The Business Benefits of Implementing NFV: New Virtualized vcpe Enterprise Services

WHITE PAPER The Business Benefits of Implementing NFV: New Virtualized vcpe Enterprise Services Sponsored by: HP Nav Chander November 2014 EXECUTIVE SUMMARY IDC believes that communication service providers (CSPs) will have to transform their current network architecture to a Network Functions Virtualization (NFV) enabled network environment to remain competitive and also evolve their business service models, network infrastructure investments, and operational structures to be more flexible and to improve profitability longer term. This IDC white paper provides an analysis of a specific HP NFV vcpe solution/use case by comparing it with legacy network services (virtual private network [VPN], firewall, acceleration, session border control [SBC]) that rely on dedicated CPE today. This analysis provides the relative quantitative benefits of vcpe versus traditional CPE, based on discussions with HP NFV customers and IDC data. IDC analysis shows that there is a potential TCO savings of 39 44% in implementing a vcpe solution compared with the existing enterprise services implemented in CPE, such as IP VPN, firewall, SBC, and acceleration. IDC also notes that the additional and important benefit of implementing a vcpe strategy is the service provider's ability to easily scale to upsell additional managed services and deliver more of these virtualized services via the same vcpe. BACKGROUND Today's CSPs face considerable business challenges in supporting the exponential growth of data traffic communications throughout their network infrastructure while continuing to generate reasonable return on investment. IDC's 2014 survey results and interviews with enterprise CIOs consistently indicate that enterprises will increasingly rely on analytics, Big Data, cloud connectivity, IT virtualization, and mobile solutions and services to support their businesses in an ever-increasing, always-connected world. As more enterprises and consumers shift their workloads and applications to the networked "cloud," they are following a transformation similar to that of the IT virtualization of compute, storage, and server resources that has occurred during the past 10 years. The requirement for this increasingly always-connected networked business model is forcing many CIOs to consider alternatives to their ICT strategies and the status quo relationship for procuring data, Internet, and voice services with a CSP as well as the capital expenses (capex) to handle the increasing cost for supporting networking of their business applications, third-party solutions, and November 2014, IDC #252279

external Web 2.0 apps. In addition to the need for more bandwidth, there are also new expectations to leverage pay-per-use, self-service upgrades via portals and access to more cloud-based services. This shift in enterprise and consumer adoption of virtualized services is forcing CSPs to transform their telecom network infrastructure to become more agile, flexible, and open and migrate to a programmable environment that will be capable of profitably supporting the global growth and adoption of mobile and cloud services in the business and consumer segments. According to IDC's Global Telecom Indicator (GTI), which tracks capex expenditures of over 700 CSPs globally, the reality for more than 90% of CSPs is that they have flat or slightly declining capex budgets. This comes at a time when CSPs are transforming their legacy network and IT infrastructure platforms and business models that support delivering dedicated physical network communication resources to enterprises. Increasing competition from alternative cloud service providers such as AWS, Microsoft Azure, Google, Rackspace, and others is adding additional pressure as enterprises and consumers shift their workloads to cloud environments. How can CSPs leverage their expertise as providers of value-added, managed communication services while also providing on-demand, flexible, and self-service customer Web-based portals to enable cloud service connectivity options? Today, many CSPs are evaluating NFV and software-defined networking (SDN) technology solutions from a wide range of network equipment vendors (NEPs), IT suppliers, and ISVs. Their key objectives are to seek alternative networking platforms that will allow them to transform their current operational business models to enable new and rapid service creation, lower operating expenses (opex) and capex, and provide the framework for future multivendor, programmable, software-based service architectures from NEPs and IT vendors like HP. This network virtualization strategy will enable service providers to: Increase revenue by accelerating delivery of new and differentiated services Reduce up-front capex and improve asset utilization Provide on-demand service delivery through customer self-service portals Reduce operational costs and time-to-service implementations from months to weeks CSPs cannot continue to evolve their network infrastructure requirements by relying on the typical 6- to 18-month window to receive a new software product release from their NEPs that will, in turn, require significant CSP resources to integrate, test, and deploy in the network. The objectives set out by the ETSI NFV ISG aim to address these problems by defining the requirements and architecture for the virtualization of network functions in carrier environments. The completion of this effort will result in standard IT virtualization technology to consolidate many network equipment types onto industrystandard high-volume servers, switches, and storage. It involves implementing network functions in software that can run on a range of industry-standard server hardware and that can be moved to, or instantiated in, various locations in the network as required, without the need to install new equipment. It will also provide carriers with the flexibility to integrate these virtual network functions (VNFs) in a new multivendor NFV framework. 2014 IDC #252279 2

