Juniper SD-WAN Alexandre Cezar Consulting Systems Engineer, Security/Cloud

Transcription

1 Juniper SD-WAN Alexandre Cezar Consulting Systems Engineer, Security/Cloud

2 MARKET DYNAMICS

3 Branch/WAN Evolution: PMO FMO Bring Agility and Enhanced Customer Experience Utilizing Cloud Technology Legacy Branch (PMO) Future Branch (FMO) WAN Optimization Router NG Firewall UTM Firewall WLAN Controller Switch VIRTUALIZED SERVICE Juniper vsrx Cloud CPE Platform Services Application s Expensive, complex all-in-one box or many vendor inline boxes and cumbersome refresh Simple, customizable and instantaneous refresh

4 Branch/WAN Disruption and Transformation Case for Cloud CPE w/ SD-WAN User Experience Cloud/Connectivity Business On-Demand Self Service Application Aware WAN Reduced Capex/Opex Visibility and Control Hybrid WAN Flexibility Service Agility & DevOps Open, Flexible Choice Centralized Policy Control Pay-As-You-Grow Biz Model

5 What is SD-WAN? Network Service Activator SD-WAN Controller Orchestrator SD-WAN has four characteristics MPLS HQ Must support multiple WAN connections MPLS, Internet, LTE etc. Can do dynamic path selection Allows for load sharing across WAN links Branch Internet Data Center Provides simplified WAN management Must support zero-touch provisioning of remote branch Must support secure VPNs And have ability to integrate additional network services like Firewall, WAN Ops etc Reference :

6 JUNIPER SOLUTION

7 Juniper SD-WAN Solution Managed Juniper Sky ATP & Spotlight Secure Service Branch SRX Series OTT Hybrid WAN Managed NFX Series Service Orchestrator Campus Junos Space vsrx Branch A p p Office365 OTT Managed

8 Secure Branch Without Local Breakout With Local Breakout Non-optimized backhauled traffic MPLS MPLS HQ HQ Branch Branch Internet Internet Optimized local break-out traffic

9 Secure Cloud CPE Platform: NFX/SRX NFX Series SRX Series (NFX250 Shown) Router + switch + server providing robust foundation to simultaneously deliver virtual services (SRX1500 Shown) Multipurpose security focused appliances, right sized for the need Automated provisioning and pre-integrated 3rd party services and applications SD-WAN Security Services Applications SD-WAN Security CPU: Intel Multi-Core Xeon D System Memory: up to 32 GB DDR4 RAM System Drive: up to 400 GB SSD Service T-Put: 20Gbps Switch T-Put 88Gbps SRX T-Put: 500Mbps 10Gbps (SRX300 SRX1500 Series)

10 Flexibility and Scale Cloud CPE Product Portfolio CSO Automation, SD WAN, Security & LAN Open VNF Platform SRX300 SRX320 SRX340 SRX345 VNF vsrx NFX250 S2 NFX250 S1 VNF vsrx NFX Large vsrx VNF NFX250 LS1 NFX Small Shipping/SOPD Investigation Small Appliances Junos Small Server Medium Server Large Server Performance Custom PFE Gbps router Crypto acceleration Integrated Appliance/ No virtualization VDSL, LTE ATOM 4C/8C 2-4 VNFs Crypto acceleration Expansion slot / LTE Server Xeon D 6C / Pentium D 4C 2-8 VNFs AES-NI acceleration 1GE/10GE Server + HW PFE Xeon Multi-socket High Performance 1/10GE and higher Crypto acceleration Expansion slots Server

11 Service Simplicity with Cloud CPE Local Branch Application Aware (L7) Security Juniper Sky ATP & Spotlight Secure Service SRX Series Centralized Cloud CPE Application Aware (L7) Routing Centralized Policy Control Distributed Cloud CPE Secure and Managed VPN NFX Series Campus Service Orchestrator/ Controller Centralized Management Automated Service Delivery Regional Branch Managed vsrx Ent. App OTT vsrx VNFs IT and Telco Cloud Consistency VPN & POS Unmanaged

