& cplSiteName &

SD-WAN Security a Headache?

Kelsey Kusterer Ziser

One of the early challenges in the burgeoning SD-WAN market is addressing security, and that includes both the reality and the customer perception of how secure this new service offering can be.

For example, service provider MetTel finds some customers try to run their own IPsec tunnels over the SD-WAN platform, creating new problems for themselves, because they aren't convinced the existing software-defined wide area networking service is secure, says Ed Fox, vice president of network services.

"When we go into a situation where the customer might not have MPLS today, but at their branches they're doing VPN and IPsec tunnels -- they're kind of making their own mesh -- those particular customers present a challenge when they deploy because they still want to run their IPsec tunnels over the SD-WAN solution and you lose a lot of what the SD-WAN solution gives you."

That additional encryption reduces network traffic and application visibility, and diminishes the benefits of utilizing SD-WAN. But some security operations teams remain concerned over the notion that bringing in an Internet connection to support bandwidth-intensive applications in the branch will expose them to new security threats.

"You have this situation where you have tunnels over tunnels over tunnels, which in some cases actually increases the packet size so much that there are certain things that we have to do -- particularly when LTE is part of the solution -- because those networks are very packet-size sensitive," added Fox. "So we have to make sure we take extra precautions in those situations."

Fox noted the importance of talking to customers during on-boarding of SD-WAN services to avoid this security challenge, and determine if the customer wants to maintain control over their tunnels or rely on MetTel to encrypt their traffic. MetTel currently has more than 90 customers with greater than 2,000 sites supported with SD-WAN, and has partnered with VeloCloud Networks Inc. for more than two years for SD-WAN services.

In an interview with Light Reading, VeloCloud's Vice President of Marketing Mike Wood echoed Fox's sentiment that it's important for operators to talk to enterprises deploying SD-WAN not just about its overall benefits but also its secure architecture. For example, during initial deployment, the VeloCloud SD-WAN device activates only after credentials are downloaded from the orchestrator or the branch manager authenticates the device via a link emailed by the orchestrator.

Track the heartbeat of the virtualization movement with Light Reading at the NFV & Carrier SDN event in Denver. There's still time to register for this exclusive opportunity to learn from and network with industry experts -- communications service providers get in free!

But if users don't understand that the SD-WAN service is secured and data encrypted using IPsec tunnels at the device, keeping messaging, control and management secure, Wood says, they may feel the need to add their own IPSec tunnels, creating the problems Fox describes.

In order to achieve interoperability with current and future security systems, VeloCloud created the SD-WAN Security Technology Partner Program to afford enterprises the choice to integrate the SD-WAN service with their preferred security technology. The program launched in April, enabling VelcoCloud to service chain security offerings with security partners including Check Point Software Technologies, Zscaler, IBM Security, Palo Alto Networks and Fortinet -- which MetTel also works with for its cloud firewall product. (See SD-WAN Buzz Spills Into Reseller & Partner Space.)

Next page: Multiple approaches to secure SD-WAN

(3)  | 
Comment  | 
Print  | 
Newest First  |  Oldest First  |  Threaded View        ADD A COMMENT
User Rank: Light Beer
8/15/2017 | 3:43:34 PM
Zero Trust Security with Session Routing from 128T can help
As noted, when deploying an SD-WAN solution, there is often a juggling act of ensuring security without losing the pre-conceived value (improved agility and cost savings) of the solution. Given that SD-WAN technologies rely on tunnels and overlays, they require coordinated provisioning along with automated key management, which isn't easy, particularly without defined standards and protocols. An alternative approach, which is actually simpler and cheaper over the long-haul, is by leapfrogging SD-WAN technologies that rely on tunnels and overlay techniques. The key is being session-oriented – understanding the language of applications and services – to enable visibility into the unique two-way exchange of information between source and destination endpoints. With session-orientation, you can enforce a Zero Trust Security model - ensuring that only valid sessions are sent along with required encryption and authentication. This removes complexities from the layers of infrastructure, and the required intricate coordination will resolve headaches.
User Rank: Light Beer
8/14/2017 | 4:40:22 AM
Cato Networks converges SD-WAN, Security as a Service and a Global Backbone
I agree that running IPSEC tunnels over SD-WAN provided IPSEC (or in our case DTLS) tunnels doesn't make sense. 

Threat protection and application control is a totally different story. Edge SD-WAN vendors work through service chaining or VNFs (virtual appliances), which involves backhauling or deploying security capabilities in the branch. Cato built a global backbone that has a full network security stack built into it. Our SD-WAN edge device and clients, connect branches, cloud instances, and mobile users to the cloud service and direct the traffic to the cloud service. All traffic, WAN and Internet, is inspected in our PoPs within 30ms of the resource - no "backhauling" and no need to deploy security in the branch (virtual or physical). 


Disclosure: I work for Cato Networks. 