To date, the NFV ISG has completed documenting a comprehensive framework and set of requirements for a carrier NFV environment (architecture, taxonomy, use cases, proof of concept, test). One of the key NFV use cases is virtual network function as a service (VNFaaS), which moves the virtualization of the CPE functionality into the carrier network. The virtual enterprise CPE (ve-cpe) solution is one of the most important implementations of VNFaaS and one that many CSPs are evaluating because it enhances the CSP's ability to easily offer managed enterprise virtualized service offerings by replacing dedicated hardware appliances with NFV-compliant virtual appliances that support virtual functions such as routing or firewalls in software. These NFV appliances are managed by carriers from their managed NFV network infrastructure, which can easily provide new functions via software downloads to these virtualized appliances at enterprise sites. VNF services provided by the ve-cpe may include a router providing quality of service (QoS) and other high-end services such as L7 stateful firewall, intrusion detection and prevention, acceleration, application delivery control, and other value-added services. Market Opportunity for vcpe Services Today's CSPs operate broadband residential and fixed enterprise networks that support voice, video, Internet, and high-speed data services. Enterprise data and voice services are delivered to the enterprise's physical office locations or customer premises with one or more dedicated network termination devices such as routers, Ethernet switches, or gateway products. All the dedicated customer premises equipment must be ordered, configured, scheduled, provisioned, and installed by CSP staff as part of a managed service. This is a complex, expensive, and time-consuming process for CSPs, which are trying to shorten service delivery time, improve self-service capabilities, enhance flexibility, and also lower opex. For CSPs, the driver for a vcpe solution is the promise of a standard hardware appliance, likely an x86-based CPU platform or an open network device, and is a confluence of network and server capabilities. It is capable of running VMs, supports general packet processing and basic L2/L3 switching, and also becomes a premise platform that can support a variety of orderable, softwarebased VNFs. Network capabilities include LAN ports, fiber ports, WiFi, and 4G/LTE. Server capabilities, which can be virtualized, include a high-performance CPU, memory, and storage. CSPs intend to ship the network appliance to enterprise sites, power up the appliance, and complete the installation process within minutes compared with days and weeks and without the requirement for a proverbial truck roll, which is expensive ($500 1,000). CSPs will then be able to offer software feature sets (i.e., VNFs) for each application (vfirewall, VPN, optimization, IDT, ADC) from a customer self-service portal or set of feature packs that can be automatically downloaded to the appliance once the device is registered and part of the network. For CSPs, the implementation of a vcpe strategy for delivering broadband and enterprise communication services represents one of the largest business opportunities to positively impact top-line revenue, reduce opex, and retain customers. IDC forecasts that the global managed network services (MNS) segment will grow from $72 billion in 2013 to $102 billion by 2017, a CAGR of 10%. IDC predicts that implementing vcpe solutions will enable CSPs to transform and improve the cost structure, speed of delivery, and flexibility to offer and support new and existing enterprise services compared with the current business CPE delivery models. Two of the largest vcpe applications today are managed MPLS/IP VPN enterprise services and firewall services, which together account for over $45 billion of global managed services revenue. For CSPs, vcpe can also serve as a single platform 2014 IDC #252279 3

