When it comes to networks and SD-WAN, businesses have an increasing number of options. And with that comes a whole lot of confusion.
Most enterprises see this world in two colors: last-mile (Internet) or Private Network (MPLS).
When it comes to networks and SD-WAN, businesses have an increasing number of options. And with that comes a whole lot of confusion.
Most enterprises see this world in two colors: last-mile (Internet) or Private Network (MPLS).
Internet-based Networks for SD-WAN: Should I Care?
It's pretty common to call these last-mile connected networks "Internet" or "Internet-based" but that can be pretty misleading. The only thing that necessarily makes them "Internet" is their use of a last-mile connection to your SD-WAN.
Beyond the last mile, solutions range from Internet Core (the only true Internet network in this case), to Optimized Internet, to Private Networks. Yes, private networks that connect via last-mile, and perform like traditional private networks.
We all know that MPLS offers private-network performance. At a great cost. And often, great pain (operationally speaking).
We also know that these "Internet-based" networks that connect via last-mile to your SD-WAN are the future. So, in thinking about your future, here's the question of the day:
Do differences among these Internet-based networks matter to most businesses? To your business?
It's already been shown that last-mile Internet can be part of a reliable, high-performance enterprise WAN. Redundancy functions in SD-WANs makes this even more true. It's also been shown that most performance variability, e.g. latency variation, happens in the core (>99%), and not the last mile.
We know that when it comes to cloud-evolved businesses that rely on hybrid or multicloud, SaaS, long-distance collaboration, etc.- milliseconds matter. For example, a single millisecond difference between financial networks can cost an institution $4M. A 1Gbps connection with 30ms of latency has 17.4 Mbps of effective throughput. At 50ms of latency, audio gets choppy. At 80ms, video goes the same way. Amazon loses 1% of sales for every 100ms of network latency. And SaaS usage drops by 8% every 200ms.
The ultimate comparison of Internet-based networks would be a study of performance extremes: poor, plain old Internet on one hand, and an Internet-connected next-generation private core on the other. It’s not fair.
So we did it anyway.
Designing a meaningful study of public versus Internet-connected private network performance in the context of the modern hybrid Enterprise poses significant challenges. The unpredictable nature of the Internet, combined with its massive scale and rapidly-changing peering structure, complicates quantitative comparison. Measure too little for too short a period of time, and the data may be anomalous.
We overcompensated. Working with our service provider partners, we collected 320+ million data points over four weeks, among 32 last-mile locations, 24 cloud instances, two cloud providers, and four continents. We are proud of the result: a study of substantial power.
The results of this extensive research will be published shortly as The 2019 Public vs. Private WAN Performance Comparison. Which is really a comparison between Internet and an Internet-connected private network for your SD-WAN. Both share the last mile. The core is where they differ.
You: Hey, Adam, are you certain that using an Internet-connected Private Network for my SD-WAN can really help my business.
Me: I am not uncertain (thanks, Dollar Bill)!
But let's not beat around the bush. You can take a look at our one-page results summary and decide for yourself. And if you're really curious, we might even let you peek at the entire paper. We will cover the details further in a future blog.
Tune in next week to learn what my car wash and your enterprise network have in common. Hint: It's got nothing to do with Armor All.
We all know that bad networks with high latency, latency variation, jitter, and packet loss lead to user frustration – leaving your workers, and your customers, unhappy. Which leads to low usage and churn. Then lost opportunities, and lower profits.
If you're responsible for keeping your WAN Always-On, bad networks can give you worse sleep, and maybe even put your job at risk. So when we say that Mode is the No-Worry Network for your SD-WAN, how do you really know? When you look at that SLA and those performance guarantees, how does that really translate into performance, and how does that performance actually tie into profitability? Stick with me, dear reader, to find out.
Obviously, this is a pretty complicated series of questions. Time to give it some quantitative color.
Let's start with the network metrics that matter. Latency and its Variation, Jitter, and Packet Loss. Each of them can drag down performance - from standard web applications, to real-time applications, to bandwidth-intensive applications like backup and recovery. Some research even suggests that cloud service pricing is causally linked with these metrics. But their impact is different depending on the use case. Let's look into that.
