In this lesson,
we're going to cover SD-WANs and SASE.
Now, as our organizations become increasingly more reliant
on the cloud-based applications that are used
by our geographically-distributed workforces,
this has led to an increased demand for agile, secure,
and efficient network infrastructure to be created quickly.
Now, a software-defined wide area network, or SD-WAN,
is a virtualized approach to managing and optimizing
wide area network connections to effectively route traffic
between remote sites, data centers, and cloud environments.
The Secure Access Service Edge framework, or SASE,
on the other hand,
is used to consolidate
numerous networking and security functions
into a single cloud-native service
to ensure that secure and seamless access for end users
can be achieved,
regardless of their actual physical location.
Together, SD-WAN and SASE
represent a big innovation in our network
and security architectures.
So we're going to take some time to cover both of them
in this lesson.
Now, first, let's talk about SD-WAN,
or software-defined wide area networking.
Now, an SD-WAN is a virtual WAN architecture
that allows enterprises to leverage any combination
of transport services
to securely connect users to their applications.
An SD-WAN is essentially
a software-based wide area network architecture
with all the control extracted from the underlying hardware.
So, instead of configuring specific infrastructure
to handle our application traffic using something like MPLS,
we can actually manage an SD-WAN
entirely inside of our software.
Plus, we can layer it over multiple types
of network transport.
This means we can really
use any of our other WAN connections that we want to,
things like MPLS, a cellular connection, a microwave link,
or a regular broadband internet service like a cable modem,
in order to create a virtual wide area network architecture
that we can then run our networks over.
To create an SD-WAN,
you can use a centralized control function
to securely and intelligently redirect the traffic
across the WAN.
Our traditional WANs,
which were never developed with the idea
of integrating cloud services into our enterprise networks,
simply aren't able to do this.
But instead, we can use an SD-WAN,
because they're enabled for cloud-first enterprises
to deliver amazing quality experiences for their end users.
Let's consider a company that has several branch offices
and one headquarters location.
In our traditional WAN architectures,
each of those branch offices would likely be connected
back to the central office using a star topology.
This would allow the headquarters
to conduct advanced security on that traffic
as it went through the branch offices to the headquarters,
and then out to the internet.
This is great for security, sure,
but it really does slow down the entire process
for our end users at those branch offices,
and it results in a poor user experience
and loss of productivity.
Now, unlike traditional architectures, though,
SD-WANs can solve this by using intelligence
to identify the network applications that are being used
by the end users,
and routing that data across the WAN to the right places.
This allows your WAN environment to be much more dynamic
and much more efficient,
by providing improvements in visibility, performance,
and manageability of our enterprise WAN architectures
from a single centralized point.
So, if you're working at a large enterprise network
and you have a lot of branch offices,
and they're all trying to move more and more into the cloud
using things like IaaS, and PaaS, and SaaS,
then you may need to use an SD-WAN
to increase the performance for your end users
and reduce the bottlenecks that were being caused
by your traditional centralized WAN architectures.
Next, we need to discuss the concept of SASE,
or the Secure Access Secure Edge.
Now, the Secure Access Secure Edge, or SASE,
is a new type of network architecture
that combines both the network security
and wide area networks, or WAN, capabilities,
into a single solution.
The Secure Access Secure Edge is seen as a way
to address the challenges of securing and connecting
users and data
that's being distributed across multiple locations,
including things like branch offices, remote workers,
and mobile users, as well as the cloud itself.
A key aspect of SASE technology
is that it's using software defined networking, or SDN,
to provide security and networking services
from the cloud rather than from
traditional hardware-based appliances.
This allows us to have more flexibility, scalability,
and cost efficiencies
than using a traditional network solution.
Now, Secure Access Secure Edge, or SASE solutions,
are typically going to include a wide variety
of security services too.
This includes things like firewalls, VPNs,
zero-trust network access,
and cloud access security brokers, which are known as CASBs.
Now, these are all going to be delivered through a common set
of policy and management platforms,
because this allows us to achieve our networking goals
in a much more efficient way.
SASE is going to help to address the challenges
of our modern distributed enterprises,
which is increasingly composed of mobile, cloud-based,
and multi-cloud applications and services,
as well as a large number of users and devices
which are constantly growing
and moving into larger and more distinct locations.
SASE is going to be used to provide a more secure
and efficient way of connecting all of these users
and their devices back to the applications and services
that they want to use,
regardless of the location or the type of device
that they're actually using.
Now, all the major cloud service providers,
including Amazon Web Services, Microsoft Azure,
and Google Cloud Platform,
are all going to offer solutions
that align with this concept of Secure Access Secure Edge.
But, each of these do refer to them
by different names or acronyms,
depending on the specific service or product
that you're going to be referencing.
For example, inside of Amazon Web Services,
which is known as AWS,
this service that's going to most closely align with SASE
is known as a VPC, or virtual private cloud.
Now, a virtual private cloud will provide a secure
and flexible network infrastructure
for your applications and data,
and AWS's VPC enables us to be able to create
virtual networks in the cloud,
and connect it to our on-premise data centers,
or other AWS services, to achieve that SASE capability.
Microsoft Azure actually has a lot of different services
that align with this SASE concept,
including Azure's virtual WAN,
which provides secure, global and efficient connectivity
between branch offices, data centers, and Azure resources,
as well as Azure express routes,
which enable you to create a dedicated private connection
between an Azure data center
and your on-premise network infrastructure.
Now, if you happen to be using GCP,
which is the Google Cloud Platform,
they actually call their SASE-aligned services
the Google Cloud Interconnect.
Google Cloud Interconnect allows you
to connect your on-premise infrastructure
to the Google Cloud Platform
over a dedicated private connection.
They also have a service known as the Google Cloud VPN,
which allows you
to securely connect your on-premise infrastructure
back to your virtual private cloud network
through an IPsec VPN tunnel.
Now, it's important to realize
that these services are not exclusively SASE providers,
and the definition of SASE here is not completely aligned
with all the features and functionality
of any single cloud service from these cloud providers,
but they do provide a lot of the aspects of SASE for you,
such as having secure, flexible,
and global networking capabilities
by using these different services.
So remember, as cyber threats evolve
and our work environments
become increasingly more geographically dispersed,
understanding and implementing solutions
like SD-WAN and SASE
is going to be important for you to consider.
These technologies aren't just about keeping pace
with the digital transformation,
but they're actually focused on anticipating the future,
preparing for its challenges,
and capitalizing on its potential opportunities.
An SD-WAN, or a software-defined wide area network,
is going to be a virtualized approach to managing
and optimizing wide area network connections
to efficiently route traffic between remote sites,
data centers, and your cloud environment.
The Secure Access Secure Edge, or SASE, on the other hand,
is a security framework that combines network security
and wide area network capabilities
in a single cloud-based service.
By leveraging these tools,
we're able to elevate our organizational security posture
and continue to move forward in our security careers
as we begin to migrate more heavily
into cloud-based environments.