Important Considerations for Cisco WAAS in Large-Scale Enterprise Deployments

Transcription

1 Important Considerations for Cisco WAAS in Large-Scale Enterprise Deployments January 2012

2 IMPORTANT CONSIDERATIONS FOR CISCO WAAS IN LARGE-SCALE ENTERPRISE DEPLOYMENTS Many vendors offer seemingly-comparable WAN optimization solutions today, but few of the available solutions can consistently demonstrate successful deployments in large-scale enterprise networks. The Riverbed Technology WAN optimization solution has an unparalleled track record of successful large-scale deployments in complex enterprise networks. Steelhead products have been deployed in thousands of production IP networks, including many that have hundreds of Riverbed Steelhead appliances. Since Cisco is the undisputed leader for general IP networking solutions, the Cisco WAAS offering would seem to be a natural solution candidate for many enterprise customers. Curiously, despite Cisco s market dominance in network equipment, and years of serious and determined efforts to promote the WAAS product, a number of large enterprises that initially selected Cisco WAAS have been unable to get it to work in their network, and have subsequently replaced their Cisco WAAS systems with the Riverbed solution. It can be difficult to pin down exactly why Riverbed can succeed in a particular network environment while Cisco WAAS doesn t, but there are some common patterns that emerge. It seems that as the size and complexity of the WAAS deployment grows, the likelihood of failure or some other unsatisfactory outcome also increases. This paper discusses six important considerations that customers should explore when evaluating the Riverbed Steelhead appliance and Cisco WAAS products for deployment in their large enterprise networks. Consideration #1: Can you verify that other large enterprises have successfully deployed WAAS throughout their network? It is relatively easy to demonstrate LAN-like performance in isolated lab environments or in simple small-scale pilot tests. In contrast, deploying, scaling, and maintaining a successful WAN optimization solution in an enterprise network with dozens of sites is a completely different matter. Issues that are never observed in the lab almost certainly expose themselves when the solution has been fully-deployed in production environments. A live production pilot or proof-of-concept may be somewhat useful for this purpose, but even then the scale of a limited pilot test involving two or three sites may not provide a proper understanding of the issues and complexities that are uncovered in a large deployment. Rather, the best way to understand the issues behind a large WAAS deployment is to ask other Cisco customers who have had that experience. Checking references and performing due diligence is important in any major purchase decision, but it is especially important when contemplating purchases of products that others have had problems with. In our experience, follow-up on supposed WAAS deployments have revealed that often the WAAS devices, while purchased by the customer, were never deployed and are still in warehouse storage. In other cases the WAAS devices were only deployed to a limited number of sites representing a small subset of the customer s overall network. In other instances, the WAAS deployment was limited to only a small set of applications, and the deployment never achieved its originally intended scale in terms of the amount of network traffic optimized. Active follow-up should be a straightforward process; Cisco should be able to provide you with the names and contact info of customers who have deployed WAAS. Make sure those references have networks that reflect your own, with a similar number of sites, application traffic types, WAN link speeds, and number of branch office users. Since Cisco has been selling WAAS for over seven years, they should be able to provide them to you. We would expect and welcome the same request for a customer reference from anyone evaluating the Riverbed solution. Without active follow-up, it s just not possible to know or understand the real details of the WAAS deployments that Cisco describes in polished marketing documents and vague anecdotal accounts. Rather, nothing can substitute for a confidential oneon-one phone conversation directly with the source, the referenced customer who has deployed WAAS. Make sure you delve into details when talking to the reference. Has WAAS been deployed to all sites in the network? Has all application traffic been optimized, or only a small subset of traffic? How much has performance improved as a result? Have they been able to remove and consolidate servers from their remote sites? These are important details, because in our experience, most customers have not achieved enough success in their WAAS deployments to be adequately satisfied Riverbed Technology. All rights reserved. 1