Example: VoIP, videoconferencing
Also: Twitch/Mixer, Real-time Workloads, IoT Streams
Let's consider communications applications, like VoIP and videoconferencing.
Latency itself doesn't affect the quality of the delivered audio, but it can ruin a good conversation. At 100ms of latency, people start talking on top of each other. At 300ms, the conversation becomes unintelligible.
High latency variation is behind all those gloriously bizarre glitches that always seem to happen during the most critical part of a meeting. Hey, Adam, you sound like a robot underwater. Can you try a different network?
High latency variation can even lead to dropped packets when those packets arrive with excessive delay, causinge the worst glitch of all - the dropout. I'm sorry Bob, we can't hear you. Can you check your headset?
Real-time communications are typically UDP-based, and for the most part the Internet and its routing designs treat UDP (and other small packet protocols) as second-class citizens. UDP packets are more likely to get dropped as a result of deprioritization. This, and drops due to timing errors and other causes, result in missing conversation and collaboration data, and more dreaded dropouts.
Collaboration application performance is often graded by the Mean Opinion Score (MOS), a universal metric to measure and classify the quality of VoIP and videoconferences. It ranges from 1.0 (low) to 5.0 (high) with 3.0 deemed the very limit of acceptability. For each 100ms latency, the MOS score drops by one point. Since 150ms is the limit of physical latency for a round-the-world trip, you can see how very long distances automatically put the quality of voice and video at risk, starting at 3.5. Just 50ms of added latency puts the conversation below the threshold of acceptable performance.
For example, a long-distance video conference with a physical latency limit of 100ms, needs only 100ms of added latency, or 50ms of latency variation, to put the collaboration session below the line of acceptable. In real-time, every millisecond matters. Which is another way of saying the network matters, a lot, for real-time application performance.
Even though we're talking voice and video, the effect is essentially the same for all real-time applications, one of the fastest-growing segments of enterprise applications. Real-time collaboration and workloads. IoT streaming. Highly distributed data requiring fast assembly and analysis.But what about other Enterprise use cases?
Modern SaaS application performance deteriorates steeply with latency variation beyond 80ms, and packet loss beyond 0.5%.
Backup, Recovery and Large Files
Both backup and recovery are bandwidth-intensive, sensitive to latency variation beyond 25ms and 10ms respectively, and packet loss beyond 0.75% and 0.25% respectively.
So while latency, latency variation, and packet loss are all killers for real-time application performance, they can affect other SaaS and IaaS performance just as easily.
Guess what? When you use the best-efforts Internet with your SD-WAN, you put your business at risk. Why? Performance and Security. Learn more about Mode security here.
According to a recent study (with over 320 million data points collected over four weeks, among 32 last-mile locations, 24 cloud instances, two cloud providers, and four continents):
Latency, latency variation, and packet loss can crush all types of SaaS and IaaS performance, battering your bottom line. Mode is the No-Worry Network for your SD-WAN, letting you stress less and do more – BECAUSE we keep your WAN metrics far away from the danger zone.
Best of all, we can get your SD-WAN out of the danger zone in under sixty seconds. All you have to do is ask us how. And that's got to help you sleep better at night.
Everyone reading this blog has lived long enough to see records broken. Giants laid low. Things thought impossible, made commonplace. Gold standards surpassed and forgotten. In the modern era of business connectivity, MPLS has been the gold standard for quite some time.
A real 90's throwback that everyone knows has stayed around a bit too long, like melted Vanilla Ice. And yet, MPLS use is growing, year over year. The truth: exploding bandwidth, combined with inertia, is camouflaging an otherwise declining tech.
The stake through the heart of MPLS will be alternative solutions that are faster, better, cheaper. SD-WAN is the tip of this sharp instrument, and SD-CORE the follow through. It won't happen overnight. It will be a gradual realization of parity, followed by a soft coup. It's already well on its way.
