To me, the word “free” comes with a fair bit of caution. At first blush, it sounds attractive. But from experience, if something feels too good to be true, it often is. Coming back to SD-WAN, free doesn’t always mean free, and it’s important to look out for hidden costs. It’s important to understand what functionality you’re receiving for “free” and what requires additional licensing for a complete solution. When evaluating any SD-WAN solution, here are a few key questions to consider – or ask of the vendor – to ensure that you have a full picture of what the solution’s capabilities are:

• Does the solution include comprehensive management capabilities, or is an additional license required to support orchestration?
• Does the base solution include end-to-end analytics capabilities?
• If additional network functions are enabled, does the quoted hardware have enough compute and memory capabilities to support them?

An advanced SD-WAN platform provides compelling operational and financial benefits over SD-WAN solutions offering only basic capabilities. For a detailed, quantitative evaluation of your organization’s strategic and operational rationale for investing in Aruba SD-WAN, please reach out to the Aruba Value Management team at valuemanagement@hpe.com.

In a hybrid WAN environment, application performance across a WAN can vary considerably from site to site or region to region because of underlying factors such as latency, packet loss and jitter that must be taken into consideration, especially using a mix of MPLS and broadband connectivity services.

The Aruba EdgeConnect SD-WAN edge platform, acquired with Silver Peak, supports advanced visibility, routing, control and intent-based policy management for any application thereby improving the performance and availability of business applications by dynamically routing traffic to virtually any site, automatically adapting to real-time network conditions.

Let’s examine three of the most popular enterprise SaaS applications in use today, (Microsoft 365, Zoom and salesforce.com) and where Aruba EdgeConnect improves application performance and delivers the highest quality of experience across these popular business applications.

Microsoft 365:

Microsoft 365 (formerly Office 365) is the most widely deployed business SaaS application globally, and Aruba EdgeConnect easily integrates with Microsoft’s global network of 365 entry points by using geo-location information to correlate EdgeConnect appliance locations with the closest onramp to the Microsoft network.

Aruba EdgeConnect continuously learns and discovers new Microsoft 365 end points and/or IP addresses and automatically re-configures EdgeConnect when a new, closer Microsoft 365 end point becomes available to help optimize latency-sensitive Microsoft 365 applications. Enterprises can also locally break-out their Microsoft 365 traffic directly from any of their branch locations to minimize latency and deliver the highest quality of experience to end users.

Zoom Collaboration and Communication – and also MS Teams, Webex and Google Meet

The COVID-19 pandemic has also seen a spike in the use of business collaboration and communication tools such as Zoom, Microsoft Teams, WebEx, Google Meet and others for employee meetings, projects and virtual conferences.

One example is in healthcare, where medical providers increasingly rely on telemedicine sessions using Zoom or Webex. The number of concurrent sessions has increased from one to two per day to ten or more per location. Aruba EdgeConnect business intent overlays make it easy to specify that real-time applications like Zoom, Webex, or Teams use local broadband with EdgeConnect path conditioning enabled, as the preferred underlay for efficient local breakout directly to the cloud. If there is further need for additional bandwidth, EdgeConnect tunnel bonding and dynamic path control can bond the MPLS and broadband underlays to create a single higher bandwidth logical link. The result is a consistent high-quality video and voice experience for end users.

Salesforce.com

Salesforce (SFDC) is today’s standard tool for customer resource management (CRM) and collaboration. While Salesforce may perform well for users in one location, the dynamic nature of the internet may negatively impact Salesforce performance across other locations intermittently.

Aruba EdgeConnect features SaaS optimization technology that finds the optimal route to applications like SFDC that are hosted in the cloud, as well as on private networks. It does this using First-packet iQ, which automatically identifies and classifies more than 13,000  SaaS applications and more than 300 million web domains on the first packet and then applies machine learning technology, application signatures and geo-location to optimize SaaS application performance.

This capability when combined with path conditioning and advanced WAN routing interoperability, ensures that SFDC traffic is sent over the shortest or least-congested path every time. During network testing, for example, the time required to retrieve files from Salesforce improved by more than 20x, decreasing from over two minutes to just two seconds.

As you seek to accelerate your digital transformation journey to the cloud, you don’t have to compromise application performance. Learn more about how AT&T SD-WAN with Silver Peak, powered by Aruba EdgeConnect, can help you deliver consistent application performance and the highest quality of experience to your users.

As the cloud-first infrastructure that sits at the intersection of networking and security, SD-WAN has demonstrated that it can be the go-to platform for connecting users securely and directly to applications wherever they reside. The latest demonstration of its growth potential has been the expansion of cloud-delivered security services that can be integrated with SD-WAN, to create a Secure Access Service Edge (SASE). Looking forward, SD-WAN will be tasked with intercepting and securing IoT device traffic to contain emerging threats and prevent lateral movement in the event of a breach.

SASE means that SD-WAN can easily extend and integrate security functions for new use cases, including IoT and the remote-access “edge,” which can be anything from a remote worker on a laptop to a point-of-sale (POS) device or a surveillance camera. As the cloud pushes out further to the edge it will become imperative that users and devices can only communicate with destinations consistent with their role and security posture. Augmenting application intelligence with role-based policy will enable enterprises to dynamically segment and isolate traffic based on context, providing consistent and automated definitions of roles that can be enforced network-wide from the user or device through the LAN and across the WAN.

