Essential Requirements for WAN Optimization. WAN Acceleration Evaluation

Transcription

1 WAN Acceleration Evaluation Revision November 2009

2 ESSENTIAL REQUIREMENTS FOR WAN ACCELERATION Introduction This document proposes a list of suggested requirements and evaluation criteria for selection of a WAN Acceleration product that can be deployed robustly to support a large-scale enterprise network. While many WAN acceleration products seem to perform adequately in simple lab tests in isolated network environments, very few have proven to be able to sustain full-scale production operation across a large number of different applications, under heavy traffic loads, and in larger-scale networks having from dozens to hundreds or thousands of remote locations. WAN optimization products that have proven to meet the stringent requirements of the larger, more complex networks will deliver greatest returns through stable trouble-free operation, including for deployments at more normal-sized networks. This document lists evaluation criteria used to identify products that are capable of meeting robust scaling and performance requirements. How to use this document In this document each suggested requirement is listed in bold, followed by a discussion about why the requirement is relevant and important. The reader should formulate and tailor their own list of applicable requirements to fit their specific needs. This document focuses on the essential requirements (e.g., the product must support CIFS acceleration ), as opposed to trivial requirements (e.g., the product must be weigh less than 10 pounds ). Not all requirements are necessarily applicable in every network environment; each environment has its own unique characteristics, and the reader should tailor their requirement to fit the needs of their specific network and applications Riverbed Technology. All rights reserved. 1

3 Table of Contents Configuration and Network Integration... 3 Must be able to provide references of other similar-sized successful customer deployments... 3 Must be deployable in-path at the core data center... 3 Must support multiple bypass port pairs for in-path deployment... 3 Must be deployable out-of-path with WCCP... 3 Must support autodiscovery of remote peer devices... 3 Must support manual configuration of remote peer devices where necessary... 3 Appliance-based solutions must not require additional software plug-ins or agents on client or server hosts... 4 Optimized traffic must preserve IETF-specified (RFC 2581) TCP congestion control behavior over the WAN... 4 Must detect asymmetrically-routed network traffic... 4 Must optimize asymmetrically-routed network traffic for both in-path and out-of-path configurations... 4 Transparency Mode should be optional, not mandatory (option for accurate addressing must exist)... 5 Must be available as a software client installable on Windows PC s and Laptops... 5 Scaling and High Availability... 6 Must be able to simultaneously communicate with at least peer devices (fill in your specific requirement)... 6 Must support clustering without WCCP or PBR... 6 Must not block additional application sessions when capacity is reached... 7 Must support TCP connections and application sessions per device (fill in your specific requirement)... 7 Must support TCP connections and application sessions through clustering (fill in your specific requirement)... 7 QoS policy enforcement must include both priority queuing and traffic shaping... 7 QoS policy enforcement must be applicable hierarchically... 7 Data Reduction Technology... 8 Must have disk-based data store for byte-level data... 8 Must be able to synchronize Data Stores between clustered WAN optimization devices... 8 Must have at least GB of storage capacity for byte-level data (fill in your specific requirement)... 8 Must use a universal single-instance data store architecture... 8 Must support an encrypted data store... 9 Application-Specific Optimization Technology... 9 Must address protocol chattiness and latency issues for CIFS (Windows File Sharing)... 9 Must not interfere with the operation of CIFS file locks between client and server... 9 Must address protocol chattiness and latency issues for Macintosh-based CIFS clients (OSX 10.5 and later) Must address protocol chattiness and latency issues for Exchange/MAPI Must address protocol chattiness and latency issues for Exchange 2003/MAPI Must address protocol chattiness and latency issues for Exchange 2007/MAPI Must support cross-protocol data recognition and data reduction for Exchange/MAPI Must address protocol chattiness and latency issues for NFS version Must address protocol chattiness and latency issues for enterprise web applications Must address protocol chattiness and latency issues for SSL encrypted applications Must address encoding processes for Oracle Forms application data Must fully optimize encrypted and compressed Citrix ICA traffic optimization without requiring server or client configuration changes Must address protocol chattiness for Windows print traffic Management Must have a central manager capability available Central manager must be optional, not required Must support the capability to host virtualized 3 rd -party software applications About Riverbed Riverbed Technology. All rights reserved. 2