It began with this question: is MPLS really as good as it gets?
There are already whispers among CIOs about things like underwhelming MPLS performance, or lapses in virtualized tenant separation, hence privacy. But leave it to Steve Garson and the folks at SD-WAN Experts to ask this blunt question: if an SD-WAN and an MPLS connection have the same bandwidth, which offers better performance?
To answer this, they examined a manufacturer considering a switch from MPLS to SD-WAN, starting with a branch in Latin America.
On the MPLS side, they found occasional routes with latency variations up to one-tenth of a second, inferior performance indeed. This could be due to policy. Or it could be related to the fact that no service provider has a true global MPLS network — it's assembled through business relationships with countless regional players, often with unpredictable results, perhaps including this one.
SD-WAN Experts then examined specific routes between the US and either Costa Rica or Mexico. In the case of Mexico, MPLS scores were significantly poorer than Internet. In fact, on these routes, at that point in time, the Internet had 66% less latency variation than MPLS.
Of course, this isn't usually the case. MPLS is generally reliably good (so says the SLA and the nosebleed pricing), and the Internet is ... unpredictably good (or unpredictably bad). Or simply, unpredictable.
One thing is clear: you need network redundancy to deliver true high availability. Even MPLS, on its lonesome, is no longer a safe bet.
Let's consider the mechanisms of redundancy. SD-WAN offers last-mile redundancy. That's a good start if you use it.
When it comes to the core, the wise company also seeks redundancy. For example, rather than backup MPLS with another MPLS connection, consider using an SD-WAN with a high availability software-defined backbone. It could make all the difference, and save you a lot of money to boot.
Many Internet Core alternatives have different flavors of redundancy baked right into their designs. Optimized Internet approaches use POPs to probe various opaque public IP paths, slowly switching among them based on performance guesstimates. A sort of redundancy, albeit limited and crude.
The ultimate form of redundancy would be to roll up every network on earth under a perfect, autonomous control overlay. Not only would you benefit from the entire pan-global capacity, but you'd also have software scouring all those connections for the one, optimal path for your traffic, every 150ms.
Mode does not control every network. Yet. :) But it does have a perfect autonomous control overlay. Mode Core capacity starts with a global underlay provided by Ericsson and nearly 100 service providers, and it grows with each SP underlay we add. No limits. An autonomously controlled network with massive capacity offers the ultimate form of redundancy — the fastest possible combination of measure, calculate, and control, routing packets around any obstacle, tripling effective network utilization. Finding the right way, at just the right moment, considering all available options.
MPLS may not be the universal gold standard we thought it was. That's ok, we can all live with that. It's worth it, should it help us recognize the peril of putting all our eggs into one basket.
It's time to diversify. Go ahead and backup that MPLS! Redundancy is our friend, and SD-CORE is a big step towards a No-Worry Network.
You can read Steve Garson's original piece here. Make sure to come back next week for another take on the need for redundancy!
For Enterprises, SD-WAN provides last-mile reliability, cloud orchestration, and IPSEC-based security and privacy. But in its most basic form, SD-WAN does little to ameliorate the effect of...
If your business relies on applications and infrastructure running in the cloud, you know how much reliable, high-performance connectivity contributes to the end user's quality of experience.
For Enterprises, SD-WAN provides last-mile reliability, cloud orchestration, and IPSEC-based security and privacy. But in its most basic form, SD-WAN does little to ameliorate the effect of best-efforts internet and its unpredictable interference with a stable SaaS and IaaS quality of experience (QoE).
Of course, there are exceptions. Talari Networks failsafe SD-WAN, for example, works with Mode Core to provide reliable, high-performance multi-cloud access. You can hear more about this very subject by tuning in to our webinar featuring Talari/Oracle CMO Andy Gottlieb:
Webinar: Failsafe SD-WANs
When: Wednesday, March 20th, 10:00 a.m. (PDT)
If you're in the business of cloud-dependent applications — from unified communications to multiplayer gaming — you've historically had to make a tough choice: live with the unpredictable nature of the best-efforts Internet, or roll your own network and assume network infrastructure commitments and operations management. Having to become a network operator when it isn't your core focus isn't much fun at all.
