Evolution of the Hybrid Enterprise

Transcription

1 White Paper Evolution of the Hybrid Enterprise Due to the increase in wide area network (WAN) traffic and application service demands, IT organizations have been evolving their WAN connectivity strategies to align with new IT cost, resilience, and performance objectives. Hybrid WAN is a growing trend with many organizations and enterprises, enabling them to augment traditional private leased lines or MPLS-based WAN circuits with secured public Internet services to achieve their goals. deployment and operation have made it a viable WAN Understanding Hybrid Architectures then forwarded on from the data center. In addition to WAN architectures have been evolving in response to major shifts in telecommunications and information technologies. The ubiquity of Internet connectivity in connectivity option as either a primary connection or a backup. Hybrid WAN uses a mix of both public Internet and private circuits, such as MPLS, for enterprise WAN transport. Internet as a WAN link coupled with the rise of cloud services whether Software-as-a Service (SaaS) or Infrastructure-as-a-Service (IaaS) create opportunities to reinvent the WAN architectures of the past and reduce operating costs. As shown in Figure 1, most enterprises today are using Internet as a secondary link to backhaul traffic to their data centers or any local point of presence where a Demilitarized Zone (DMZ) exists and security policies can be applied. Traffic destined for cloud providers is traditional MPLS backhaul, local Internet breakouts can also give access to cloud properties directly, as shown in Figure 2. various geographies and relatively lower cost of

2 Figure 1 Hybrid WAN with Internet traffic backhauled through the data center. Figure 2 Hybrid WAN with direct local Internet breakout. Internet connectivity, with its superior flexibility and price, provides a great option as either a primary WAN link or secondary link for branch connectivity. However, along with all its benefits, this approach also has a number of challenges. Requirements for a Successful Hybrid WAN Hybrid WANs lack uniform architecture deployment and heterogeneity across the WAN. Ensuring application performance across these environments becomes difficult to manage without a policy-based approach. Additionally, security concerns are compounded as the environment becomes increasingly distributed Riverbed Technology. All rights reserved. 2

3 Hybrid WAN architectures introduce several challenges: Efficiency Difficult and time-consuming to maintain and upgrade networks Less predictable performance, capacity, and reliability Delays in application deployment Complexity Exponentially increasing number of network policies Exposure of security weaknesses Requires more elaborate policies for security and performance Cost Increased Total Cost of Ownership (TCO) Under-utilized network resources Productivity reduced by poor application performance Hybrid networks can in fact exacerbate problems and increase IT operational expenditures. Thus, network operators face a conundrum; how to move to a hybrid WAN architecture to reduce bandwidth expenditures, without increasing the operational costs associated with managing these networks. A successful hybrid WAN architecture takes into consideration the workload requirements of applications to create an application-centric approach that delivers more control to network operators. An application-centric WAN architecture will: Improve Agility Rapid provisioning of applications Orchestration between application and network Streamline Management Centralized management for enterprise-wide Consistent deployment of application policies regardless of the transport Reduce Cost Reduced costs of operation Easier arbitrage between WAN links of varying costs The Riverbed Approach Riverbed takes a holistic, application-centric approach to solving the challenges of hybrid architectures. A network should serve the applications the business requires, enhance the user s experience of those applications, and allow for secure inter-communication amongst applications that require it. Riverbed solutions help organizations orchestrate a hybrid enterprise strategy that ensures exceptional application performance. Application-Centric Riverbed empowers IT to design and manage an application-centric hybrid enterprise network and finetune application performance with centralized global policy management and distributed policy enforcement. The enterprise defines a Global Policy indicating how an application (or group of applications) should be handled across the network. This policy includes parameters for various networking services (such as path selection and QoS) and, as shown in Figure 3, is distributed to various end points for more localized enforcement of network services. Whether designing or managing a hybrid WAN, centralized policy management and distributed policy enforcement: Simplifies configuration and management at scale Automates systematic control of application traffic Enables application-centric management 2015 Riverbed Technology. All rights reserved. 3