4 Configuration and Network Integration Must be able to provide references of other similar-sized successful customer deployments With a large number of vendors offering products in this relatively-new technology area, one of the best ways to identify the most suitable product is to look at other success stories. Many WAN acceleration products look good on paper, but only a small number of vendors have had their products successfully rolled out in large-scale production network environments. The solution must have consistent and demonstrated success in a real-life production network, and not just in a simple two-box lab demonstration in an isolated test lab. Some vendors encourage customers to limit their evaluations to a lab environment, where they can avoid unfavorable conditions (e.g., unknown applications, heavy traffic loads, etc ). Often they introduce contrived conditions (e.g., artificially-high packet loss levels) that unfairly benefit their own products. The best way to see if a product will work and work well is to look for concrete examples of full-scale successful deployments in other customer networks that are similar to your own. The vendor should be able to furnish these customer references if indeed they exist. Be sure to check that the references have actually deployed at a scale similar to your own network, not just that the customer has purchased a comparable number of devices. Must be deployable in-path at the core data center Some vendors recommend a PBR or WCCP-based deployment for the data center, because their devices are not capable of passing-through significant amounts of traffic loads that would be seen when deployed in-path in the data center. However, use of WCCP and PBR in these environments requires creation and constant maintenance of lengthly and complex ACL s, due to the large heterogeneous mix of application and traffic types seen in the core data center. In contrast to a branch office environment where there are a limited number of applications used by a relatively small number of employees, the core data center typically hosts a large number of applications that are being accessed by employees located in many branch offices. Configuring ACL s for WCCP or PBR traffic redirection is inevitably going to be a complex and continuous process, repeated whenever a new application or traffic type shows up in the network. For a large enterprise, the burden of managing these ACL s for traffic redirection is very difficult if not impossible to handle. As a result, an in-path deployment approach may be far more preferable in the data center. Must support multiple bypass port pairs for in-path deployment Larger networks, particularly those designed for high availability and redundancy will have redundant Ethernet LAN connections. To efficiently support these environments, the WAN optimization product should support multiple Ethernet bypass port pairs so that a single appliance can be simultaneously connected to multiple Ethernet LAN connections. This avoids having to use a separate appliance for each Ethernet connection. Must be deployable out-of-path with WCCP WCCP should be an available deployment option, as it allows the WAN acceleration device to physically reside outside of the network path. This option allows traffic that cannot or should not be optimized to avoid any contact with the WAN acceleration device, should that be desirable. Must support autodiscovery of remote peer devices The WAN acceleration device must be able to dynamically detect the presence and IP address of any other WAN acceleration devices, on demand and without advance administrator configuration. True autodiscovery significantly reduces the amount of tedious configuration work and potential for configuration error, especially in networks with large numbers of WAN acceleration devices or sites with WAN acceleration devices. Furthermore, autodiscovery avoids the need to enter host subnets in the configuration process, another source of headaches and errors. In contrast, tunneling-based products require that all host subnets be identified. This is an administrative burden, particularly for networks with large numbers of subnets and those that use formal subnet tracking tools management processes. Each and every time an IP address subnet assignment is created, deleted, or changed, the change must be reflected not only in your existing address tracking tools, but also must be reflected in the WAN optimization solution s management interface. The long-term task of keeping these two configuration databases synchronized, up-to-date, and accurate is a potential source of conflict and error in the foreseeable future. Must support manual configuration of remote peer devices where necessary In some environments, firewalls and intrusion protection devices may block use of the TCP options field, and this can interfere 2009 Riverbed Technology. All rights reserved. 3

5 with the operation of the autodiscovery mechanism. In these environments, one can either change the configuration of the firewall, or alternatively disable the autodiscovery mechanism and instead manually configure IP address information of each remote peer device. Because the former approach can compromise security, the latter option of manually configuring peering relationships is the better choice in many cases. However, some WAN optimization products lack this ability to disable autodiscovery and instead use fixed rules that specify the IP address of the peer device. These WAN optimization products should be avoided as they lack the flexibility to be deployed in highly-secure environments where firewalls disallow use of the TCP options field. Appliance-based solutions must not require additional software plug-ins or agents on client or server hosts A truly transparent appliance-based solution should not require software agents on client or server hosts. This defeats the purpose of having an appliance-based solution. Optimized traffic must preserve IETF-specified (RFC 2581) TCP congestion control behavior over the WAN Some WAN acceleration products do not honor IETF-specified TCP congestion control semantics. Rather, they use TCP windowing tricks to boost performance and throughput to levels that normally wouldn t be allowed by standard TCP congestion control safeguards specified in RFC2581. These products attempt to boost performance by stealing bandwidth from other applications sharing the WAN infrastructure. If you are planning to deploy WAN acceleration devices an environment with shared WAN connections, then non-tcp compliant products should be avoided. The danger for these products is when multiple non-tcp traffic flows collide in a shared WAN environment, significant levels of network congestion and packet loss will occur, affecting all traffic sharing the WAN. Products that do not honor slow start and congestion avoidance principles outlined in RFC2581 will not know how to adequately handle such situations. Rather than fall back and reduce their transmission throughput under heavy network congestion, these products attempt to power-through the congestion, by maintaining their transmission rate in the face of packet loss. The result is severely degraded network conditions for all traffic sharing the WAN. Must detect asymmetrically-routed network traffic Asymmetric routing is unavoidable in most large and highly-available IP networks. Whether your network already has redundancy features such as multiple network paths, or at some future point you believe you may add additional connections to provide the redundancy, the WAN acceleration product that you select should have the capability of detecting and not harming or blocking traffic that is asymmetrically-routed. Some WAN optimization products block traffic that is routed through a different WAN optimization device for each direction of traffic flow. These products are incapable of detecting asymmetric routing conditions, particularly when a given WAN optimization device only sees the client s request, but not the server s response. When this condition occurs, the WAN optimization device must be able to realize that asymmetric routing is probably going on, and that it should not attempt to intercept and optimize the traffic, but rather let it pass-through without disruption. Products that cannot do this should be avoided, because they block traffic and break applications when asymmetric routing exists in a network. This may be an important requirement even if you don t believe you have asymmetric routing. Often, in the initial state of the network asymmetric routing will not exist at all until a link failure or some other event occurs, which triggers activation of an alternate network path. In this case, a WAN acceleration deployment that initially works fine may suddenly start blocking traffic and breaking applications as a result of normal IP re-routing operations through the dynamic routing protocol (e.g., OSPF, BGP, etc...). Note that detecting asymmetrically-routed traffic only means that the traffic will be passed-through without optimization, and does not necessarily mean that the traffic will be optimized. The next requirement deals with the ability to actually optimize asymmetrically-routed network traffic. Must optimize asymmetrically-routed network traffic for both in-path and out-of-path configurations The WAN acceleration product should not only detect, but given adequate configuration, also be able to optimize asymmetricallyrouted network traffic. While WCCP can be used to address asymmetric routing, there are some environments where WCCP may not be possible. As a result, the WAN acceleration solution must have explicit mechanisms to address asymmetric routing for inpath/in-line configurations, where the device is deployed using bypass interfaces. To accomplish this requires that the product have an ability to forward and re-direct traffic appropriately so that the asymmetry is eliminated as far as the WAN optimization 2009 Riverbed Technology. All rights reserved. 4