3 Consideration #2: What about the features that are missing from the Cisco WAAS offering? It s no secret that Cisco WAAS is missing a number of features available in the Riverbed Steelhead solution features that are important for many customers. Missing features include not only important layer-7 application-specific optimization capabilities, but also a number of advanced technology features that make the Riverbed offering a truly powerful solution. Before deciding on the WAAS solution, it may be useful to take a close look at the features missing from WAAS to avoid purchasing a solution that does not meet your requirements. The following are a list of layer-7 application-specific optimization features included in the Riverbed solution that are not available in Cisco WAAS. Because WAAS lacks application-awareness of these applications, it is incapable of addressing latency and/or data encoding issues as required to optimize performance for these applications: - Encrypted MAPI - SMBv2 - SMB signed CIFS - Macintosh CIFS - Citrix ICA - Lotus Notes - Encrypted Lotus Notes - Oracle Forms (both Oracle JInitiator and Sun JRE client) - MS-SQL - Microsoft Sharepoint - Microsoft Office - Layer-7 HTTP (Parse & prefetch, URL learning, 304 fast response, and object prefetch table) - FCIP - SRDF - UDP - IPv6 The Riverbed solution also offers a number of features that are not available in Cisco s WAAS offering, including the following: - Solid State Disks (SSD): The Riverbed Steelhead 7050 uses SSD technology for persistent storage of byte-level data patterns. Because SSD technology achieves much faster read and write performance, the Steelhead 7050 is able to achieve end-to-end throughputs of multiple gigabits per second, well beyond what any WAAS device can achieve. Cisco does not offer any WAAS appliances equipped with SSD storage technology. - Data Store Synchronization: To support high availability requirements, the data stores in each Steelhead can be synchronized to a redundant Steelhead. Using this feature, loss of a Steelhead does not lead to loss of its stored data. - MAPI and Lotus Notes prepopulation: Riverbed s pre-population features allow Steelhead appliances to download s over the WAN, even when the end-user is offline. This feature reduces WAN usage during busy period at the beginning of the day when employees access their s. - Asymmetric routing support through connection forwarding: Riverbed has a number of features to support asymmetrically-routed network traffic commonly found in large networks, including when Steelhead appliances are deployed in-path. Because Cisco WAAS lacks these features, it is much more difficult to integrate into networks where asymmetric routing is common. - Steelhead-aware load balancing and clustering: Riverbed offers the Interceptor appliance, an external load balancing and clustering device that works with Steelhead appliances to scale up to 12Gbps of performance throughput. Cisco does not offer an external WAAS-aware load balancing device, and must use WCCP or PBR when attempting to scale WAAS deployments. While Rivebed also supports WCCP and PBR, the Interceptor is a more scalable approach that is also able to make more intelligent load balancing decisions because it is Steelhead-aware. - Manual Peering Rules: Cisco WAAS is entirely dependent on its autodiscovery mechanism that uses TCP options to discover and peer with other WAAS devices. But this creates a problem in networks with security gateways and other 2012 Riverbed Technology. All rights reserved. 2

4 devices that do not allow traffic using unknown TCP options. TCP options can also be denied for non-security-related reasons, such as in satellite networks that often use TCP spoofing devices to boost transport performance in high-latency WANs. Because TCP connections are terminated and re-initiated by a proxy device within the network, any added TCP options are lost and the WAAS autodiscovery mechanism will not work. WAAS cannot be used in such environments because it does not allow the administrator manually configure the IP address of peer WAAS devices. - Auto-disable compression and selective optimization for SRDF: Riverbed Steelhead appliances are capable of communicating with EMC Symmetrix arrays in order to dynamically disable their default compression for SRDF traffic. This allows the storage administrator from having to perform a bin file modification in the Symmetrix array. Steelhead appliances are also able to selectively apply the most effective optimization algorithm for each RDF group in an SRDF session. - Stream splitting for Microsoft Silverlight and Adobe Flash video: WAAS only supports stream splitting for the older Windows Media/RTSP, which today is infrequently used compared to more recent video delivery methods that use HTTP. Riverbed supports live video stream splitting and dynamic caching of video-on-demand files for Microsoft Silverlight and Adobe Flash. - WAN optimization for the Public Cloud: For customers planning to migrate servers to a public cloud, Riverbed offers the Cloud Steelhead solution for Amazon EC2 and soon and WAN optimization through Akamai for SaaS (Software-as-a- Service) environments. These new cloud-hosted capabilities interoperate with Steelhead appliances, Steelhead Mobile, and Virtual Steelhead, giving organizations maximum flexibility to optimize network traffic regardless of how users and data are distributed. Today, thousands of Riverbed customers rely on the above listed features and capabilities in their Steelhead deployments capabilities that are not available to WAAS users. Before seriously considering Cisco s WAAS offering, it s important to understand if any of these missing features are important to you. Consideration #3: Would you deploy WAAS Mobile even if it isn t a Cisco product? WAAS Mobile is a rebranded software product from ViaSat that is re-sold by Cisco. This arrangement makes WAAS Mobile an unusual product. In general, Cisco does not resell products from other companies; Cisco is known for either building products internally or acquiring them outright. Because WAAS Mobile is not a Cisco product, the future strategic direction of WAAS Mobile is unclear. This is an important issue for customers with mobile software requirements in WAN optimization, because ViaSat has been shifting development and marketing resources away from WAAS Mobile (including employee layoffs). However, the fact that WAAS Mobile is neither owned nor engineered by Cisco s development team has further implications there is no coordination or interaction between the WAAS Mobile solution and Cisco s WAAS appliances. The WAAS Mobile solution requires a completely separate and unrelated parallel infrastructure to any WAAS appliances that might already be deployed in an enterprise network; WAAS Mobile clients connect to a software application hosted on a standard Windows server, and not Cisco s WAAS appliances. WAAS Mobile clients also have to be manually disabled in order for end-users to utilize WAAS appliances that may be co-located in the same branch office. This makes coordination between the two different solutions a bit tedious when WAAS Mobile users occasionally connect while in a site already deployed with WAAS appliances. If support is needed, the deep expertise on WAAS Mobile is at ViaSat not at Cisco. Accordingly, support for WAAS Mobile may encounter inter-organizational coordination issues when asking Cisco for help on a non-cisco product. In contrast, the Riverbed Steelhead Mobile offering is completely integrated with Steelhead appliances. Steelhead Mobile clients connect with Steelhead appliances deployed in the data center often the same appliances that remote branch office Steelhead appliances connect with. Steelhead Mobile is also capable of coordinating and sharing data patterns with Steelhead appliances that are co-located in the same branch office. This is known as the Steelhead Mobile branch warming feature, available only from Riverbed. Finally, it s also significant that WAAS Mobile does everything differently from WAAS appliances, including different compression techniques, different management interfaces, and different traffic interception approaches. WAAS Mobile is a tunnel-based system that does not have autodiscovery capabilities, and requires that all server subnets be identified and configured into its management interface, along with the IP address of each WAAS Mobile server. Familiarity acquired from using one solution does not provide any leverage for using and configuring the other which is unfortunate because both WAAS and WAAS Mobile are rather difficult and tedous to configure and manage Riverbed Technology. All rights reserved. 3