that can support additional value-added managed services including application performance management, security enhancements, and optimization without requiring expensive, dedicated appliances for each offering. Today, enterprises rely on enterprise network solutions that are defined by access bandwidth, network protocols, and a host of different equipment choices and hardware configurations that add to the cost of the service. For CSPs, there are issues with maintaining and supporting myriad legacy CPE devices for every type of managed service offering. There are testing, integration, inventory, staging, truck roll, and installation costs, which add more opex and reduce profitability. vcpe Solution Alternatives Because today's managed enterprise service offerings such as IP VPN, Carrier Ethernet, and security rely on dedicated CPE, enterprises face a higher initial cost, longer installation intervals, and difficulty with modifications and upgrades. The traditional CSP service activation process is also slow and vendor specific, creating customer dissatisfaction. Every CPE vendor has a proprietary hardware and software platform that requires training and technical expertise, which the CSP has to invest in. Adds, moves, or changes frequently require replacement of the CPE, which further increases CSP costs associated with truck rolls, manual updates to databases, and network elements onsite, at the network operations center (NOC), and at the customer services center. The service provider's ability to innovate and offer new revenuegenerating software services is compromised. An appliance-based vcpe replaces a physical purpose-built CPE with a simple on-premise x86-based routing appliance that a CSP can use for supporting one or more managed services and reduces the requirement for multiple dedicated CPE hardware. Software can be distributed from a CSP's provider edge network or SDN controller, which moves some of the intelligent IP VPN and firewall functions to the provider edge. Figure 1 depicts an HP vcpe solution that manages the configuration and distribution of virtual software elements, including VPN, optimization, firewall, and an SBC via an HP NFV Director vcpe network management platform. Several things have to be considered when deploying NFV, including accrued cost savings, business models, and architectural options. Cost must be considered over a full five-year life cycle that would include capex as well as opex. Capex (hardware and software licenses) reductions may become apparent immediately, while opex (installation, support, and power) will improve over time. 2014 IDC #252279 4

FIGURE 1 HP vcpe Enterprise vcpe applications vcpe management vcpe vnfds Firewall acceleration Router DHCP IPv4/IPv6 VPN Deploy, configure, and monitor (vcpe services) HP NFV Director Deploy, configure, and monitor (hardware, virtualization) Deploy, configure, and manage (access network) (optional) vcenter ops. manager Firewall manager Customer s internal network vcpe app images NFV infrastructure (COTS server) Customer sites access Access network Configure and manage CSP Back end office/ DC customer site Source: HP, 2014 Comparing Legacy CPE and vcpe IDC conducted an analysis of the total cost of ownership (TCO) for implementing NFV technology for a vcpe enterprise use case compared with the existing CSP-managed CPE delivery models, or the present mode of operation (PMO). The use case represents a typical CSP that delivers dedicated IP VPN, firewall, SBC, and acceleration services to a medium-sized enterprise with 250 branch offices. The 250 branch offices are made up of 50 small (<25 employees), 150 medium-sized (25 99 employees), and 50 large (100 500 employees) branch office locations that require this set of services. IDC's analysis includes assumptions regarding the costs of virtual and physical appliances, routers, labor, and power consumption. Table 1 lists the cost items used for this comparison. 2014 IDC #252279 5