6 device is concerned. Note that WAN acceleration devices that address protocol chattiness issues must be able to intercept and optimize traffic in both directions of data flow. If one direction of data flow is intercepted and optimized by one WAN optimization device, and the return path for that traffic follows a path supported by a different device, then problems can occur because each of the two different devices only see one duplex of the traffic. This requirement states that the WAN optimization devices must communicate, coordinate, and appropriately forward the traffic flow so that the device performing the optimization service can see both directions of traffic flow. Transparency Mode should be optional, not mandatory (option for accurate addressing must exist) Some WAN acceleration vendors offer a transparency feature that uses the original IP address of the client and server to address packets containing optimized data for delivery over the WAN. This feature allows network monitoring devices to observe the original source and destination of the network traffic, but it also hides the real sender and receiver of the processed, compressed, and transformed traffic, which are the WAN optimization devices, not the original client and server. The alternative approach to transparency is accurate addressing for the processed, compressed, and transformed traffic. This approach accurately reflects on the compressed traffic that the WAN optimization device is sending the traffic to another WAN optimization device, so that there is no possibility of misrouting of the traffic. The transparency feature achieves a worthy objective by providing traffic visibility, but it also creates a number of significant impacts to the overall integrity of the functioning IP network. As a result in many situations this feature may need to be disabled in order to avoid routing problems and application disruptions. Unfortunately, Transparency mode is not only the default mode for some WAN acceleration products, but for some products it cannot be disabled even if the customer does not want to use this feature. This raises an important issue for customers with large networks having redundant WAN routers and asymmetrically-routed traffic. Because the optimized WAN traffic contains the IP address of the end-host, and not the WAN optimization device, traffic can potentially be routed to the wrong WAN optimization device, particularly in networks with asymmetric routing and multiple WAN optimization devices deployed at the data center site. Furthermore, routing loops can develop because network routers cannot distinguish between traffic that has already been processed by the WAN acceleration device, and traffic that has yet to be processed, and as a result they may continuously route already-processed traffic back to the WAN acceleration device in a continuous loop, resulting in black-holing of the traffic. Finally, a very-real possibility exists for the wrongly-addressed packets to actually be delivered to the end-host, resulting in confusion and application disruptions when that traffic contains random bytelevel data compressed by the WAN acceleration device. In order to avoid these issues, the WAN optimization solution must have a capability for accurate addressing. This capability can be optionally enabled, but it must exist, and when it is utilized, the optimized, compressed, and transformed data sent over the WAN segment of the network will accurately utilize the real IP addresses of the WAN optimization devices. This prevents any chance of misrouting of the traffic from occurring. While the Transparency feature might be useful in a limited number of cases, nevertheless in many enterprise networks, it can cause serious problems and challenges, and it may need to be disabled in order for the WAN acceleration solution to function without disrupting the network and various applications. Must be available as a software client installable on Windows PC s and Laptops According to IDC s Mobile Worker Forecast , about 450 million workers will use mobile computers in the near future. If your corporation has a number of mobile users, then the requirements for the WAN optimization solution must be available not only as a separate hardware appliance deployed in data centers and branch offices, but also as a software client on mobile Windows laptop computers. The software client should support an invisible mode, allowing installation and configuration to be centralized, because mobile users will generally not have a technical background that allows them to comfortably navigate complex configuration tasks. Operation of the mobile software client should be completely transparent to the end user. The software client should be tested and work well with your VPN client and anti-virus software, and interoperate well with the various applications that are used by the end user Riverbed Technology. All rights reserved. 5