User Rank: Light Sabre
8/9/2017 | 3:08:20 PM
Security is probably the number one headache for anything involving communications. We can guess that because nobody really wants to talk about it.
From The Founder
NFV's promises of automation and virtualization are intriguing, but what really excites service providers is the massive amount of money they could save.
Flash Poll
Live Streaming Video
Charting the CSP's Future
Six different communications service providers join to debate their visions of the future CSP, following a landmark presentation from AT&T on its massive virtualization efforts and a look back on where the telecom industry has been and where it's going from two industry veterans.
Women in Comms Introduction Videos
VMWare VP Brings Women Up With Her

8|16|17   |   6:49   |   (1) comment

It's an art and a science to make mentorship, inclusive leadership, diversity and promotion of high-potential women work, says Honore' LaBourdette, vice president of Global Market Development at VMWare.
LRTV Documentaries
5G Spectrum Wars – The Recap

8|15|17   |   2:22   |   (0) comments

Service provider 3 has filed a lawsuit against Ofcom over 5G spectrum auction in the UK.
LRTV Custom TV
Say What? Facebook Unleashes AI Anarchy – The Recap

8|7|17   |     |   (0) comments

A recap of the week's talking points on Light Reading's sister site, telecoms.com. Facebook AI programmers had a bit of a brain-fade as they allowed one of its AI applications to invent its ...
Women in Comms Introduction Videos
Fujitsu's Women Band Together to Help Girls Do STEM

8|2|17   |   9:35   |   (1) comment

Supporting women both inside and outside of Fujitsu is a top priority of the telecom vendor. Yanbing Li, Fujitsu Network Communication's director of System Software Development & Delivery, shares why it's important, but why there's still a long road ahead.
LRTV Custom TV
If You're Not First, You're Last – The Recap

7|31|17   |   08:18   |   (1) comment

In case you missed it, Amazon's 1% stock increase helped Jeff Bezos dethrone Bill Gates as the richest man in the world. Also, Taiwanese electronics manufacturer
Women in Comms Introduction Videos
AT&T's Tech President Preps Workforce for the Future

7|26|17   |   5:47   |   (10) comments

AT&T is focused on the software-defined network of the future and is reskilling its workforce to get ready too, according to AT&T's President of Technology Development Melissa Arnoldi.
Women in Comms Introduction Videos
Cisco: Mentoring Critical to Attract & Retain Women

7|19|17   |   6:40   |   (1) comment

Liz Centoni, senior vice president and general manager of Cisco's Computing System Product Group, shares why mentoring in all its forms is important for women and what Cisco is doing that's made a difference for women in tech.
LRTV Custom TV
Gigabit LTE With Snapdragon 835

7|12|17   |     |   (1) comment

At an event in Wembley stadium, EE used its live network to demonstrate gigabit LTE using a Sony Xperia XZ Premium smartphone with a Qualcomm Snapdragon 835 chip.
LRTV Custom TV
Implementing Machine Intelligence With Guavus

7|12|17   |     |   (0) comments

Guavus unites big data and machine intelligence, enabling many of the the largest service providers in the world to save money and drive measureable revenue. Learn how applying Machine Intelligence substantially reduces operational costs and in many cases can eliminate subscriber impact, meaning a better subscriber experience and higher NPS.
LRTV Custom TV
Unlocking Customer Experience Insights With Machine Intelligence

7|12|17   |     |   (0) comments

When used to analyze operational data and to drive operational decisions, machine intelligence reduces the number of tasks which require human intervention. Guavus invested in Machine Intelligence early. Learn about the difference between Machine Learning and Machine Intelligence.
Women in Comms Introduction Videos
Verizon VP Talks Network, Career Planning

7|12|17   |   4:49   |   (0) comments

Heidi Hemmer, vice president of Technology, Strategy & Planning at Verizon, shares how bold bets and the future of tech define her career.
Telecom Innovators Video Showcase
Masergy's NFV Journey

7|11|17   |     |   (0) comments

Ray Watson, vice president of global technology at Masergy, discusses the advantages and challenges in entering the still-maturing NFV market for the past three years.
Upcoming Live Events
September 28, 2017, Denver, CO
October 18, 2017, Colorado Convention Center - Denver, CO
November 1, 2017, The Royal Garden Hotel
November 1, 2017, The Montcalm Marble Arch
November 2, 2017, 8 Northumberland Avenue, London, UK
November 30, 2017, The Westin Times Square
All Upcoming Live Events
With the mobile ecosystem becoming increasingly vulnerable to security threats, AdaptiveMobile has laid out some of the key considerations for the wireless community.
Hot Topics
Intel CEO Leaves Trump Biz Advisory Board
Dan Jones, Mobile Editor, 8/15/2017
Are Cord-Cutting's Days Numbered?
Alan Breznick, Cable/Video Practice Leader, Light Reading, 8/14/2017
Orchestration Startup UBiqube Pivots Away From NFV
Carol Wilson, Editor-at-large, 8/15/2017
Verizon Video Woes Pile On
Mari Silbey, Senior Editor, Cable/Video, 8/14/2017
WiCipedia: Dolly Babes, Manifesto Backlash & 'Brotastic' Failures
Eryn Leavens, Special Features & Copy Editor, 8/18/2017
Like Us on Facebook
Twitter Feed
Animals with Phones
We Know a Tough Day When We See One Click Here
Live Digital Audio

Understanding the full experience of women in technology requires starting at the collegiate level (or sooner) and studying the technologies women are involved with, company cultures they're part of and personal experiences of individuals.

During this WiC radio show, we will talk with Nicole Engelbert, the director of Research & Analysis for Ovum Technology and a 23-year telecom industry veteran, about her experiences and perspectives on women in tech. Engelbert covers infrastructure, applications and industries for Ovum, but she is also involved in the research firm's higher education team and has helped colleges and universities globally leverage technology as a strategy for improving recruitment, retention and graduation performance.

She will share her unique insight into the collegiate level, where women pursuing engineering and STEM-related degrees is dwindling. Engelbert will also reveal new, original Ovum research on the topics of artificial intelligence, the Internet of Things, security and augmented reality, as well as discuss what each of those technologies might mean for women in our field. As always, we'll also leave plenty of time to answer all your questions live on the air and chat board.