TABLE 1 vcpe and CPE TCO Comparison by Branch Size Small (<25 Employees) Branch Size Medium Sized (25 99 Employees) Large (100 500 Employees) Cost model 2a 2b 3a 3b 4a 4b Router type Hardware Software Hardware Software Hardware Software Branch services Firewall, VPN Firewall, VPN Firewall, VPN, acceleration Firewall, VPN, acceleration Firewall, VPN, acceleration, SBC Firewall, VPN, acceleration, SBC Hardware required Small CPE router + one appliance Small vcpe Medium-sized CPE router + two appliances Medium-sized vcpe Large CPE router + three appliances Large vcpe Software required Included Routing VNF + FW VNF Included Routing VNF + FW VNF + acceleration VNF Included Routing VNF + FW VNF acceleration VNF + SBC VNF Hardware cost ($) 4,500 500 11,500 800 22,000 1,000 Software cost ($) 0 2,500 0 6,800 0 12,000 Installation/ configuration time (hours) Installation/ configuration costs ($) Support costs (3 year) ($) Power costs (3 year) ($) 8 3 12 3 16 3 800 250 1,200 275 1,600 300 2,025 1,350 5,175 3,420 9,900 5,850 792 360 2,280 720 2,280 720 Total costs ($) 8,117 4,960 20,155 12,015 35,780 19,870 TCO savings (%) NA 39 NA 40 NA 44 Source: IDC, 2014 2014 IDC #252279 6

IDC evaluated the CSP costs of deploying an HP hardware based CPE solution to every site. This managed VPN bundled service requires a dedicated hardware-based router for VPN and firewall services and also dedicated appliances for the acceleration and SBC services at every branch office. There are initial costs and ongoing costs associated with delivering the managed services bundle. HP also has traditional purpose-built CPE products that can support these services, such as the MSR3000 and a pure server-based approach with a non-customized HP server. IDC estimated the cost of deploying a vcpe solution for the VPN, firewall, acceleration, and SBC enterprise branch services. The solution uses an x86-based vcpe appliance with routing and communication software to support VNF instances for each of the four branch services. For the medium-sized and large branch offices, the HP vcpe appliances include additional capabilities such as an LTE interface for wireless access to 4G networks as well as multiple LAN ports and an integrated wireless LAN. Figures 2 and 3 provide a cost comparison for the initial year one costs and ongoing yearly costs for the legacy CPE solution and the HP vcpe alternative solution for this 250-branch use case. FIGURE 2 Comparison of Initial Costs for a 250-Site Network 5,000 4,000 3,000 Costs ($000) 2,000 1,000 0 1,000 2,000 3,000 Hardware Software Install Support Power Total Costs ($000) vcpe scenario $195 $1,745 $69 $291 $54 $2,354 Costs ($000) legacy CPE scenario $3,050 $0 $300 $458 $165 $3,973 Costs ($000) vcpe savings $2,855 $1,745 $231 $167 $111 $1,619 Note: IDC used the costs listed in Table 1 and the Appendix. Source: IDC, 2014 2014 IDC #252279 7

FIGURE 3 Comparison of Ongoing Yearly Costs for a 250-Site Network 700 600 500 Costs ($000) 400 300 200 100 0 Hardware Software Install Support Power Total Costs ($000) vcpe scenario $0 $0 $0 $291 $54 $345 Costs ($000) legacy CPE scenario $0 $0 $0 $458 $165 $623 Costs ($000) vcpe savings $0 $0 $0 $167 $111 $278 Note: IDC used the costs listed in Table 1 and the Appendix. Source: IDC, 2014 The HP vcpe appliance solution consists of a small form factor platform with an embedded x86 processor architecture. This virtual CPE appliance provides the same functions and experience as the physical router, but it can operate on a standard x86 appliance. The vcpe appliance supports MPLS VPN, stateful firewall, and VXLAN for integration into cloud-based hypervisor environments. This vcpe solution includes a built-in GUI to enable easy setup and installation into a virtualized environment that uses industry-standard hypervisor technologies remotely and further simplifies service additions with scripting. Another key characteristic is the ability to add multiple VNFs via software downloads to each branch server for every managed service application, which can be easily done at installation or as an in-service upgrade remotely without the need for a truck roll. Installation costs are significantly lower because less hardware is required in the case of vcpe, and it is also designed for DIY installation unlike specialized hardware, which requires installation of dedicated CPE appliances. Other recurring costs such as support and power are also lower. Maintenance, space savings, and sparing reduction can also add additional savings. As the cost model discussed previously shows, a medium-sized 250-site enterprise branch NFV vcpe deployment can reduce initial CSP costs from $4.0 million to $2.35 million, or about 41%, in the first year. Even if there is an increase in software costs, the reduction in hardware, installation, configuration, and power costs more than compensate, resulting in a five-year savings of $2.7 million. 2014 IDC #252279 8