7 The software client should work with the same WAN optimization product in the data center that is also supporting remote branch office appliances. This will allow standardization on one WAN optimization device in the data center, including the ability to load balance and cluster data center devices for scalability and high availability. Otherwise, two separate sets of products in the data center would be needed one to support remote branch office appliances, and the other to support mobile software clients. The software client should be capable of simultaneously connecting to more than one WAN optimization device, in order to support network environments where servers are located at more than one data center. Without this capability, the mobile software client can only receive optimized performance for applications from only one data center. Though this requirement is seemingly fundamental, one of the more prominent mobile software client products has this very limitation. The software client should have the ability to auto-detect when it is in a location with a WAN optimization appliance and automatically disable its optimization. This capability is needed in the common use case where an employee with a software client-equipped laptop roams in and out of corporate offices that have WAN optimization appliances. When the employee is working in the office, it is typically preferable to defer to the local appliance for WAN optimization, in order to leverage the appliances data store that is shared among all employees, and to avoid unnecessary consumption of a client license. This feature should be fully automated and should not require manual configuration of subnets or DNS servers. The software client should also have a branch warming capability, so that its data store is pre-warmed when the user is working form an office with a local appliance, so that subsequent data transfers are warm as soon as the client leaves the office, even though it was previously relying on the appliance for optimization. With this feature, users get the best of both worlds: the ability to rely on the appliance while in the office, and immediate warm performance after leaving the office. Scaling and High Availability Must be able to simultaneously communicate with at least peer devices (fill in your specific requirement) This requirement is important for customers having (or potentially having) large numbers of sites where WAN acceleration devices will be deployed. It becomes an even more important requirement if your network includes an MPLS-based WAN, which provides for any-to-any connectivity. Many WAN acceleration devices can only connect with a small number of remote peer devices, while others can connect with thousands of peer devices, each deployed at a different site. Be careful about products that claim to increase the number of peers that they can communicate with through clustering approaches. Load balancing and clustering through WCCP unaware of device peering relationships, and the same is true for many proprietary clustering approaches (e.g., Juniper s WX/WXC cluster). With random traffic load balancing, there is no way to determine which clustered/load balanced device will receive a given traffic flow. As a result, every device in the cluster must form relationships with the same peer devices. For example, if a given WAN acceleration product can peer with a maximum of 50 devices using WCCP to cluster 3 of these devices together does not necessarily raise the peer limit to 150, because each of the 3 clustered devices typically must support peering relationships with the same 50 peer devices. Furthermore, note that this architectural requirement has implications on the solution s ability to support individual mobile software clients. If a given WAN optimization device can only support connectivity to 50 peer devices, then effectively each data center device can only support 50 mobile software clients. On the other hand, many enterprise environments expect to have far greater than 50 mobile employees using a software-based Windows client-pc solution. Must support clustering without WCCP or PBR WCCP does have drawbacks, one of which is increased demand on router processing resources. In some environments the traffic load is such that WCCP places too much demands on the processing resources of the router or switch, and therefore an alternate load balancing and clustering approach must be supported, without use of WCCP. Another problem with both WCCP and PBR is that they are unaware of device peering relationships or device overload; they can tell when a device is up or down, but they have no finer-grained visibility in to the state of the cluster. Finally, note that WCCP requires at least 30 seconds to detect a failure among its clustered devices. The WCCP hello timer interval cannot be changed, and a failure of a device clustered through WCCP will likely result in black-holing of traffic for at least 30 seconds before WCCP recognizes that the failed device is no longer responsive Riverbed Technology. All rights reserved. 6

8 Must not block additional application sessions when capacity is reached A solution that scales properly must be able to survive overload conditions without disrupting application sessions for additional traffic beyond the device capacity. In a large massively-scaled network environment, there will be time periods where application demand spikes to higher levels. To accommodate this, when the session capacity of the WAN acceleration device is reached, additional sessions should be passed-through and not be adversely affected. Note that some WAN acceleration devices use an application-specific caching (e.g., file cache) approach. These devices handle session requests similar to how an application server would if the maximum number of application sessions that can be supported by the server is reached, then additional connections are denied. Unfortunately, this behavior is not appropriate for a WAN acceleration device deployed to intercept and generically optimize all application traffic, and any such device should be eliminated from consideration as it will not scale, unless the device can be adequately oversized so as to guarantee that the connection-denial never occurs. Must support TCP connections and application sessions per device (fill in your specific requirement) Scaling the solution requires that each WAN optimization device be able to accelerate a significant amount of network traffic. Bandwidth metrics are often deceptive, as raw packet compression capacity does not accurately measure the solution s ability to apply layer-7 application-specific acceleration techniques designed to address latency and protocol chattiness issues. Rather, a more accurate metric of a device s scaling capability is the number of TCP connections and application sessions that can be intercepted and accelerated. Note that these are two separate and equally-important metrics that must be considered and compared across all WAN optimization solutions being considered. Note that some vendors emphasize a very high connection limit for generic TCP connections, but they have significantly lower application-level session (e.g., CIFS, MAPI, etc ) limits that they avoid disclosing. Make sure you specifically enquire on the vendor s limits for both TCP connections and application sessions. Must support TCP connections and application sessions through clustering (fill in your specific requirement) Many network environments are sufficiently large that multiple WAN optimization devices must be deployed at some sites, particularly the data center hub site. In these cases, multiple WAN optimization devices must be clustered in order to scale the solution as required, and the total number of TCP connections and application sessions that the clustered solution must be compared across all WAN optimization solutions being considered. QoS policy enforcement must include both priority queuing and traffic shaping QoS is important to ensure real-time transactional traffic such as VoIP, RDP and Citrix ICA receive priority access to bandwidth in the network. However, some WAN optimization devices are only capable of providing traffic shaping and bandwidth reservation; these devices do not have any priority queuing capability to deliver packet prioritization. This creates an issue when traffic classes exceed initial manually-configured bandwidth guarantees. If priority queuing is not available, then it is possible for FTP traffic to be prioritized and expedited ahead of a time-sensitive VoIP or Citrix ICA packet. For this reason, QoS policy enforcement capability in the WAN optimization device must have the ability to perform both priority queuing and bandwidth guarantees/traffic shaping. QoS policy enforcement must be applicable hierarchically QoS policies must be able to address not only the WAN bandwidth available locally, but also the bandwidth at the remote site. This is important for shared WAN infrastructure such as MPLS clouds, where the bandwidth available at the data center is likely not the same as the bandwidth available at branch offices. To address these situations, the WAN optimization device must be able to apply QoS enforcement policies in a hierarchical manner, for example shaping traffic not only to the 45 Mbps bandwidth that is available locally at the data center, but also addressing the fact that most branch offices are only connected with a T1 WAN (1.5Mbps). Must be able to individually apply QoS policy enforcement policy to each of the four virtual channels in Citrix ICA traffic The WAN optimization device should have the ability to decode the ICA Priority Packet Tagging that identifies each virtual channel from which the packetized ICA data originated. This capability allows the WAN optimization solution to deliver more granular QoS enforcement, as well as to apply the appropriate DSCP marking to packets from each virtual channel. Some QoS solutions that decode ICA Priority fields might re-order packets, for example sending a high-priority interactive packet ahead of a lower-priority bulk packet, even though the bulk was transmitted first by the sender. While this may appear as a logical scheduling approach, it can have adverse effects on performance due to the out-of-order delivery of packets from the same TCP flow. The receiving endpoint s TCP stack must queue the out-of-order packets to deliver them in-order thus increasing jitter, delay, and possibly 2009 Riverbed Technology. All rights reserved. 7

