Sponsored by: Cybera This paper highlights emerging trends in software-defined wide area network deployments, particularly in relation to challenges faced by distributed enterprises. Customizing SD-WAN for the Distributed Enterprise August 2018 Written by: Brandon Butler, Senior Research Analyst, Network Infrastructure, and Rohit Mehra, Vice President, Network Infrastructure The Promise of SD-WAN The WAN needs to be reinvented. Driven by myriad transformations from across the mobility and cloud landscape, organizations are realizing the limitations of traditional network connections used to provide connectivity for remote sites to corporate datacenters and the cloud. There s a fundamental shift requiring increased network flexibility and security, as well as the need to make networks more dynamic a trend that began in the datacenter but in recent years has spread to the WAN, creating the need for software-defined wide area network (SD- WAN). AT A GLANCE KEY STATS Spending on SD-WAN infrastructure will reach $4.5 billion by 2022; meanwhile, the SD-WAN managed services market will be worth $5.4 billion by 2022. WHAT S IMPORTANT SD-WAN optimized for distributed enterprises does not require high touchpoint installations and management. Consequently, organizations are looking increasingly to implement SD-WAN technologies. Empirical data backs this up: In IDC's U.S. Enterprise Communications Survey, conducted in the spring of 2017, more than 82% of respondents indicated that they would be using SD-WAN at some point. Approximately 75% indicated that they were already using or would be using SD- WAN within two years (see Figure 1). Moreover, in IDC s 2017 Software-Defined WAN Survey, 64% of respondents indicated that SaaS would be important to their organization s WAN technology choices within the next two years.
FIGURE 1: SD-WAN INTENT TO DEPLOY Q. Are you implementing or do you plan to implement software-defined WAN technologies? Currently use Plan to use within 1 year Plan to use in 1 to 2 years Plan to use in more than 2 years Do not use/have no plans to use Not familiar with this service/technology 0% 5% 10% 15% 20% 25% 30% 35% 40% Source: IDC s 2017 U.S. Enterprise Communication Survey, n = 1,200 Managing WAN environments poses unique challenges compared with other aspects of the network. For one, cloud-based software-as-a-service (SaaS) applications have become mainstream and have created additional strain on the WAN due to their mission criticality and need for guaranteed levels of performance. The pervasiveness of mobile computing and new trends such as Internet of Things (IoT) deployments will only continue to increase demands put on the WAN. Meanwhile, organizations are realizing the limitations of their current WAN architectures, which do not typically provide for centralized management, prioritization of applications or assurances of security, or performance of applications on the network. These trends have led to the rise of the SD-WAN market in recent years. IDC estimates that spending on SD-WAN infrastructure will rise from $832 million in 2017 to become a $4.5 billion segment of the market by 2022. Meanwhile, SD-WAN managed services will be a $5.4 billion market by 2022, with a strong compound annual growth rate of 77.2%. As shown in Figure 2, network reliability, secure connectivity, and flexibility in bandwidth management are top considerations when selecting virtualized solution providers. #US44182718 Page 2
FIGURE 2: TOP CONSIDERATIONS WHEN CHOOSING A VIRTUALIZED SOLUTION PROVIDER Q. Which of the following attributes of a virtualized network service or solution are the most important considerations when choosing a solution provider? 99.999% network reliability Secure network connectivity Flexibility to add/change bandwidth capacity in near real-time Application-based SLAs for each virtualized network service Managed security policies and templates Plug and Play x-86-based CPE Branded vendor network operating system (NOS) e.g., Cisco IOS, Juniper JunOS, Alcatel-Lucent SR OS Interoperability with existing network equipment and CSP network Support for multi-vendor equipment in a virtualized solution Bandwidth & application optimization tools Monitoring of virtual network connections to SaaS providers Self-service portal for making changes to service bandwidth, CoS or policies 0% 10% 20% 30% 40% 50% 60% Source: IDC s 2017 U.S. Enterprise Communication Survey, n = 1,200 Without SD-WAN, organizations have typically relied on costly and inefficient models for connecting their remote sites. Some organizations even backhaul traffic from cloud applications all the way to a corporate datacenter before delivering it to the remote site, through either a VPN or an MPLS link. This model does not allow for granular control of security policies on individual applications, nor does it allow prioritization or optimized routing of certain applications. SD-WAN, on the other hand, provides benefits that specifically address these pain points:» Provide direct connectivity between the remote site/iot network and cloud, or remote site/iot network and datacenter, thereby reducing the need to backhaul