4 Figure 3 Global Policy with distributed, local policy enforcement Global Policy Components Policy-Based Application Routing Riverbed s SteelHead solution considers applications as the building blocks for application steering and Path Selection. Applications are treated as objects, each with different attributes that uniquely define the application s network requirements. A rich database of application knowledge underpins the Riverbed Application Flow Engine (AFE). The AFE recognizes applications by using port-based classification, application signature matching, protocol dissection, future flow registration, and behavioral classification. For ease of identification and system management, applications are tagged with the following attributes: Application Groups, Application Category and Business Criticality. SteelHead provides a built-in set of Application Groups that bundle enterprise applications with the same business intent into a group, as shown in Table 1. An enterprise-wide policy can then be applied to an Application Group and distributed to individual endpoint appliances for enforcement. Each application is also tagged with an Application Category and Business Criticality for ease of reporting and identification. Aggregating applications in Application Groups in accordance to their business intent simplifies enforcement of an enterprise-wide policy across the network, while enabling the network operator to create a differentiated set of network services to support each application s requirements Riverbed Technology. All rights reserved. 4

5 Application Group Business Voice Business VDI Business Video Business Critical Business Productivity Business Bulk Standard Bulk Application Group Description Includes all the business-level Voice over IP applications and protocols Includes all real-time interactive business-level virtual desktop interface (VDI) protocols Includes all business-level interactive video conferencing applications and protocols Includes network signaling protocols and business-level low latency applications Includes typical business productivity applications and protocols Includes business-level file transfer applications and protocols Includes general file transfer protocols and select internet sites Table 1 Application Groups and sample application memberships Quality of Service SteelHead provides a rich suite of Quality of Service (QoS)-related features to better manage application performance across the network. SteelHead appliances that are configured for QoS can identify applications, guarantee bandwidth and improve performance for latency-sensitive applications on the network thereby ensuring predictable performance. Path Selection and Application Routing SteelHead Path Selection leverages business intentbased policies to steer application traffic along alternate routes based on service metrics, such as path availability and priority. SteelHeads constantly monitor availability of links and dynamically switch paths if a primary path becomes unavailable. With standardsbased, Secure Transport functionality, SteelHead automatically encrypts all data in motion regardless of the path taken, enabling protected data transmission between SteelHead appliances over private, public, and hybrid networks. With integrated QoS and business-intent Path Selection, SteelHead provides IT organizations with the ability to control network consumption by steering application traffic to specific networks, with priority for businesscritical and latency-sensitive applications. SteelHead Secure Transport As shown in Figure 4, Riverbed SteelHead appliances use Group VPNs to facilitate Any-to-Any secure communication between SteelHead appliances in the same domain - any device that is part of a secure group can establish a secure tunnel to another member authenticated in the same group. Multiple Secure Transport groups on a given SteelHead can be used to create a secure multitenant solution for the branch user Riverbed Technology. All rights reserved. 5

6 Figure 4 Secure connectivity between SteelHead appliances in a group Building the Hybrid Enterprise A Riverbed central management console, the SteelCentral Controller for SteelHead (SCC), enables the creation of the Global Policy and definition of the Application Groups and Network Services policies that are applied to various applications. Global policies can be used to: Define a security policy to secure connectivity on certain network paths all applications on that network will use dynamically created IPSec tunnels The SteelCentral Controller for SteelHead scales to control thousands of appliances in the network. It distributes policies to individual SteelHead appliances that configure the data plane to identify and intercept specific application traffic, configure the various network services (QoS, Path Selection, and Secure Transport) and provide reports back on usage and application visibility in the network. The individual SteelHeads provide local enforcement, deciding how to best adhere to the global policy. Define path selection policies for an application group steer them over secure Internet paths Define QoS policies for an application group improve performance for latency sensitivity applications across the entire network 2015 Riverbed Technology. All rights reserved. 6

7 Figure 5 Building a hybrid WAN Conclusion Riverbed s hybrid architecture simplifies the laborious aspect of operating in a hybrid WAN environment by providing a very manageable set of application-centric network policies. These policies not only ease management, but also ensure that applications perform to the service level required by the business no matter where users are located. For IT, the easier applications are deployed, the faster business imperatives are met. As a leader in wide area networking, offering Riverbed s comprehensive visibility, optimization, and control solutions, Riverbed is well positioned to address the emerging requirements of the hybrid enterprise Riverbed Technology. All rights reserved. 7

8 Riverbed, at more than $1 billion in annual revenue, is the leader in application performance infrastructure, delivering the most complete platform for the hybrid enterprise to ensure applications perform as expected, data is always available when needed, and performance issues can be proactively detected and resolved before impacting business performance. Riverbed enables hybrid enterprises to transform application performance into a competitive advantage by maximizing employee productivity and leveraging IT to create new forms of operational agility. Riverbed s 26,000+ customers include 97% of the Fortune 100 and 98% of the Forbes Global 100. Learn more at Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used here are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners Riverbed Technology. All rights reserved. 8