Let’s dive a bit deeper on how this will all happen.

The Remote Device Explosion

The number of devices and connections has exploded, making it more challenging to dynamically connect the mix of people, devices, and resources — none of which necessarily lives in any permanent fixed physical location.

Devices are proliferating on the IoT side, with the rise of industrial automation, retail analytics, and smart cities. Whether it’s a traffic light or a robot on the factory floor, a wide range of new devices require secure connectivity.

At the same time that the number of devices explodes, the mobility of the workforce is expanding. A variety of studies show that remote workforces are here to stay, with anywhere from 40-60 percent of the workforce expected to be working remotely going forward. As a greater share of the workforce goes remote, connecting to enterprise networks using a variety of devices from virtually any location means the attack surface will expand dramatically.

Legacy network and security architectures were never designed to address this complex mix of users, devices and locations, because they were tied to inflexible networks that were nailed into specific devices or locations by perimeter-based security architectures. Conversely, SD-WAN and SASE use a software approach to help managers build agile network services that are spun up on demand.

The ability to rapidly adopt new security features is a key draw for enterprises with SD-WAN deployments. According to Futuriom’s June 2020 SD-WAN Growth Report, which surveyed more than 100 end users, the top four benefits of SD-WAN adoption were improved security, better management/agility, bandwidth optimization/cost savings, and faster cloud application performance.

The new world requires a Zero Trust security model that can authenticate both users and devices using a variety of techniques and dynamically segment traffic based on this context. One of the key benefits of SD-WAN, our research has shown, is that it can integrate security features such as Zero Trust authentication and encryption.

Locking Down IoT Devices

As the Zero Trust security approach makes its way toward IoT devices, it couldn’t come at a better time. According to the Ponemon Institute, an independent security research firm, organizations experiencing security breaches of IoT devices increased from 15 to 26 percent during the three-year period of 2017-2019. A Ponemon survey found that IoT risks were perceived as increasing. 59 percent of respondents said the IoT ecosystem is vulnerable to a ransomware attack. Other reasons for the increase in IoT risks are the inability to determine whether third-party safeguards and IoT security policies are sufficient to prevent data breaches with 55 percent of respondents acknowledging difficulty in managing the complexities of IoT platforms due to the number of third parties.

The network needs to connect to any device or application, anywhere, including micro-segmentation and granular perimeter enforcement based on endpoint locations and other contextual data.

Here are the things to look for as Zero Trust security, SASE, and SD-WAN converge for IoT and remote access:

Role-based security. User identity is the key attribute for delivering security and network access, not an IP address. A variety of network identity attributes need to be used to authenticate users and devices, such as the username, role, group, device OS and the unique MAC address of the device, including its posture.

Zero Trust and the dissolving security perimeter. In the Zero Trust model, users and devices are never trusted whether the connection is made inside or outside the traditional security perimeter. Zero Trust security ensures that the same controls applied to campus or branch networks extend to remote users and IoT devices. This requires having device insight to intelligently discover and profile all network connected devices to deliver full spectrum visibility of everything on the network. Next generation role-based user, device and application policy firewalls provide dynamic segmentation functionality to deliver effective wireless and wired access security across any environment.

Flexible Service Orchestration. In past legacy networks, secure networking often required specialized hardware or proprietary VPN tools. In the SD-WAN market, cloud-delivered security services can be added using service orchestration, providing integrated security and VPN at the device level with software, without the need to deploy specialized devices. This applies whether a network is connecting IoT or business-class networking at the home office.

As demand for flexible security tools for IoT and remote access increases, SD-WAN will continue to evolve to become the preferred platform to manage these new functions and capabilities.

Learn more about Aruba solutions at:

Aruba SD-WAN solutions

Aruba SD-Branch and Network Security solutions

Aruba EdgeConnect SD-WAN solution

In this installment, we’ll discuss the three remaining capabilities of an advanced SD-WAN required to simplify and automate the connectivity to public clouds, SaaS and cloud security services.

3.Deploying SD-WAN Virtual Instances in Public Clouds

Enterprises can deploy a virtual Aruba EdgeConnect appliance instance to extend their SD-WAN to IaaS providers with seamless orchestration and ongoing lifecycle management. Aruba EdgeConnect virtual appliances may be deployed in public cloud infrastructures, such as a Microsoft Azure Virtual Network (VNET), Amazon Web Services virtual private cloud (AWS VPC), Google Cloud Platform (GCP) and Oracle Cloud Infrastructure. These appliances are available in the partner’s respective public cloud marketplaces, enabling seamless and secure connectivity via public internet or private Direct Connects for all branch and data center locations connecting to public clouds.

The management of the EdgeConnect virtual instances are managed by Aruba Orchestrator that completely automates VNET and VPC discovery, subnet management, virtual instance onboarding, high-availability configuration and status monitoring.