traffic to the corporate datacenter or pay for expensive MPLS links.» Provide granular management of individual applications being delivered to the remote site. SD-WAN users can segment traffic into virtual networks, individually managing performance, reliability, and security policies on a per-application basis.» Ensure compliance with stringent regulatory requirements through dynamic and secure connectivity of apps to remote sites, with integrated firewall capabilities.» Centrally manage WAN policies across a large organization, including monitoring usage, setting policies and, in the future, using machine learning technology to dynamically optimize traffic routing and remediate issues that arise. SD-WAN: One Size Does Not Fit All Not all organizations have the same priorities when modernizing their WAN footprint, however. Distributed enterprises with a large number of small sites require centralized, yet granular, #US44182718 Page 3
secure management of policies. IT budgets of distributed enterprises must cover hundreds, if not thousands, of small-footprint business locations, creating the need for a large-scale, secure, cloud-based overlay management platform. Each remote site may have a handful of applications (or more) that need to be delivered, each with its own requirements for performance guarantees and security/compliance. These include cloud-based SaaS applications, mission-critical payment system apps, and legacy facilities management systems. Meanwhile, organizations are increasingly looking to support the rollout of Internet of Things (IoT) applications, which will only put increased strain on the network as more devices are connected and need to be managed by the WAN. By nature, SD-WAN rollouts must be lowtouch installations because there are few or no technical staff onsite at remote locations. Deployments of new technology need to be easy, fast, and repeatable (taking hours or days, not months). Industries that most acutely face these issues include retail, chain restaurants, convenience stores, gas stations, banking/finance, and medical clinics. Gas station and convenience store chains, for example, can have tens or thousands of remote sites or IoT devices that are centrally managed. Most stores do not have technical IT staff, and some are in remote locations. Yet multiple applications need to be delivered, including payment stations in the store, payment stations at a fuel pump or kiosk, and integrated loyalty and lottery programs, along with sensors reporting data from refrigeration systems, a car wash, or fuel storage tanks. There are also regulatory issues to deal with. A critical component of remote site technology is to meet compliance with Payment Card Industry (PCI) Data Security Standards both in-store and at the gas pump (essentially, an unattended kiosk that takes credit cards and mobile payments). Another example of regulatory compliance involves monitoring for a fuel leak, in which case the environmental authorities need to be automatically notified. Some applications need highly reliable and secure connections, such as payment systems, often with the need for a mobile backup to the primary broadband. However, an app that backs up weekly logs does not need as high of a priority network connection. Many SD-WAN offerings on the market now require high touchpoint installations and management. In fact, installations can typically take multiple days, weeks, or months to convert applications and systems into a new deployment. These offerings are not optimized for distributed enterprises. Increasingly, organizations are looking for remote site technologies that offer robust security, ease of installation and centralized management. In the future, additional components of remote/branch office technology will continue to be virtualized, creating a Software Defined Branch (SD-Branch). SD-Branch architectures use virtualized network and security applications such as routing functionality implemented as SD-WAN and software-based virtual network functions (VNFs) such as firewalls, Unified Threat Management (UTM) and network analytics. SD-Branch is the logical evolution beyond SD-WAN for even greater levels of management and operational simplicity, security and cost-savings. Considering Cybera Cybera, a company headquartered in Franklin, Tennessee with additional offices in Silicon Valley, has created a purpose-built SD-WAN offering specifically for the distributed enterprise. Launched in 2011, the Cybera Network Services Platform is the company s managed service #US44182718 Page 4