Also, adding incremental software services via another virtual instance or VNF is a simpler and less expensive process for future upgrades or customer purchases. Additional benefits that will accrue over time from new revenue opportunities are not considered in this analysis. This includes lower costs to upgrade new revenue-generating software services or features, which may be downloaded by the enterprise IT manager via a self-service portal or from the CSP NOC. The vcpe software licensing model allows CSPs to offer more pricing flexibility to their enterprises and offer some discounts based on the number of VNFs deployed per vcpe or the number of vcpe, similar to the server pricing that IT procurement staff are familiar with. Figure 4 indicates a possible licensing model for increasing VNFs per vcpe. IDC estimates that CSPs may yield an extra 10 15% revenue from upselling additional services via VNFs to enterprises for services that these enterprises may be interested in using but have found too expensive as standalone services or too difficult to support themselves. FIGURE 4 Evolution of License Price with Number of vcpe $600 $500 License price/vcpe $400 $300 $200 $100 $0 500 1000 2000 3000 5000 10000 VNF = 2 VNF = 3 VNF = 4 VNF = 5 VNF = 6 Source: HP, 2014 Tier 1 CSPs are planning early trials to deploy a multitenant cloud-based vcpe offering (see Figure 5). This is a secure managed enterprise service that the CSP can enable for enterprises to add/change bandwidth or even download new software services (VNF) by enabling them on a self-service portal. The example shown in Figure 5 is another opportunity for CSPs to become more agile and creative in offering flexible, multitenant vcpe branch solutions that can be customized to securely support each tenant's unique requirements for dedicated or on-demand bandwidth, security, and service. This can create service differentiation and also significant customer satisfaction as install intervals for CSPs approach times similar to those of large public cloud service providers such as AWS and Microsoft. 2014 IDC #252279 9

FIGURE 5 Value-Added Enterprise vcpe Service Company A Tenant A Bandwidth: 10Mbps Service chain: IPSec + routing + SSL + firewall vcpe service portal vipsec vrouter vssl vfirewall Company B Cloud vcpe Tenant B Bandwidth: 50Mbps Service chain: IPSec + routing + NAT + firewall vcpe service portal vipsec vrouter vnat vfirewall Source: HP, 2014 BUSINESS BENEFITS The vcpe enterprise services business case is compelling, with 24 29% capex savings compared with deploying legacy CPE. This capex savings benefits CSPs that have to support CPE replacements for existing aging CPE at enterprise branch office sites, expansion of existing customers' new branch office sites, or new customers' office sites. IDC estimates that CSPs will benefit from additional capex savings because there will be lower hardware costs for sparing the vcpe appliances than traditional legacy CPE. IDC RECOMMENDATIONS IDC believes CSPs have to consider a number of important features when evaluating NFV, SDN, and network virtualization solutions from network equipment vendors, especially as NFV continues to evolve. IDC recommends that CSPs look for vendors with the following attributes: Offer a platform-based open NFV architecture that embraces the use of third-party vendors and allows CSPs to choose best-of breed VNF solutions Have industry expertise with IT virtualization and network virtualization solutions that can leverage open source hardware and software platforms Are active in contributing to and leading developments in open source communities such as OpenStack, ONF, and OpenDaylight and advance the goals of the ETSI NFV ISG and OPNFV Have an ecosystem partner program and technical resources including interoperability labs to support CSP evaluations and proof of concepts for NFV 2014 IDC #252279 10