4.SD-WAN Integration and Automation with Public Cloud

EdgeConnect SD-WAN provides orchestrated, secure branch connectivity directly to public cloud providers’ global backbone networks. This greatly simplifies the SD-WAN overlay by connecting branch locations directly to regional points of presence (POPs) that provide access to cloud resources within a region and across regions. The overlay also supports branch-to-branch communication without virtual gateways at each VPC. Figure 1. Highlights the flexibility of public cloud connectivity with an Aruba EdgeConnect SD-WAN.

Aruba Orchestrator provides a single centralized dashboard to streamline the management and operation of SD-WAN integrations with AWS Transit Gateway Network Manager (TGNM) and Microsoft Azure Virtual WAN (vWAN). 

The main benefits are focused on simplification of a large global network with many AWS VPCs or MSFT VNETs by reducing the number of point-to-point connections. Aruba Orchestrator gives complete visibility from within the cloud connect dashboard.

5. Automation and Integration of SD-WAN with Best-of-Breed Cloud-delivered Security Vendors

Aruba has extended its orchestration capabilities to integrate third-party cloud security services from best-of-breed cloud security solutions from Zscaler, NetSkope, Check Point, and Palo Alto Networks Prisma Access. This advanced API integration within the EdgeConnect SD-WAN platform enables network managers to fully realize a cloud-first vision that leverages UTM and advanced security capabilities to enable the enterprise to automate consistent, network-wide security policies that combine the advantages of an advanced Zero Trust WAN edge on-prem, with cloud-delivered security services from their security vendor of their choice.

Aruba automatically orchestrates primary and secondary IPsec tunnels to nearest POP for these cloud security partners. In this model the Aruba Orchestrator become the point of business and security policy enforcement, giving the organization the flexibility to route specific traffic to cloud security or onboard using gateway firewall policy.

With the emergence of SASE, SD-WAN is becoming a cloud-programmable networking platform for orchestrating network, security and SASE components providing enterprises with a better way to adopt, orchestrate, and manage these discrete security components, plugging them into the network and centrally managing them with software. This flexibility offers enterprises the freedom of choice to adopt leading cloud-delivered security solutions, which can be fully unified with their Aruba SD-WAN deployments.

In a multi-cloud environment, IT teams require automation and orchestration to ease the burden of deployment and ongoing management to ensure the highest level of performance and security for the users they serve. Lifecycle management and orchestration are essential to achieve the full transformational promise of the cloud.

Managing multi-cloud connectivity across your WAN must be made simpler – so that it doesn’t become unruly or unmanageable. Selecting the right SD-WAN platform provides an “Easy Button” to simplify the integration of private cloud, SaaS and IaaS hosted applications and deliver consistent and secure application performance over any WAN infrastructure to all users anywhere and from any device.

Learn more at:  

Aruba SD-WAN solutions

Aruba SD-Branch and Network Security solutions

Aruba EdgeConnect SD-WAN solution

Today, more applications are hosted in the cloud than in traditional enterprise data centers, and the majority of these applications are being consumed as software-as-a-service (SaaS). Moreover, an increasing number of employees work outside of the corporate network and connect directly to cloud applications. Both of these dynamics render traditional perimeter-based security ineffective. Finally, the explosion of mobile and IoT devices across the enterprise has dramatically increased the attack surface, exposing enterprises to security breaches that can compromise data and result in network downtime.

To achieve the full promise of cloud and digital transformation, enterprises must transform both their WAN and security architectures — not just one or the other. An enterprise may start with modernizing its WAN or security, but to realize the true value of cloud investments, both aspects must be addressed. By transforming both their WAN and security architectures, enterprises can ensure direct, secure access to applications and services across multi-cloud environments regardless of location or the devices used to access them.

Leveraging advanced SD-WAN to adopt a cloud-first security architecture

An advanced SD-WAN platform automatically identifies and classifies application traffic on the first packet, intercepting it at the network edge and assigning it to an appropriate segment, securing it from other traffic on the network. As shown in Figure 1 below, enterprises can connect directly to the cloud via secure, adaptive internet breakout using an advanced SD-WAN platform. The intelligence to recognize trusted applications enables local breakout from the branch office to the nearest point of presence (PoP), eliminating latency and delivering the highest quality of experience for trusted SaaS and cloud applications such as Microsoft Office 365, 8×8, and RingCentral.

Application awareness also provides the ability to send other internet-bound traffic first to a cloud-delivered security vendor for advanced inspection before forwarding it along to a SaaS or IaaS provider. An advanced SD-WAN platform uses a virtual WAN overlay model and enforces end-to-end micro-segmentation to enable differentiated treatment for different applications, including security policies and controls. For instance, a security policy may be defined to:

• Send all known “trusted business SaaS” traffic directly to the internet

• Send “work from home” recreational applications to a cloud-delivered security vendor such as Zscaler, Netskope, Check Point, McAfee, or Palo Alto Networks for additional inspection, and

• Backhaul all other “untrusted, suspicious, and unknown traffic” to a data center or headquarters-based next-generation firewall from Palo Alto, Fortinet or Check Point

Advanced SD-WAN capabilities orchestrated with modern cloud-delivered security services ensures consistent policy enforcement and access control for users, devices, applications, and IoT.