9 even causing retransmissions. Therefore, when applying QoS to Citrix ICA traffic, the QoS scheduler must respect the ordering of packets within an ICA flow, and must not re-order packets. Data Reduction Technology Must have disk-based data store for byte-level data A sufficiently-large disk-based data store with multiple gigabytes to terabytes of data storage capacity, used to retain byte-level repetitive byte patterns is essential for effective WAN optimization. A disk-based data store is persistent across reboots, and will retain learned repetitive byte patterns for a period of weeks, if not months or years. The overall end-user experience is significantly enhanced when a file or attachment last accessed a number of weeks ago is accessed with LAN-like speeds. Furthermore, transfer times for large files, such as a 100MB FTP file transfer, are significantly faster if the entire byte-level data can be retained in the disk-based data store. In contrast, WAN acceleration products that only retain learned byte patterns in DRAM memory are significantly less effective due to their lack of storage capacity. Some DRAM-only products, due to storage constraints, only store repetitive byte patterns that are observed at least twice these products only provide warm performance acceleration on the third transfer of a given file. Other DRAM-only products store all byte patterns that they observe, and any learned files are retained in memory for a period of a few minutes before they are flushed out by newer byte patterns that are more recently acquired. Must be able to synchronize Data Stores between clustered WAN optimization devices In order to support high availability, redundancy, and failover of the WAN optimization solution, the byte-level contents of the diskbased data store must be able to be copied and synchronized between clustered WAN optimization devices. This may be between an active and a passive device (one-way synchronization), or it may be between two devices that are actively optimizing traffic (bi-directional synchronization). In the event of failure or loss of one WAN optimization device, then there will be no loss of data and the other device will be able to continue accelerating with the same data store as the previously-operational device. Data store synchronization between redundant WAN optimization devices must be supported regardless of the deployment approach, and this includes not only for in-path deployments, but also deployments that make use of WCCP. Must have at least GB of storage capacity for byte-level data (fill in your specific requirement) Backup and data replication applications involve transfers of potentially hundreds of GB to several TB of data. The WAN optimization device must be capable of storing the entire set of byte patterns transferred for the entire backup and data replication process. Of course, this will vary depending on your specific application and environment, but the data store must match or exceed the nominal amount of application data to be backed-up or replicated. It is important to distinguish between a byte-level data store and an application-level cache. Disk-based storage can be utilized to store either byte-level data or application-level data. The byte-level data storage capacity required in the WAN optimization device is typically far less than the amount of file-level data being transferred over the WAN. A byte-level data store eliminates the bytelevel data redundancies found among different versions of the same or similar files. It is not uncommon to be able to support three to five times as much application-level data with a given byte-level data store (e.g., a 500GB data store can often support between 1.5 to 2.5TB of files, attachments, web objects, etc ). On the other hand an application-level cache (e.g., a file cache or web cache) must have a data storage capacity that is greater than the amount of application-level data being transferred over the WAN. Note that for some WAN optimization products, data is stored twice first at the byte level and then again at the file level. For such products, the amount of disk storage needed is far greater than the amount of application-level (i.e., files) data that must be transferred over the WAN. A memory-only WAN acceleration device stores much less data than disk-based devices, and will provide minimal benefit for backup and data replication applications because the stored data will quickly be overwritten. Must use a universal single-instance data store architecture The WAN optimization solution must use a universal data store that stores each byte-pattern once, regardless of the number of remote peer devices accessing the file. In the case of an identical file fetched by users at 10 different branch offices, the relevant data must only be stored and represented only once in the data center WAN optimization device not 10 separate times. Each additional accelerated transfer of that file to any remote site leverages the same instance of data stored in the central WAN optimization device, and must not consume additional storage Riverbed Technology. All rights reserved. 8

