, it can be used as a single link into an SDN controller where you still can take advantage of FortiWAN s features like tunnel routing, automatic link failover, and policy based routing. FortiWAN s upcoming API interface will allow an SDN controller or similar devices to directly manage FortiWAN providing benefits of advanced Link Load Balancing and SDN management and control. Summary The high cost of WAN bandwidth challenges most organizations. Lower-cost options like DSL, Cable and even Wireless can provide the bandwidth, but introduce complexities where most organizations don t think they re worth the headaches. There are many instances where traffic doesn t need to be backhauled to a data center and then out to the Internet from there. By implementing an advanced WAN Link Load Balancer such as FortiWAN, organizations can provide cost-effective bandwidth and link redundancy to create Hybrid WANs. By seamlessly integrating links using virtually any ISP technology, FortiWAN enables organizations to address needs such as adding cost-effective bandwidth to their remote locations and data centers, increasing backhaul capacities with tunnel routing, and delivering inexpensive Wi-Fi to guest users. GLOBAL HEADQUARTERS Fortinet Inc. 899 Kifer Road Sunnyvale, CA United States Tel: EMEA SALES OFFICE 120 rue Albert Caquot 06560, Sophia Antipolis, France Tel: APAC SALES OFFICE 300 Beach Road The Concourse Singapore Tel: LATIN AMERICA SALES OFFICE Paseo de la Reforma 412 piso 16 Col. Juarez C.P México D.F. Tel: (55) Copyright 2015 Fortinet, Inc. All rights reserved. Fortinet, FortiGate, FortiCare and FortiGuard, and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet s internal lab tests. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable. April 21, 2015