Best of breed solutions enable enterprise agility

Enterprises need agility to spin up new branches and dynamically adjust QoS and security policy and rules. The ability to propagate policy context is a critical requirement for branch automation. This makes the concept of an advanced SD-WAN solution desirable and can help enterprises eliminate the need for multiple appliances to perform dedicated security functions and simplify and consolidate — or “thin” — their branch WAN edge architecture. An advanced SD-WAN edge platform enables enterprises to transform their WAN by unifying SD-WAN, routing, WAN optimization, segmentation, application visibility and control, and branch security in a single centrally managed unified platform.

As modern cloud-first enterprises continue to migrate applications from the data center to the cloud, they must embrace WAN and security transformation to realize the maximum return from their cloud investments. Gartner coined the term SASE, or Secure Access Service Edge that

moves the industry in this new direction. It is important that enterprises consider both WAN

and security transformation as they architect a secure access service edge to deliver a seamless experience. Automated orchestration that seamlessly integrates best-of-breed SASE components without compromising networking capabilities or security enforcement capabilities is a foundational requirement. Ultimately, no single vendor will have the breadth and depth of features and capabilities required to deliver best-in-class network and security technologies across a single platform. With a continuously evolving threat landscape, enterprises must also retain the agility to quickly and cost-effectively adopt new security solutions as they come to market. Enterprises are well-served to evaluate platforms that offer the freedom to integrate best-of-breed network and security solutions. By doing so, enterprises can avoid being locked-in to proprietary single-vendor solutions or settle for basic features and functionality.

To learn more about WAN and Security Transformation, read our latest White Paper.

When the COVID-19 pandemic first hit, companies around the world had to shift their focus toward launching new and expanded digital services to support a fully remote workforce and accelerate the transition to a more cloud-connected world – all virtually overnight. The consequence of the global pandemic exacerbated the importance of accelerating cloud and digital transformation, resulting in more than 90 percent of enterprises purporting to now have a multi-cloud strategy in place, according to the Flexera 2020 State of the Cloud Report.

So, fast forward to today. Have enterprises also considered and adapted their IT and network infrastructure to support applications in a multi-cloud connected environment? Here are five common challenges enterprise IT managers face when it comes to supporting multi-cloud connectivity of applications across the enterprise WAN:

1. How do I assure the highest levels of performance for mission-critical SaaS applications that are carried over broadband?
2. How can I integrate and enforce unique security policies for trusted or untrusted cloud-hosted applications with the increased use of broadband?
3. How can I easily integrate and extend WAN applications to be hosted in public cloud environments?
4. How can I automate the integration of my SD-WAN with AWS, Azure and GCP public cloud backbone networks?
5. How can I automate the orchestration of cloud security services hosted by best-of-breed cloud security vendors within my SD-WAN?

When it comes to the enterprise multi-cloud connectivity, there are five pillars of an SD-WAN platform that explicitly address these challenges and form the foundation for enabling an effective multi-cloud enterprise strategy:

1. SaaS Optimization for the Best User Experience

The majority of applications are now delivered as SaaS, so backhauling ALL cloud-destined traffic back to the data center impairs application performance due to added latency.

Aruba SaaS Optimization connects users from branch sites to SaaS applications in a seamless and secure way, while continuously monitoring the SaaS Quality of Experience (QoE). There are a number of capabilities that come together to do this including:

• First-packet iQ automatically identifies and classifies applications on the first packet, enabling dynamic application traffic steering to the data center, cloud provider or cloud security service. Application-aware traffic steering minimizes latency resulting in better application performance while ensuring enforcement of business-driven security policies.
• Intelligent Cloud Breakout allows enterprises to deploy virtual EdgeConnect appliances in their public cloud IaaS instances. Connections between branch locations and the cloud benefit from Aruba path conditioning and optional Aruba Boost WAN Optimization. This “ruggedizes” the first mile between the branch and the cloud, providing improved network quality as well as application performance and availability.
• Microsoft Office 365 API integration ensures secure internet breakout directly from the branch office to the closest Office 365 entry point using the latest Office 365 end-point data. This supports delivery of optimal Office 365 connectivity and performance.

2. Intelligent Local Internet Breakout

The Aruba EdgeConnect SD-WAN edge platform employs a virtual WAN overlay model and enforces end-to-end micro-segmentation to enable differentiated treatment – including security policies and controls – for different classes of applications. A business-driven cloud-app security policy might be defined as:

• Send all known, trusted business SaaS (Office 365, SAP, Oracle, Zoom) traffic directly to the closest SaaS instance – or doorstep – using the internet as the primary WAN transport service
• Send “home from work” recreational applications, such as Facebook and YouTube, to a secure web gateway service such as Zscaler, Netskope, McAfee or Symantec for verification
• Send all untrusted, suspicious or unknown traffic to a hub or headquarters-based next generation firewall

Having a unified zone-based stateful firewall at the WAN edge is essential for a complete, secure local internet breakout solution for direct connectivity to trusted SaaS applications and IaaS from branch offices, blocking any unwanted or unauthorized traffic attempting to enter the branch network from the enterprise LAN. Aruba EdgeConnect overlays allow for easier micro-segmentation based on application characteristics, performance requirements and security policies. This helps with security compliance by taking automatic action to isolate affected branches from the wider network where a security breach is found to have occurred.

