In the early days of the Internet, enterprise networks followed a well-established blueprint: applications ran in centralized data centers, and users accessed them over private WANs. Connectivity to the Internet-based applications of the time – email, file transfers, and web browsing – was likewise centralized, and the associated public traffic was carried over the same private WANs. This was an appropriate architecture when Internet traffic was modest and sub-second latency was acceptable. And because connectivity to public networks was limited to a few physical locations, it made the network easier to secure by minimizing the potential attack surface.
But as the Internet rose to prominence, the situation changed. Many internally hosted applications were replaced with powerful SaaS alternatives, and the amount of Internet traffic on the WAN increased substantially. Moreover, new bandwidth-hungry applications such as cloud-based storage began to overload legacy WAN links, and real-time applications such as UCaaS performed poorly across congested WANs with the latency overhead of centralized Internet access.
Consequently, enterprises scrambled to deploy hybrid WANs, adding local Internet access at each location. This had the desired effect of offloading Internet-based traffic from the private WAN, and it avoided the latency overhead of routing through centralized data centers. But these gains weren’t achieved without trade-offs: the network grew more complex and difficult to manage, and the potential attack surface increased significantly, making the hybrid WAN more difficult to secure.
SD-WAN: Harmonizing the Hybrid WAN
With the emergence of SD-WAN, the physical distinction between private WAN and public Internet has blurred: the private WAN has become a virtual “overlay” network running atop one or more public networks (the “underlay”), and SD-WAN software now determines how application traffic is routed. Internet-based applications can be broken out locally to use the underlay natively, while private traffic is encrypted and tunneled between locations in the overlay.
Although SD-WAN adds intelligence and flexibility to the hybrid WAN, it is subject to the same security and latency trade-offs. Using local breakout minimizes latency, but it expands the attack surface to include every location, and some of SD-WAN’s most powerful features such as Forward Error Correction and packet level link steering are only available in the overlay.
Cloud Firewalls to the Rescue
Fortunately, there is an alternative wherein the benefits of centralized security can be achieved while keeping latency in check. Managed secure SD-WAN providers who operate their own backbone networks can offer cloud-based firewalls for regionalized secure Internet access. This avoids the need to open up public network access at all locations, and it allows Internet traffic to enjoy the full benefits of riding the SD-WAN overlay. A well-designed cloud-based firewall design will align with the geographical footprint of the enterprise, ensuring all locations can reach the Internet without excessive delay. From a performance and security perspective, SD-WAN combined with regional cloud-based firewalls offers the best of both worlds!
About GTT
GTT connects people across organizations, around the world, and to every application in the cloud. Our clients benefit from an outstanding service experience built on our core values of simplicity, speed, and agility. GTT owns and operates a global Tier 1 internet network and provides a comprehensive suite of cloud networking services. We also offer a complementary portfolio of managed services, including managed SD-WAN from leading technology vendors.