Have an NFV network management and orchestration platform to enable vcpe solutions Have extensive technical and systems integration expertise to help CSPs adapt to and embrace open platforms The HP NFV Director, Virtual Service Router, OpenNFV Labs, and NFV network virtualization architecture provide a comprehensive framework and set of product and management tools that enable CSPs to develop, implement, and deliver a suite of new virtualized enterprise vcpe services to enterprises. The vcpe enterprise services business case demonstrates that there are opex benefits for CSPs. IDC analysis confirms that the initial installation costs, which consist of configuration, testing, and implementation of a vcpe solution and each VNF instance at each branch site and ongoing support costs, are significantly lower than costs for the legacy CPE enterprise solutions. CSPs that are developing or plan to offer Web portals and self-service customer tools that can be used with a vcpe solution will be able to lower opex costs further. CSPs' enterprise customers will also benefit from the vcpe solution with faster service delivery and easier upgrades for additional services without the service costs of a truck roll. Most enterprises experience a 30- to 60-day installation interval for managed enterprise services because of existing CPE installation processes and hardware constraints. In the current environment, enterprise IT and communication managers have limited resources, time, and budgets to manage, configure, and support services. The vcpe is an ideal platform that makes service deployment more convenient for the enterprise as well, and combined with a Web portal, it makes information and data about the services more accessible. APPENDIX: DEFINITION AND ASSUMPTIONS The following definitions and assumptions (see Table 2) were used to develop the TCO comparison: Small branch office: An office with up to <25 employees who require communication services including voice, data, Internet access, and access to corporate Web servers, databases, and datacenters Medium-sized branch office: An office with 25 99 employees who require communication services including voice, data, Internet access, and access to corporate Web servers, databases, and datacenters Large branch office: An office with 100 500 employees who require communication services including voice, data, Internet access, and access to corporate Web servers, databases, and datacenters 2014 IDC #252279 11

TABLE 2 Branch Cost Assumptions Item Value Typical small VNF $2,000 Typical small hardware appliance $3,500 Typical medium-sized VNF $3,000 Typical medium-sized hardware appliance $5,000 Typical large VNF $4,000 Typical large hardware appliance $6,500 Small CPE router $1,000 Medium-sized CPE router $1,500 Larger CPE router $2,500 Small vcpe appliance $500 Medium-sized vcpe appliance $800 Large vcpe appliance $1,000 Typical small routing VNF $500 Typical medium-sized routing VNF $800 Typical large routing VNF $1,200 Basic hardware install hours 2 Local software configuration hours 2 Remote software configuration hours 0.25 Installation labor/hour $100 Support cost/year 15% Power consumption/vcpe (kw) 0.3 Hours of use/year 4,000 Power cost/kwh $0.10 Power consumption/small CPE (kw) 0.03 Power consumption/medium-sized CPE (kw) 0.06 Power consumption/large CPE (kw) 0.1 Power consumption/large vcpe (kw) 0.6 Source: IDC, 2014 2014 IDC #252279 12

About IDC International Data Corporation (IDC) is the premier global provider of market intelligence, advisory services, and events for the information technology, telecommunications and consumer technology markets. IDC helps IT professionals, business executives, and the investment community make factbased decisions on technology purchases and business strategy. More than 1,100 IDC analysts provide global, regional, and local expertise on technology and industry opportunities and trends in over 110 countries worldwide. For 50 years, IDC has provided strategic insights to help our clients achieve their key business objectives. IDC is a subsidiary of IDG, the world's leading technology media, research, and events company. Global Headquarters 5 Speen Street Framingham, MA 01701 USA 508.872.8200 Twitter: @IDC idc-insights-community.com www.idc.com Copyright Notice External Publication of IDC Information and Data Any IDC information that is to be used in advertising, press releases, or promotional materials requires prior written approval from the appropriate IDC Vice President or Country Manager. A draft of the proposed document should accompany any such request. IDC reserves the right to deny approval of external usage for any reason. Copyright 2014 IDC. Reproduction without written permission is completely forbidden.