So far, we have discovered how easy it is to securely classify, route and breakout cloud-based applications with an advanced SD-WAN platform. In the second part of this blog series, we will examine additional SD-WAN capabilities that help automate WAN connectivity in a multi-cloud environment.

As frequent users of business applications such as Microsoft 365 (Office, Teams, SharePoint, and Exchange), we often fail to notice what peak performance feels like, but we certainly know what poor performance feels like! Our frustration builds as we wait on a frozen screen, watch a spinning wheel, or listen intently as we attempt to decipher garbled voice: “Can you repeat that? You’re breaking up.” These experiences tend to occur at the worst time: while delivering a webinar, leading a Microsoft Teams call with an important client, or while trying to access and update a file for your boss while under a tight deadline.

Poor app performance is not only frustrating to users and IT network pros alike, but it also hits the company’s bottom line in terms of lost productivity. Let’s take a look at some of the causes of poor app performance and how Aruba can help you resolve these issues.  

A new weak link when apps are no longer close by

While app performance issues have been dogging IT network pros for years, accelerated cloud transformation and increased usage of broadband circuits have created additional challenges as business suites such as Microsoft 365 (formerly Office 365) have moved from residing close to the users on-premises or being hosted in corporate data centers to now existing as distributed cloud services across the country, region, and globe.

While the benefits of cloud and SaaS are well understood, the shift to SaaS has put pressure on IT network pros as they attempt to meet SLAs for the business while running corporate networks that weren’t architected for cloud-hosted apps and services. The wide area network becomes the bottleneck—or the weakest link—in delivering the highest quality of experience to app users.

Aruba understands these pain points. This is why we built industry leading networking and security solutions that transform the WAN from edge-to-cloud and provide fully automated connectivity to SaaS that’s specifically optimized for Microsoft 365. An Aruba network adapts to changing network conditions to deliver the best possible employee experience when using Microsoft apps and services.

Here is how Aruba’s SD-WAN solutions empower IT pros to deliver the highest quality of experience for Microsoft 365 users.

Certified Microsoft 365 App Performance

Aruba SD-Branch was recently recognized by Microsoft as a preferred networking partner that delivers optimal performance for Microsoft 365 applications in accordance with Microsoft 365 network connectivity principles. The Aruba EdgeConnect SD-WAN edge platform, acquired with Silver Peak, was already a member of the Microsoft program. Aruba SD-WAN customers can count on the highest levels of performance delivered to their users when using Microsoft 365 from Aruba SD-WAN-enabled network locations.

Automation and Integration are critical

Aruba SD-WAN solutions leverage the Microsoft 365 REST API in accordance with the Microsoft 365 connectivity principles to continuously learn, identify, classify, and prioritize traffic to Microsoft 365 applications and services (such as Skype, Teams, and SharePoint).

The best possible user experience is achieved from branch locations to Microsoft 365 services, automatically and continuously by:

• Monitoring of the availability of Microsoft 365 front doors (which are the global entry points to reach Microsoft 365 applications) based upon the published fully qualified domain name (FQDN) across the WAN to steer traffic from branch locations to the nearest Microsoft 365 entry point
• Path performance monitoring over direct internet breakout from multiple ISP providers and across hybrid WAN links (The best path may not always be direct)
• Differentiating traffic based upon Microsoft 365 categories: Optimize, Allow, and Default, across the entire Microsoft 365 productivity suite. This is important because many apps and services have unique performance needs.

Simplified deployment and management

In a few clicks network IT pros can enable Aruba SD-WAN solutions to provide optimal routing for all Microsoft 365 applications. No manual configuration or specialized knowledge of Microsoft 365 is required to deliver the highest quality of experience to users at campus or branch locations connecting to Microsoft services. Aruba Central and Aruba Orchestrator track SaaS performance in terms of quality of experience, loss, latency, and jitter with drill-downs to troubleshoot application performance by group, site, and gateway context.

A more efficient way to deliver better SaaS experiences

With Aruba SD-WAN, your workforce has a better experience using Microsoft 365 and other SaaS apps. There’s nothing workers need to do to gain the optimized performance, and they’ll just know that their SaaS apps are responsive. Ultimately, more engaged and productive employees translate to more value for the business.

Aruba SD-WAN also simplifies network operations for IT pros. Already running lean, IT teams are doubly challenged to do more with less during the COVID-19 pandemic. Solutions that truly “just work” are vital for IT productivity. Aruba SD-WAN is fully automated, adapting in real time to changing network conditions, to deliver a continuously optimized experience to users.

At the same time, IT teams have the visibility and control they need. Aruba dashboards provide complete visibility into metrics such as quality of experience, loss, latency, and jitter. It’s more than just a pretty picture: IT can drill down into the details for troubleshooting and accelerate problem resolution.

Choose the Aruba SD-WAN solution that is best for you

Your organization can meet its most challenging SD-WAN requirements—from campus and branch to cloud and SaaS with the flexibility and choice of Aruba SD-WAN solutions. SD-Branch and the Aruba EdgeConnect SD-WAN edge platform are each recognized and independently validated to deliver optimal performance for employees using Microsoft 365.