5 Consideration #4: How do WAAS users address WAN optimization requirements for BC/DR? In August 2011, Cisco officially discontinued support for Replicator Mode in WAAS version 4.0.x. At the same time Cisco also made clear Replicator Mode is not available or supported in any other WAAS release. With the non-availability of Replicator Mode, WAAS users no longer have a disk-based data deduplication capability to optimize transfers of large amounts (e.g., multiple TB) of data between data centers, such as for business continuance and disaster recovery (BC/DR) purposes. Cisco s decision to give up on efforts to address BC/DR is further reflected by the observation that WAAS is not qualified by storage vendors such as EMC, HDS, IBM, and Brocade for use with their storage products. The WAAS DRE mechanism is simply too slow and inefficient to keep up with high-throughput data transfer requirements found in BC/DR applications. WAAS users who have requirements for disk-based data deduplication to optimize high speed DC-to-DC data transfers are therefore confronted with a need to also consider use of WAN optimization products from a different vendor other than Cisco. This is a significant consideration for enterprises who have needs for high-speed data replication over long distances, including for BC/DR. Consideration #5: Is there evidence that WAAS DRE problems have been fixed? DRE is Cisco s Data Reduction and Elimination mechanism in the WAAS device used for compression and data reduction of TCP traffic. Since the original introduction of the WAAS product over six years ago, Cisco has consistently denied that the perpeer data store design of the DRE mechanism ever resulted in a scalability or performance issue, despite customer complaints by current and former WAAS users. In a sudden turnaround, Cisco has implemented significant DRE design changes in WAAS version 4.4 in an apparent attempt to address these problems. The latest version of WAAS uses a new and more complex DRE design involving a shared data store with a per-peer index. Despite Cisco s claims that the new design changes in WAAS version 4.4 have fixed their DRE mechanism, they still saw the need to introduce unidirectional DRE mode. Cisco claims the primary advantage of unidirectional DRE is that it is faster than the bidirectional DRE, because it only stores data in the remote WAAS device that is receiving the traffic. Unidirectional comes with the drawback that traffic is only optimized in one direction of data transfer from the data center to the branch office, with no optimization in the reverse direction from branch office back to the data center. However, another drawback of unidirectional DRE is data corruption risk due to the possibility of hash collisions. Cisco describes their unidirectional DRE mechanism as only storing a fingerprint or signature for the original raw data in the sending WAAS device, as if that signature were uniquely associated with that raw data. But published work has shown that it is possible to construct different data that can have the same signature as the original raw data, leading to undetected data corruption in the unidirectional DRE mechanism (For more details on the problem of hash collisions, see An Analysis of Compare-by-Hash by V. Henson or Implicit within Cisco s descriptions about unidirectional DRE an admission that bidirectional DRE optimization is too slow, and therefore must be augmented with unidirectional DRE in order to gain performance benefits. Apparently, Cisco feels the performance problem with bidirectional DRE is a serious-enough issue that the tradeoffs of unidirectional DRE data corruption risk and loss of optimization in one direction are worthwhile and should be seriously considered. It s important to realize that both bidirectional and unidirectional DRE in WAAS version 4.4 are very new mechanisms that have not been extensively tested in production environments. Given that Cisco has historically had issues with WAAS when introducing new features or design changes, our earlier advice to seek references from Cisco customers that are using the redesigned WAAS product (version 4.4 or later) in large-scale WAN environments is especially important. Consideration #6: Can Cisco improve WAAS in the future? It s no secret that WAAS lacks many features and capabilities offered by the market-leading Riverbed product. But Cisco has continuously been promising their customers that they will eventually be able to "catch up to Riverbed. These promises date back almost seven years to the first days when Cisco began selling WAN optimization, but now many are starting to wonder if Cisco can ever execute on these promises. To gain some insight into these promises, it s important to realize that WAAS is not a new product. Rather, Cisco s WAAS product has a history that dates back to March of 2000, almost twelve years ago when it was originally created as a file caching product called ActaStor. That product was purchased by Cisco in 2004, and eventually re-named WAAS. Through the seven-year 2012 Riverbed Technology. All rights reserved. 4