solution. It provides an overlay network to prioritize and secure mission-critical applications. The platform is centrally managed from the company s cloud orchestration systems and allows multiple customers or partners to configure network and security services across a multi-tenant platform. Cybera s SD-WAN and SD-Branch appliances include integrated routing, switching, and firewall capabilities, along with options for Wi-Fi and integrated 4G LTE. In addition, the Cybera Network Services Platform includes:» Cloud-hosted services for active load balancing» SSL/TLS VPN clients with multi-factor authentication» W-Fi controllers with analytics» A secure web gateway service that includes firewall, anti-malware, web and app filtering, intrusion prevention, advanced threat management, and SSL/TLS Proxy The Cybera Network Services Platform allows customers or partners to create microsegmentation between apps, devices, and users to significantly improve security and simplify compliance. This also allows the customers or partners to uniquely assign whatever IP addressing, routing protocols, dynamic path selection, or other network and security policies are required for any individual application. The platform creates dedicated SSL/TLS tunnels using AES-256 encryption and multi-factor authentication. These tunnels are aggregated to Cybera s virtual concentrators, which can reside within Cybera datacenters, on the customers premise, or within a cloud service provider such as Amazon Web Services or Microsoft Azure. At any of these aggregation points, Cybera provides a Service Insertion Framework and hosting capabilities for any third-party VNFs, applications, or other cloud services. This allows customers and partners to integrate their applications or services directly onto the Cybera platform or choose from Cybera s growing list of application partners. Beyond the common network and security VNFs and applications, Cybera s cloud-based solution provides secure gateways to vertical applications such as the major payment processors, loyalty networks, POS system providers, DVR/surveillance, ATMs, and more. The cloud-based configuration and orchestration enables non-technical end users to simply connect power and the Internet to their Cybera appliance the rest of the setup is automated. In fact, more than 90% of Cybera systems have been deployed by onsite non-it personnel, streamlining network deployments and reducing field integration and support costs. In addition, Cybera s services fit well within hybrid networks, allowing them to be overlaid on top of MPLS or other WANs. This approach provides all of the same micro-segmentation and SD-WAN capabilities end-to-end from the centrally managed LAN port to the most remote office. Challenges Commonly, Cybera is lumped in with other SD-WAN vendors that have a very different solution set, one that has a higher touchpoint for the end user and is primarily focused on MPLS replacement. Cybera s opportunity lies in differentiating itself from other vendors in the market and identifying itself with the broader SD-WAN market. In the end, Cybera focuses on a unique #US44182718 Page 5
niche in the market of distributed enterprises, and it offers a unique purpose-built solution for the needs of these customers. Conclusion SD-WAN has exited the early adopter phase and is in the early mainstream phase, driven by numerous SD-WAN and SD-branch successes and the continued need to optimize WAN performance for remote office connectivity and enable new business opportunities. Cybera s two largest SD-WAN implementations 16,400 sites and 9,600 sites, respectively have been in production for over three years. Cybera offers a low-touch, highly scalable offering for large enterprises with large numbers of distributed locations. IDC recommends that end users evaluate providers to ensure their vendor s strengths align with their specific SD-WAN needs. About the analyst: Brandon Butler, Senior Research Analyst, Network Infrastructure Brandon Butler is a senior research analyst with IDC's Network Infrastructure group covering enterprise networks. In this role, he is responsible for market and technology trends, forecasts, and competitive analysis in Ethernet switching, routing, wireless LAN, and adjacent emerging segments such as SDN and SD-WAN. Rohit Mehra, Vice President, Network Infrastructure Rohit Mehra is IDC's vice president of Network Infrastructure, leading IDC's research practice in enterprise and datacenter networks and telecom infrastructure. He provides expert insight and analysis into global industry and technology trends as they relate to enterprise, datacenter, cloud, and telecom networks. IDC Corporate USA 5 Speen Street Framingham, MA 01701, USA T 508.872.8200 F 508.935.4015 Twitter @IDC idc-insights-community.com www.idc.com This publication was produced by IDC Custom Solutions. The opinion, analysis, and research results presented herein are drawn from more detailed research and analysis independently conducted and published by IDC, unless specific vendor sponsorship is noted. IDC Custom Solutions makes IDC content available in a wide range of formats for distribution by various companies. A license to distribute IDC content does not imply endorsement of or opinion about the licensee. External Publication of IDC Information and Data Any IDC information that is to be used in advertising, press releases, or promotional materials requires prior written approval from the appropriate IDC Vice President or Country Manager. A draft of the proposed document should accompany any such request. IDC reserves the right to deny approval of external usage for any reason. Copyright 2018 IDC. Reproduction without written permission is completely forbidden. #US44182718 Page 6