Address your weakest link today. Your users will possibly thank you. At least they won’t complain as much!

Everything we do, whether it’s in our approach to engineering our products, delivering 24/7 customer support, or enabling enterprises big and small to architect modern WAN edge infrastructures that help to transform their business operations, revolves around this maniacal focus.

So, when Gartner Peer Insights recently published its 2021 Gartner Peer Insights ‘Voice of the Customer’: WAN Edge Infrastructure report, we were delighted to be officially recognized as a Customers’ Choice among the 35 other WAN Edge Infrastructure companies, measured per Gartner Peer Insight’s strict selection criteria, scoring an overall rating of 4.8/5.0. This recognition joins other Customers’ Choice designations for Aruba by Gartner Peer Insights, including last October in the Network Access Control category for Aruba ClearPass Policy Manager, and in February 2020 in the Wired and Wireless LAN Access Infrastructure category for Aruba Gateways and Controllers.

First, and most important, is to express our gratitude and a huge thank you to all of our customers, as well as the entire Aruba team and global channel partners for improving day-to-day customer experiences and business outcomes with Aruba EdgeConnect.

Now, I’d like to briefly share some insights, commentary, and a few customer review examples about the Gartner Peer Insights program and what’s behind Aruba’s Customer’s Choice recognition.

Gartner Peer Insights

It’s worth noting that because the surveys tell the stories of actual experiences from verified customers, Gartner Peer Insights reviews have become a trusted source of experiential information. Gartner Peer Insights reviews frequently influence enterprise IT teams when evaluating and purchasing a vast array of technology products.

All reviews go through a strict validation and moderation process in an effort to assure authenticity

For vendors in the WAN Edge Infrastructure market category, the Gartner Peer Insights Customers’ Choice designation is a recognition that takes into account both the total number of reviews and the overall customer ratings. To ensure fair evaluation, Gartner maintains rigorous criteria for recognizing vendors with the highest customer satisfaction ratings, and only the highest ranked vendors are named a Customers’ Choice.

Aruba EdgeConnect Assessment

Based on a 5-Star point system from 68 reviews over the past 12-months, Aruba achieved an overall rating of 4.8, with 93 percent of reviewers stating they would recommend the company’s EdgeConnect SD-WAN edge platform. Breakout scoring was 4.9 for Evaluation and Contracting, 4.7 for Integration and Deployment, 4.7 for Service and Support, and 4.7 for Product Capabilities.*

Aruba EdgeConnect reviews are listed as Silver Peak Unity EdgeConnect, the name change resulting from Aruba, a Hewlett Packard Enterprise company, acquiring Silver Peak last September. In addition to core Customer First, Customer Last values, a sharing of Aruba’s common vision and goal to provide simplicity, scalability, and application-awareness at the edge were key factors in completing the acquisition, along with the company’s placement as a Leader in the Gartner Magic Quadrant for WAN Edge Infrastructure report for the past three years.

Now it’s time to hear from a few of our customers.

Exceptional Customer Experiences

Below are verbatim excerpts of Gartner Peer Insights customer reviews for Aruba EdgeConnect submitted and verified by Gartner Peer Insights over the past 12-months:

Silver Peak – The Powerhouse of SD-WAN Products

“The deployment of this product has been flawless and made our replacement of our existing infrastructure (Cisco ISR 4331) uncomplicated and efficient.”

— Network Engineer, Finance industry (firm size $10 – $30B USD)

“Amazing SD-WAN System. Simple, Yet Extremely Robust. Very Well Designed.”

“Silver Peak’s SD-WAN solution is absolutely amazing. We performed POC’s with several of Gartner’s highest rated solutions and none of them are even close to offering a fully packaged and simplified solution like Silver Peak. We began by only deploying 3 sites on Silver Peak and performed an 18-month POC. Once that completed, we started moving all of our sites to Silver Peak.”

— SVP, Director of IT, Finance industry (firm size $3B – $10B USD)

Easy Win: Performance, Visibility, and Stability With EdgeConnect

“Our overall experience was very positive. We were able to perform a proof-of-concept (POC) and verify that this product met our technical requirements and solved the problems we were looking to solve. We were able to quickly implement this solution globally and have continued to be very satisfied with our decision to choose this product.”

— Senior Network Engineer, Manufacturing Industry (firm size $500M – $1B USD)

To learn more about this distinction, or to read some of the other 65 Aruba EdgeConnect reviews, from the network and IT infrastructure teams who rely on them 24/7, please visit the WAN Edge Infrastructure page on Gartner Peer Insights.

Lastly, if you have an Aruba or Silver Peak story you’d like to share, we encourage you to join the Gartner Peer Insights crowd and weigh in. Your peers will find considerable value in reading your story.