10 Note that some WAN optimization devices use a partitioned data store for each peer device, which stores each instance of data once for each tunnel or remote peer device. For a given file retrieved by users at different remote sites, the data center WAN optimization device must store the same instances of byte-level data at least once for each remote site. As a concrete example, where users at 10 different branch offices retrieve the same file, the core WAN optimization device in the data center must store the relevant data 10 times once for each tunnel or remote peer WAN optimization device. A partitioned data store architecture also has implications on the solution s capability to support a software client-based solution for mobile users. In this case a separate data partition must be created and maintained for each mobile software client. If 10GB were set aside for each mobile software client, then supporting 1000 mobile software users would consume 10TB of data store capacity in the central data center appliance. The per-peer data store architecture used by some WAN optimization devices will not scale to meet the needs of larger more complex networks having many remote sites and/or individual mobile client users. As a result, the WAN optimization solution must use a single-instance universal data store architecture. Some vendors will claim that a per-peer data store is actually a good feature on the dubious premise that it dedicates storage capacity for each site, and thus prevents high traffic activity in one remote site from overwriting data used to optimize traffic to other remote sites. However, this reasoning overlooks the fact that premature eviction of data is also possible with a per-peer data store -- a single client performing a very large transfer can evict data from the data store for that entire site, thus impacting optimization for all other users at that site. Under the reasonable assumption that the per-peer datastore is smaller than a single global data store, this consequence is far more likely with a per-peer data store than with a unified data store. Must support an encrypted data store Data stored on the disk drives of the WAN acceleration device can introduce a new security exposure if the disks are physically removed. For this reason the data store should be encrypted with strong encryption algorithms in order to prevent compromise of sensitive confidential information. This can be especially true if SSL-based applications are being accelerated by the WAN acceleration device. Because WAN optimization requires a symmetric deployment meaning devices are deployed at both the remote site and data center encryption should be a requirement to protect data at the branch office, where security may be inadequate. Data that the end-user had trusted would be encrypted and confidential should not be stored in clear-text format in the disk drives of the WAN acceleration device. Application-Specific Optimization Technology Must address protocol chattiness and latency issues for CIFS (Windows File Sharing) CIFS, also known as Windows File Sharing, is one of the more common application protocols seen over the WAN. The WAN optimization solution must not only address scarce bandwidth issues through data reduction and compression technologies, but it must also address latency and protocol chattiness issues associated with CIFS chatty protocol behavior. Furthermore, the WAN optimization must not only accelerate simple CIFS desktop drag & drop copy operations, but it must also accelerate more complex CIFS operations that are initiated from within applications, such as when an application user clicks the save-as button within the MS-Excel application. Must not interfere with the operation of CIFS file locks between client and server The CIFS acceleration mechanism must be transparent to CIFS file lock operation between client and server. In order to provide safe acceleration of CIFS traffic, end-to-end file locking mechanisms employed by the Windows operating system must be able to continue functioning. As a result, a WAN outage should be handled no differently from a PC being disconnected while a file operation is taking place in this case the Windows operating system will save a local backup copy of the file, and the end-user can recover normally through existing Windows file recovery processes. Note that file caches inherently intercept these file locks and use a proprietary mechanism to relay file lock information across the WAN. If a WAN disruption or other event (such as a glitch in the WAN optimization device) prevents the local and remote WAN optimization devices from communicating over the WAN, the result can be data corruption or blocked file access because of incorrect file locking Riverbed Technology. All rights reserved. 9

11 Must address latency and protocol chattiness issues for SMB-Signed CIFS traffic Some Windows hosts such as the Domain Controllers require that the CIFS traffic that they send and receive be SMB signed. Digitally signing SMB messages enables the recipient of the packets to confirm their point of origin and authenticity (that is, verifying that the packets came from the expected location and have not been modified during transit). SMB Signing does not keep data confidential; it does not cause any data to be encrypted. However, it does prevent hostile parties from adding or altering data in the connection. Many WAN optimization products are not able to deliver latency optimization for SMB signed traffic. These products are unable to deliver latency optimization and address CIFS protocol chattiness issues for Windows Domain Controllers and other Windows hosts that require SMB signing. In addition, in many environments security requirements mandate that SMB signing be used for all CIFS traffic. WAN optimization products that lack the ability to address latency and protocol chattiness issues for SMB-signed CIFS traffic will deliver only data reduction and compression benefit for these environments, but CIFS performance may still be very slow over high-latency WAN links. If your environment supports multiple Active Directory domains, then ensure that the WAN optimization product supports latency optimization of SMB signed CIFS traffic when the client and server are in different AD domains. Must address protocol chattiness and latency issues for Macintosh-based CIFS clients (OSX 10.5 and later) Macintosh workstations have recently been experiencing an increasing presence in the enterprise. Although Macintosh workstations use the same CIFS protocol that Windows machines use to access files over the network, the actual CIFS implementation in the Leopard OSX operating system has some very significant differences compared to the Windows CIFS implementation. Specifically, the Macintosh CIFS implementations (specifically the Leopard 10.5 and Snow Leopard 10.6 operating systems) use oplocks differently, and request different file attributes compared to the Windows CIFS implementation. Use of a WAN optimization product that fails to recognize these significant differences will result in very slow data transfers for certain file requests, or even worse--risk data corruption in a multi-user environment. For these reasons, it is important that the WAN optimization device have implementation-specific CIFS acceleration mechanisms engineered to recognize and optimize Macintosh traffic, in order to avoid further slowing it down or potentially risking data corruption. Must address protocol chattiness and latency issues for Exchange/MAPI The WAN optimization solution must be able to not only reduce bandwidth consumption through compression and disk-based data reduction techniques, but also address latency and protocol chattiness issues associated with the chatty Exchange/MAPI protocol. Exchange is one of the more common applications used over the WAN; acceleration of Exchange/MAPI traffic allows consolidation of Exchange servers to central data centers, thus saving cost, improving backup and data protection processes, and increasing overall IT efficiency. Must address protocol chattiness and latency issues for Exchange 2003/MAPI2003 When an Outlook 2003 client connects to an Exchange 2003 server, chatty protocol behavior will slow down transfer performance, although the slow performance can be masked if Outlook Cache Mode is used. Exchange 2003 uses a different version of the MAPI protocol than earlier Exchange servers. WAN optimization products that claim to optimize Exchange/MAPI do not necessarily optimize Exchange 2003/MAPI2003, because the latter uses a different protocol. Must address protocol chattiness and latency issues for Exchange 2007/MAPI2007 When an Outlook 2007 client connects to an Exchange 2007 server, chatty protocol behavior will slow down transfer performance, although the slow performance can be masked if Outlook Cache Mode is used. Exchange 2007 uses a different version of the MAPI protocol than earlier Exchange servers. WAN optimization products that claim to optimize Exchange2003/MAPI2003 do not necessarily optimize Exchange 2007/MAPI2007, because the latter uses a different protocol Riverbed Technology. All rights reserved. 10