6 timeframe that Cisco has owned and developed WAAS, the product has been subjected to a rushed and chaotic development environment. There was intense pressure on Cisco s developers to quickly introduce the new features needed to catch up to Riverbed, and this naturally spawned numerous bugs and other software problems that have plagued WAAS, and caused a number of serious difficulties for Cisco s early WAAS customers. As software professionals know, an emphasis on quick feature releases and short-term fixes, along with major decisions to redesign the core software functionality and architecture, eventually undercuts itself as the overall product becomes hard to understand, modify, and support. Today s WAAS product appears to be afflicted with extremely complex underlying software, primarily resulting from WAAS s rushed development environment. As a result, Cisco s WAAS development team has to cope not only with numerous bugs and product stability issues, but also significant challenges in adding the many new features and capabilities that are available from Riverbed but missing in WAAS. This issue was demonstrated in Cisco s last several major software releases of WAAS, versions 4.2, 4.3, and 4.4. What is remarkable about these software releases is their lack of major new functional capabilities that didn t already exist in previous WAAS software releases. After years of development effort, the Cisco engineering team was unable to introduce any new layer-7 application optimization capabilities (AO s). As of this writing (January 2012), AO s such as encrypted MAPI and SMBv2 that Cisco had promised for years to deliver are still not available in the latest WAAS 4.4 software. Given that the newer WAAS software upgrades only produced marginal changes and improvements, one has to wonder if future versions of WAAS will be much different from what Cisco s WAAS users must live with today. It appears the underlying complexities resulting from WAAS s early rushed software development may be affecting Cisco s ability to improve and add new features into their WAAS product. Conclusion There are a number of WAN optimization offerings available, with each vendor making significant claims for their own products. However, many have not experienced success in large-scale enterprise-wide deployments. It is important to look beyond the similar-sounding marketing claims and small-scale lab demonstrations, and on to larger issues that affect production networks. Riverbed has clear advantages for large-scale deployment that explain why its installed base is substantially larger than Cisco in terms of both the number of customers and the largest successfully-deployed networks. About Riverbed Riverbed Technology is the IT infrastructure performance company. The Riverbed family of wide area network (WAN) optimization solutions liberates businesses from common IT constraints by increasing application performance, enabling consolidation, and providing enterprise-wide network and application visibility all while eliminating the need to increase bandwidth, storage or servers. Thousands of companies with distributed operations use Riverbed to make their IT infrastructure faster, less expensive and more responsive. Additional information about Riverbed (NASDAQ: RVBD) is available at Riverbed Technology, Inc. 199 Fremont Street San Francisco, CA Tel: (415) Riverbed Technology Ltd. Farley Hall, London Rd., Level 2 Binfield Bracknell. Berks RG424EU Tel: Riverbed Technology Pte. Ltd. 391A Orchard Road #22-06/10 Ngee Ann City Tower A Singapore Tel: Riverbed Technology K.K. Shiba-Koen Plaza Building 9F 3-6-9, Shiba, Minato-ku Tokyo, Japan Tel: Riverbed Technology. All rights reserved. 5