*Reviews and ratings current as of February 24, 2021. The GARTNER PEER INSIGHTS CUSTOMERS’ CHOICE badge is a trademark and service mark of Gartner, Inc., and/or its affiliates, and is used herein with permission. All rights reserved. Gartner Peer Insights Customers’ Choice constitute the subjective opinions of individual end-user reviews, ratings, and data applied against a documented methodology; they neither represent the views of, nor constitute an endorsement by, Gartner or its affiliates.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Enterprises navigate new path to SASE

If enterprises are to realize the full promise of the cloud and digital transformation, while supporting a new work-from-anywhere normal, they must transform both their WAN and security architectures — not just one or the other. As the noise surrounding SASE subsides, the strategic imperative in 2021 will be to successfully navigate a path from legacy data center-centric, perimeter security architectures toward a cloud-centric SASE architecture. This will require an intelligent SD-WAN edge that unifies embedded security capabilities at the edge with automated orchestration and steering for leading cloud-delivered security services. Enterprises will value a neutral, non-captive edge as they simultaneously support their legacy security architecture, navigate towards SASE for an improved user experience, and to address security challenges associated with new IoT initiatives.

Enterprises tackle IoT security challenges       

Digital transformation is driving a proliferation of IoT devices, which, in turn, is creating new security challenges. A zero-trust framework that limits device connectivity to just what is required will become essential to contain threats and prevent lateral movement following a breach. While end-point agents can be used to provide zero trust access for users and applications, agents cannot be installed on most connected devices such as printers, cash registers, cameras and sensors. The new WAN edge will have to implement granular segmentation based on device identification, enforce distinct security policies for each class of IoT endpoints and provide sufficient embedded security capabilities to support east-west inter-segment use cases.

The new Edge will evolve to bring together the principles of SD-WAN, SD-Branch and SASE

The edge is the pivot point for WAN and security transformation and is at the center of three architectural shifts. First, SD-WAN provides cloud-first connectivity and steering in accordance with business policy or intent. Second, SASE provides a better and more direct way to connect users to business applications. Finally, SD-Branch will become increasingly important to simplify the branch as IoT adoption accelerates. SD-Branch will enable enterprises to implement consistent role-based policies that tie together identity, device and application, extending control from the wired and wireless edge, to the WAN edge appliance and across the wide-area-network. The coupling of SD-WAN, SD-Branch and SASE will significantly enhance security posture and yield operational efficiencies.

Edge strategies will be reevaluated in light of a new normal

When COVID-19 struck, enterprises needed to quickly adapt and typically reacted by implementing the most expedient remote work options available. Generally, this involved a combination of VDI, remote VPN access and simple-to-deploy cloud managed devices like remote access points. It’s now commonly recognized that the global pandemic has forever changed the way we work and conduct business. In 2021, enterprises will step back and review what they learned in the past year and evolve their remote work strategies, applying a longer-term perspective of the workplace. This will include eliminating trade-offs between security and user-experience and providing more a consistent experience as users work from home, the road or the office.

LEO joins 5G in the race to become the preferred wireless WAN technology

Wireless WAN access technologies have the advantage of being ubiquitous and quick to deploy.  However, the traditional option of 4G/LTE has been expensive and offered lower bandwidth in comparison to wired technologies. This has limited deployments to use cases where existing services are unavailable and time-to-deploy is critical, including construction sites and pop-up shops, and for backup where LTE connectivity is utilized as a last resort. As 5G is rolled out more broadly, improved performance and cost-competitiveness may see 5G adopted for primary connectivity. To support work-from-home, enterprises will extend their SD-WAN fabrics to the home, bonding 5G and consumer broadband services to deliver the highest quality of experience for latency-sensitive voice and video applications and significantly improving network and application availability and resiliency. We are also witnessing early trials of low earth orbit (LEO) satellite broadband service, and we expect that later in 2021 a new race will emerge between 5G and LEO broadband, with the later promising blanket coverage to all parts of the globe. This will be a boon for businesses that require connectivity in remote locations, adding LEO broadband to the list of SD-WAN connectivity options.

IoT will drive the requirement for dynamic segmentation

Network segmentation is critical to containing security breaches. To date, most enterprises have segmented traffic using VLANs and virtual routing and forwarding (VRF) technology. This enables them to separate guest Wi-Fi traffic from business application traffic from cash register transactions and IoT device traffic. With digital transformation driving a surge of IoT device deployment, and the potential for lateral movement from one class of compromised device to others, a new requirement for finer-grained segmentation by IoT device type is emerging. This will increase the number of segments required in a typical branch from single digits to fifty or more, multiplying the number VLANs, subnets and VRFs, in turn increasing complexity and administration overhead exponentially. In 2021, we will see a significant uptick in adoption of dynamic segmentation architectures that create virtual segments based on end-user role, device type and end-point security posture, allowing tens or even hundreds of segments to be created, as needs arise, without requiring VLAN or subnet allocation. This trend will start from the edge, in the branch and campus. This granular segmentation will be extended across the WAN by advanced SD-WAN and SD-Branch implementations, realizing the true potential of fully orchestrated, edge-to-edge dynamic segmentation.

Advances in automation and AI propel enterprises toward a self-driving wide area network

A growing number of enterprises are benefitting from advances in automation and the use of AI at the WAN edge to further streamline application management. Advanced SD-WAN edge platforms are business-driven, reflecting a top-down approach to aligning network resources to the changing needs of the business. Advances in areas like threat analysis and automated diagnostics are making the network more secure and resilient to disruptions in underlying network conditions and an ever-expanding threat landscape. Network engineers are becoming more confident in “letting the network drive itself”, acknowledging the benefits of being able to focus more attention on moving their businesses forward and less on day-to-day administration.