We aren't the first to have this epiphany. Back in 2016, our friends at Riot Games wrote about this exact topic. What they didn't know at that time was that work was already underway on a new, autonomous algorithm for packet network control that would change the game of reliable networking forever. Pun totally intentional. More about that later.
Riot Games complained that that Internet just didn't cut it for real-time applications. That's certainly true — and it covers games, voice, video, and pretty much the gamut of what's coming, application-wise. But the Internet is also problematic for mission-critical long-haul business traffic, large file transfers, and traffic requiring high security and a low attack surface.
When it comes to SaaS and IaaS performance, you need three things to guarantee high QoE: a. high-performance private connections to the major cloud services, b. high-availability, high-performance round-the-world connectivity between end users and these multi-clouds, and c. affordability, without which the applicable business cases become vanishingly small in number.
We built Mode Core to be the ultimate No-Worry Network for cloud access. Mode Core's software overlay uses Perfect Network ControlTM to drive underlay fiber networks from Ericsson and nearly 100 major service providers toward an optimal state, every 150ms. The end result is the fastest possible path for your traffic, with the lowest latency variation, and the fewest dropped packets — with control efficiencies delivering this level of private circuit performance at a fraction of the typical price.
Mode Core's capacity grows with each mature service provider underlay added to the global fabric, and Mode's overlay delivers the final word on autonomous packet control — so there is no "pioneer tax" when you go with Mode. Mode Core peers worldwide with all the major cloud providers, including Amazon Web Services, Microsoft Azure, and Google Cloud Platform, giving you the benefit of an affordable, high-performance private connection to these cloud services.
The end result? A No-Worry Network that makes your SaaS and IaaS investments shine, your customers happy, and lets you focus on your core business vs. network operations.
So while Mode Core may be the best thing you can do for your SD-WAN this year — if reliable, high-performance cloud access is the ticket to keeping your customers happy with your cloud-based applications, we're the No-Worry Network for you, too. Give us a shout today!
I read the article and liked it so much that I snatched it back and held it with my GTD (shout out to Todoist, and Buddy Guy) for a future blog. Thanks, David!
This is that.
If 2019 is the year of SD-WAN, and also the year to bet your career on Mode, we are going to have a wild ride. Mode was built to help SD-WAN achieve its ultimate potential, after all.
Your Network Is Showing
The article begins with a bit of a wet blanket: "... despite experts estimating that up to 70 percent of applications have moved to the cloud, the transformational promise of the cloud has fallen short of the hype and expectations ... 85 percent still say they are still years away from fully realizing the benefits of the cloud, citing monthly cloud application disruptions and networks that can't keep pace with demands."
Sounds like the world needs a better network between SD-WANs and clouds, not just a better SD-WAN.
Edge control — the kind delivered by SD-WAN — is great, but it was only a matter of time before promises and expectations met reality: if the core, or backbone, isn't reliable, isn't predictable, isn't secure, and isn't adaptive, SD-WAN devices on the network edge can't deliver the kind of WAN CIOs need. Why? Application disruptions. Networks that can't keep pace with demands. Mode was built to enhance any SD-WAN by addressing what others had neglected — the majority of the network: the core. Bringing incredibly fast, autonomous control to the core. That's the name of the game.
But it doesn't end there. Let's continue with a few more of David's 2019 predictions:
SD-WAN Market Consolidation
Sixty SD-WAN vendors, and counting. This is, perhaps, the most obvious of his points. Folks are making their choices — Cisco bought Viptela and Meraki. Oracle grabbed Talari. And so on. It's musical chairs with only a few seats left, and … hasn't that song has been playing for a while now? How about making your SD-WAN stand out? Future-proof it with a reliable SD-CORE. Make reliable, secure, flexible high-performance HA WAN a lot easier to achieve. Think about it.
