Integrating SD-WAN with vCD (vCloud Director)

Introduction

SD-WAN is a highly-available, well-established, carrier class solution that facilitates on-demand, seamless and secure connectivity between any two points in a network. It is typically sold as a service with centralized, cloud-hosted orchestration and life-cycle management with zero touch deployment for rapid expansion of service footprint. SD-WAN is a disruptive technology that has the power to transform more than just branch connectivity. This article explains the overall architecture and benefits of integrating SD-WAN solutions into a vCD (vCloud Director) environment from both a provider and consumer perspective. Please see “why SD-WAN for hybrid cloud” for more information on the benefits of SD-WAN for enabling hybrid / multi-cloud.

Architecture overview

VMware SD-WAN from VeloCloud has three main components, an orchestrator, gateways and edges / hubs. Orchestrator is a centralized, multi-tenant, cloud-hosted platform that provides roles-based access to a single pane of glass for deployment, configuration, life-cycle management and transparency in SD-WAN network operations. The gateway is also multi-tenant and can be deployed and hosted in the cloud and optionally on-premise data centers. It is the primary component of the control plane and facilitates route exchanges for the SD-WAN network. The gateway also allows connectivity to legacy data-centers that support traditional site-to-site IPSec VPN’s. The third component is a software defined edge that is deployed on dedicated, pre-qualified hardware at the branch site or as software on existing compute / storage resources. The VeloCloud edge (VCE) is not multi-tenant and deployed one per branch, establishes secure management plane connectivity to the orchestrator and control plane connectivity to the gateway. It builds on-demand, secure tunnels to other branches and hubs, enforces business policies and is the primary component of the data plane in the SD-WAN network.

In the diagram above, there is one VCE per organization VDC. The VCE terminates tunnels from remote branches and allows secure access to services / assets within the VDC. Remote branches could be other private data-centers or public cloud instances such as EC2 on AWS or Azure. The VCE is deployed and managed by the provider / partner north of the org-vdc and does not count against tenant quota. SD-WAN is sold as a managed service to the tenants.

Why do it?

SD-WAN is the underlying technology that allows the tenant Org-VDC in a publicly hosted VCD environment (VCPP partners) to become part of the customers digital transformation journey to hybrid / multi-cloud.

What’s in it for the provider / partner?

• Extend service footprint to remote branches at a reduced cost
  • Build customer loyalty
  • Workload migration
• Additional revenue stream from existing customer base
  • Branch connectivity and hybrid cloud as a service
  • New service insertion at the branch like cloud security, L2/L3 VPN’s
• Invest in your customers’ business outcomes
  • Offer services that are relevant to customer business
• Seamless integration with public cloud
  • Help customers take advantage of public cloud
  • Seasonal elasticity / backup / disaster recovery
• Single pane of glass for network management, branch deployment and policy
  • Centralized policy configuration with immediate enforcement at branch sites
  • Rapid zero touch deployment of new sites (matter of hours)

What’s in it for the tenant?

• Single partner owns both data center and branch connectivity
  • Partner owns both ends of the SLA
  • Single point of contact – no finger pointing
  • Flexibility to migrate workloads to cloud provider or public cloud
• Network and services are more relevant to their business outcome
  • Appropriate services inserted at the branch
  • Application awareness and prioritization
  • Consistent Security policy for both public SaaS and hosted applications
• Reduced cost for remote connectivity
  • MPLS only used for backup or when SLA’s violated
  • Multiple broadband links for greater bandwidth
• Better service assurance and availability (Application performance)
  • Outage detection for service degradation
  • Automatic reroute of service requests based on monitoring KPI’s
  • Improved performance of SaaS applications (VoIP / Video calling)