The software-defined enterprise will emerge

Much as we’ve witnessed with SD-WAN where automation and AI have created a much better way of implementing WANs, the same software-defined principles are being applied in other areas like the data center and campus LAN. In 2021, these software-defined silos will begin to come together into a broader software-defined enterprise architecture. We have seen early steps with SD-Branch, which unifies SD-LAN, SD-WAN and branch security together under one orchestration framework. With the help of VXLAN meta data dynamic security segmentation can be extended from the LAN across the WAN and into the data center or cloud. With end-to-end automation, AI and role-based policy control driven consistently across remote sites, campus, data center and cloud, enterprises will benefit from driving substantial gains in business efficiency and agility.

The question of the day: Is now the time for Managed Service Providers (MSPs) to define and formalize a SASE offering to deliver an expanded set of managed and professional services that support an integrated enterprise network and security transformation?

Often, IT executives prefer to “buy” vs. “build” when it comes to the WAN or network security by selecting a single or multiple Managed Service Providers (MSPs) to provide either a turnkey managed WAN/SD-WAN service, a managed security service for their corporate WAN sites or a combination of both in some cases. 

Managed SD-WAN & Security Services

Do you want a fully managed service in which the MSP handles everything (service delivery, management, monitoring, troubleshooting)? Or do you prefer a co-managed service that enables you to retain certain “self-service” capabilities like making firewall rule changes, adding new SaaS applications, configuring business intent policing, or updating approved web proxy lists?

Whether fully managed, co-managed or self-service, it’s necessary to carefully examine the SLAs of any new SASE managed service offerings. What is the turnaround time when problems arise as they inevitably will? Does the provider help develop and enforce security policies? How do you securely support new SaaS applications across all WAN sites?

Today, MSPs have an opportunity to be the IT solution provider and integrator of these two important technologies: networking and security. Leading MSPs have dedicated technical expertise and resources in both domains to design, build and implement either a turnkey managed security service or a managed SD-WAN service.

Many MSPs also choose “best-of-breed” network security and “best-of-breed” SD-WAN technology vendor partners as part of their managed WAN/SD-WAN and security service offerings.

So, are MSPs embracing SASE and are they ready to help enterprises implement their network and security transformation? This is where you need to do your due diligence.

The MSP service delivery model aligns well with SASE, opening up a world where managed services are defined, refined, and deployed on demand, allowing cost-efficiencies, scalability, and simplicity.

Convergence of MSP SD-WAN and SASE strategy

MSPs, however will likely need to revamp their existing siloed organizational structures to be able to deliver integrated managed networking and security services to enterprise customers, which is really what SASE is all about. MSPs need to partner with their networking and security technology vendors to leverage open APIs, automation, provisioning/deployment integrations and service chaining between security and SD-WAN vendors to help simplify the service integration and an eventual path towards SASE. This will also enable you to select your preferred SD-WAN and security vendors and technologies in alignment with your business requirements.

To realize the promise of a SASE architecture however, a basic SD-WAN solution with limited WAN edge capabilities simply won’t deliver the application performance and high quality of experience enterprises strive to achieve with a cloud-first transformation.

MSPs offering a “best-of-breed” managed solution should partner with a SD-WAN vendor that supports the following eight capabilities which are the attributes of an advanced SD-WAN platform that will fully deliver on the promise of a SASE architecture.

• First-packet application identification and classification to enable granular, automated traffic steering
• Automated, daily application definition and TCP/IP address table updates to all sites across your network
• Automated orchestration with cloud-delivered security services from best-of-breed cloud-security vendors including Zscaler Internet Access, Netskope Security Cloud, Check Point CloudGuard Connect and Palo Alto Prisma Access

• Automatic failover to a secondary cloud enforcement point if the primary is unreachable
• Automatic reconfiguration and redirect should a closer enforcement point become available
• Enable enterprises to implement a SASE architecture at their own pace

• Offer enterprises the freedom of choice to avoid vendor lock-in, enabling the adoption of new security innovations as they become available in the future, including MSPs own cloud-delivered security services
• Flexibility to deploy DIY, managed, and co-managed services

MSPs will need to adapt and deliver hybrid—premise and multi-cloud solutions—to meet a wide variety of enterprise use cases on the path toward SASE. This includes partnerships and integrations with the major public cloud providers. They will need to decide which technology vendor partners, are best positioned to deliver the solutions to support a SASE architecture and assess the internal development and system integration investment required to launch new SASE managed edge services.

Some vendors market and offer an “all-in-one” SASE solution promising seamless integration, simplicity and the benefit of having a “one-throat-to-choke” business model. While this may sound enticing on the surface, it routinely results in vendor lock-in and compromises. It means either compromising the advanced networking functionality to fully optimize your SASE architecture. Or it means potentially exposing the MSP and enterprises to new threats that require rapid intervention.

The MSPs and enterprises that have started their journey towards adopting a SASE framework should ensure that they retain the “freedom of choice” to select an open, advanced SD-WAN platform that enables MSPs and enterprises to transform their security model, adapt to the changing networking and security landscape, and fully embrace SASE at their own pace.