12 Must address protocol chattiness and latency issues for encrypted MAPI for Exchange 2003/2007 The default configuration for Exchange 2007 automatically encrypts Exchange attachments. Previous versions of Exchange also have the ability to encrypt MAPI attachments. Most WAN optimization product require that Exchange encryption be disabled, but this obviously reduces the amount of security for end-users. To avoid any increased security exposure, the WAN optimization solution must be able to provide compression, data deduplication, and latency optimization for Exchange 2003 or 2007 even when encryption for Exchange is enabled. Must support cross-protocol data recognition and data reduction for Exchange/MAPI Exchange 5.5, Exchange 2003, and Exchange 2007 servers all encode their attachments before sending them to the Outlook client, even when Exchange encryption is not enabled. Because of the Exchange special encoding, the original byte-patterns of the file are changed when they are viewed over the network. As a result, the byte-patterns for the encoded attachment are different than if the same file was sent using a different protocol such as CIFS, HTTP, or FTP. A WAN optimization device must first undo the encoding before applying data reduction algorithms, if the byte patterns of the file are to be stored and recognized in their native format. This approach allows the WAN optimization device to deliver cross-protocol data recognition and data reduction. For example, when an attachment is initially retrieved by the Outlook client from an Exchange server, it will also be accelerated when that attachment is then sent over for the first time using CIFS or FTP. If a WAN optimization device applies data reduction algorithms to the file attachment s encoded form, then the WAN optimization device cannot deliver cross-protocol data reduction because the data had initially been stored and recognized in its encoded format by that WAN optimization device. Must address protocol chattiness and latency issues for Lotus Notes Lotus Notes client interactions with the Lotus Notes server involves some chatty protocol behavior, particularly when sending attachments. Slow performance results in high-latency WAN environments. Must address protocol chattiness and latency issues for NFS version 3 Environments with Unix hosts often use NFS to transfer files across the WAN. If your environment includes Unix-based workstations and servers, then you may want to include NFS protocol optimization to your requirements. Must address protocol chattiness and latency issues for enterprise web applications Simple web applications and static web pages generally perform well with WAN optimization solutions that deliver disk-based compression and data reduction mechanisms. However, more complex enterprise-class business applications often exhibit chatty behavior when accessing various web objects needed to populate a given web page. If your environment includes such applications (e.g., Siebel, Oracle, SAP, etc ), then a feature that pre-fetches web objects and addresses latency-related performance issues for enterprise web applications should be one of your requirements. Note that the capabilities to optimize web applications must go beyond just compression and data deduplication of the HTTP data traveling through the WAN. Chatty behavior that results from the web client serially fetching large numbers of web objects from busy web pages can result in very slow performance in high-latency WAN environments. The WAN optimization product must be able to address these impacts. Due to the diversity in the design and implementation of web applications (e.g., static or dynamic pages, with or without cookies, small objects or large objects, different authentication methods), no single latency optimization is consistently effective for all types of web applications. Rather, a diverse set of different HTTP latency optimizations have the best potential to optimize different web applications. As a result, the HTTP optimization feature should include multiple different optimizations such as parse-and-prefetch, URL learning, or object caching. For the same reason, it should be possible to selectively enable/disable different HTTP optimization mechanisms on a per-server basis. Must address protocol chattiness and latency issues for SSL encrypted applications SSL-encrypted web traffic comprises an increasing portion of today s enterprise network traffic. The traffic must not only be encrypted for confidentiality, but also authenticated to ensure the data comes from the correct source. Unfortunately, these requirements also prevent many WAN acceleration solutions from accelerating SSL traffic, because the encrypted traffic has been scrambled and any repetitive data patterns have been hidden in the encrypted data stream. However, there are some WAN optimization solutions available that are now able to securely terminate the security layer in a safe manner, without compromising security. Once they can access the underlying clear-text data, WAN optimization algorithms and techniques can now be applied before the traffic is re-encrypted for delivery over the WAN. If the SSL-encrypted traffic in your network is slow due to bandwidth and latency issues in the WAN, then consider adding a 2009 Riverbed Technology. All rights reserved. 11