12 Juniper SD-WAN Architecture App Perf Monitor* CSO with Network Services Controller BGP* Net Act Netconf / Openconfig for configuration Standard data models for Device management VPN management Overlay Routing Policy Based Routing SLA measurement Telemetry/Analytics SRX/MX Headend Internet IPSec tunnels Corporate Office BGP for Overlay Routing App Analytics vsrx VNF Standardized probes: RPM Branch Office NFX Customer Premises Managed Access (Private WAN) SRX Remote Office Customer Premises Standardized Overlay with P2P, Hub/Spoke IPSec, Auto VPN, AD-VPN Control (BGP) Configuration IPSec VPN Connection SRX and vsrx (with NFX) is the EDGE platform for the Juniper SD-WAN Solution *Roadmap items

13 Contrail Service Orchestration (CSO) Network Svc Activator/Controller Downloads the image Configures the device Orchestrate device egress WAN policies Administration Portal Manages End-to-End Solution Allows Admin to Monitor and Troubleshoot Provides Workflows and Site Management Network Service Designer Define services Specify VNF onboarding process Create service chaining templates Customer Portal Provides Web Portal to Customer Select deployment model Self-select Network Services

14 SRX and vsrx SD-WAN Capabilities Advanced Policy Based Routing Application and User* aware policy based routing Load balance traffic over WAN Ifs based on link perf (RPM) Carrier Class Routing Highly Secure Multiple WAN interfaces types : TDM, DSL, LTE, Ethernet Full routing stack with overlay protocols (MPLS, GRE etc) FIPS complaint IPSec VPN with flexible deployments Advanced threat detection & mitigation with IPS, UTM, Sky ATP Management and Automation Zero Touch Provisioning with centralized mgmt & orchestrator On-box / off-box scripting capabilities automate repetitive tasks

15 Zero Touch Provisioning Work Flow 2 SRX320 3 Juniper Hosted Redirect tool Activation Server Contrail Controller 1. Administrator installs and setup activation server and adds device info to the activation server and Juniper hosted redirect tool 2. Device is powered up at remote branch and user adds activation code to the device 3. Remote device communicates with the Redirect tool and obtains contact info of activation server 4. Device authenticates itself to activation service using activation code and X.509 certs. After which it downloads Junos and configuration 5. Activation server sends a notification to the management server 6. Once device upgraded and configured itself, it connects to management server for further device management and orchestration

16 Advanced Policy Based Routing (AppRoute/APBR) Corporate HQ Enterprise App Server MPLS Applications N Branch Internet

17 SD-WAN - R2.1 Application Routing with vsrx/srx/nfx APBR supports DPI and pattern-matching capabilities of AppID to identify application traffic or a user session within an application Benefits: APBR Enhancements APBR allows you to define the routing behavior based on applications APBR provides flexible traffic-handling capabilities with granular control for forwarding packets based on application attributes Supports 3K+ application signatures Enables exception path routing for SD- WAN Application groups for easy policy selections (Web, Gaming, Multimedia etc) Supported from Junos Release 15.1X49-D60 onwards on SRX/vSRX/NFX Self Care Portal VNFs NFX/SRX Branch / Campus Network Controller Managed Access Internet (IPsec) GRE Distributed Cloud CPE Contrail Service Orchestration Edge Router (Existing PE device) SD-VPN GW Telco POP/ Infrastructure Admin Portal MPLS Core

18 SD-WAN - R2.1 Application Monitoring Basic Link Level Link Level Monitoring Support for following types of link level monitoring via SLA profiles on SCP Monitoring with Route Failover Monitoring with a DHCP Backup Interface Monitoring with Interface Failover Using Advanced Boolean Selection Monitoring in a Virtual Router Probe types supported in SLA profile HTTP GET request to a target URL HTTP GET request for metadata from a target URL ICMP echo request to a target IP address (the default) ICMP timestamp request to a target address UDP ping packets to a target device/ip TCP ping packets to a target device Dynamic failover to default path when threshold exceeded Self Care Portal VNFs NFX/SRX/vSRX Branch / Campus Network Controller Managed Access Internet (IPsec) GRE Distributed Cloud CPE Contrail Service Orchestration Edge Router (Existing PE device) SD-VPN GW Telco POP/ Infrastructure Admin Portal MPLS Core

19 QUESTIONS?

20 Thank You