13 requirement for the WAN optimization device to accelerate the traffic in a safe and secure manner, without disrupting the existing trust model. Configuration of SSL optimization should not require explicit manual entry of the SSL server IP addresses by the administrator. In order to support large environments with many SSL servers, the WAN optimization solution should automatically detect the IP address of each individual SSL server. Must address encoding processes for Oracle Forms application data Oracle 11i and 12 E-Business Suite, also known as Oracle Forms, uses a proprietary encoding method that transforms the original application data when it is transported over the network. The WAN optimization solution should dynamically recognize Oracle Forms applications, and perform decoding of the application data prior to its applying data reduction algorithms. This allows the WAN optimization device to recognize common byte-level data patterns and to effectively perform data reduction algorithms. Those WAN acceleration devices without this capability will not be able to recognize common byte-level data patterns, because the application data has been scrambled through a special encoding process by Oracle Forms. The WAN optimization solution must be able to support all of the different modes for Oracle E-Business Suite, including JInitiator (also known as native or sockets mode), JRE, HTTP, and HTTPS mode. Must fully optimize encrypted and compressed Citrix ICA traffic optimization without requiring server or client configuration changes Many organizations using Citrix XenApp have struggled with the performance and feasibility of delivering desktop virtualization across the WAN. The resulting performance issues impact employee productivity and application usability. To address these issues, the WAN optimization device must be able to optimize Citrix ICA traffic and consistently deliver superior data reduction compared to the default compression capabilities provided by the Citrix XenApp presentation server. Citrix ICA optimization must include the capability to dynamically disable the XenApp server s default encryption and compression so that the WAN optimization device can dynamically apply its own advanced data reduction algorithms to the raw Citrix ICA data. Manual reconfiguration of the XenApp presentation server should not be necessary, as the WAN optimization device should be able to interact with the proprietary API s of the XenApp server to disable the default compression and encryption. Full optimization of Citrix ICA traffic also requires specific QoS capabilities, which are described earlier in this document. Must address protocol chattiness for Windows print traffic Windows print traffic across the WAN can not only be affected by bandwidth constraints, but also latency issues. The WAN optimization solution must address the chatty protocol behavior that exists in Windows print traffic, in order to facilitate printing of documents over the WAN. Management Must have a central manager capability available Management is an important issue when scaling a solution. As more sites deploy the WAN optimization solution, it is important to have a central manager capability, in order to monitor the health and performance of large numbers of remote appliances. The central manager must be able to store configuration files and software images. These will be handy whenever the need to replace a given hardware device comes up, as the configuration file and software image can then be pushed out to the replacement hardware. Central manager must be optional, not required Often, there will be a need to deploy in limited environments, where only two devices one at each site are involved. In these cases, use of a central manager should be optional, not required. A central manager in a limited 2-3 site deployment not only raises cost, but also increases administrative burden and complexity for what should be a very simple deployment. In very large networks, processes and custom tools built around scripting, statistics export, and SNMP may be a better fit for the organization. In such a situation a mandatory central manager is not just an unfortunate waste of money, but may become a point at which the organization s preferred management system is undercut Riverbed Technology. All rights reserved. 12

14 Must support the capability to host virtualized 3 rd -party software applications The capability to host virtualized 3 rd -party software applications on the WAN optimization device allows additional server hardware in the branch office to be removed. If the WAN optimization device cannot host these services, then separate server hardware may have to be maintained at the branch office to support these services. Examples of these software applications include print server, Windows Active Directory, DNS, DHCP, multimedia streaming server, and various security software capabilities. The WAN optimization device must be able to host each of these services in a virtualized partition. Multiple virtual partitions must be supported, allowing multiple separate software packages to be hosted and active simultaneously. The virtualization feature must support flexible routing of data between and among the virtual software partitions and the WAN optimization mechanism. It must support 3 rd -party applications that must interact with the data stream before and/or after the data has been processed for WAN optimization. For example, firewalls may need to access the data stream before it is processed for WAN optimization, in order to inspect the original clear-text data stream for threats; the same firewall may need to access the data stream after it is processed for WAN optimization in order to deliver secure VPN tunneling services over the Public Internet. Similar requirements may exist for virtualized network monitoring applications, that need to receive a copy of the data stream through a virtual span port. In addition, the virtualization should use proven hypervisor technology from a leading vendor such as VMWare. The technology should be licensed and jointly supported by the virtualization software vendor. Open-source virtualization software should be avoided, as there is little or no accountability for such software. About Riverbed Riverbed Technology is the IT infrastructure performance company. The Riverbed family of wide area network (WAN) optimization solutions liberates businesses from common IT constraints by increasing application performance, enabling consolidation, and providing enterprise-wide network and application visibility all while eliminating the need to increase bandwidth, storage or servers. Thousands of companies with distributed operations use Riverbed to make their IT infrastructure faster, less expensive and more responsive. Additional information about Riverbed (NASDAQ: RVBD) is available at Riverbed Technology, Inc. 199 Fremont Street San Francisco, CA Tel: (415) Riverbed Technology Ltd. 1, The Courtyard, Eastern Rd. Bracknell, Berkshire RG12 2XB United Kingdom Tel: Riverbed Technology Pte. Ltd. 391A Orchard Road #22-06/10 Ngee Ann City Tower A Singapore Tel: Riverbed Technology K.K. Shiba-Koen Plaza Building 9F 3-6-9, Shiba, Minato-ku Tokyo, Japan Tel: Riverbed Technology. All rights reserved. 13