Basic SD-WAN Solutions Fall Short
This is a bit of a corollary to the previous point. The basic SD-WANs that lack a rich feature set or (hint) a reliable SD-CORE — that ensures end-to-end zero trust security, MPLS+ guaranteed performance, and a business internet price — are likely to be the ones left standing alone when the music stops. Don't be that guy.
Enterprises Shift to a Business-first Networking Model
Now things are getting interesting. Business-first sounds a lot like intent-based networking. I actually like Business-first better (thanks David). Sure, it's aspirational, but it's clearly where things are going. The network needs to conform to the needs and speed of business, not the other way around. And this has certainly NEVER been the case. Ask any CIO about the carrier train and how much they'd like to get off it once and for all. And while a great SD-WAN can get you part of the way there, you need a great SD-CORE working with it to really make this happen. Why? Because a great SD-WAN connecting to apps, clouds, sites, etc. through rigid MPLS or Basic Internet, or even Optimized Internet, isn't going to be good enough. For end-to-end security. For application performance, in particular those using real-time protocols. For fast, hyper-segmented private global network creation. And for dynamic bandwidth needs featuring wild, instantaneous swings. The dream of Business-first can only come true when affordable, reliable network performance is able to turn on a dime before that business intelligence is out of date. Mode Core is the only SD-CORE with control changes made at every node, in parallel, every 150ms. No global network on earth can react faster to the changes expected of it. That was always our intent.
SD-WAN and UCaaS Come Together
Voice. Video. Grand daddies of real time. Lag is a drag. If SD-WAN customers, as David writes, "expect [that] the quality, availability, and reliability meets or exceeds their traditional telephony solutions" those UC sessions had better be using something other than BGP-backed Internet or even Optimized Internet for long-haul transport. Almost all of the UC providers have already learned this. That's why many of them have been forced to become something they never wanted to be: network operators, burdened with building their own global backbones. That's tremendously bad for time-to-market and margins. There has to be a better way: a private global network as a service that's ready to take any application based on real-time protocols up to — and beyond — "traditional telephony solutions" performance levels. For a fraction of the cost of any of today's private networks. All possible because of the efficiencies derived from autonomous control. Perfect Network Control™. Only available in Mode Core.
WAN Segmentation — Key to Securing the Enterprise
If segmentation is a key to Enterprise security, Mode has you covered (working with your SD-WAN of course). First, we feature a low attack surface global backbone, based on underlay networks from Ericsson and nearly 100 large service providers. Mode Core allows the spin up of a global private network with HA, MPLS+ performance, and a granular MPLS+ SLA, in under a minute. You can create a separate global private network, in under a minute, for each and every application you run on your WAN. Most importantly, if you're a compliance-sensitive organization where highest-level security is paramount, Mode is a Zero Trust Network. We don't decrypt your data, ever, to achieve our performance gains. Unlike others who apply WAN optimization at the POP, we don't. Also, keep your security keys under the exclusive domain of your Enterprise. We don't need them. We don't want them. WAN Optimizations and then encryption occur on the business premises via our SD-WAN CPE partners, with encrypted traffic traversing a hijack-immune Mode Core, and eventual decryption done safely at the end, on the customer's premises. So while we agree that one key to enterprise security is hyper-segmentation, we also believe the other is a core network that delivers all its performance gains without the need to trust us, your service provider, or the Internet. Of course, if the enterprise requests Mode Core to direct traffic to a trusted cloud security service, for example, we can — but we leave that choice to customers, rather than force it upon them.
A Unified SD-WAN Platform for Multi-Cloud Deployments
Mode makes HA, high-performance, secure, affordable multi-cloud and hybrid cloud easy. Mode Core provides turnkey, reliable access to both your data centers (with SD-WAN) and today's SaaS, IaaS, PaaS, cloud solutions — at a business-internet price point. That is a lot different than the "free to store, expensive to retrieve" model common among the leading cloud providers. While a good SD-WAN can help provide a certain degree of last-mile and path redundancy, improving cloud access performance, it's no substitute for discrete software control of a global SP backbone that holistically flows towards an optimal solution every 150ms. Cloud with confidence, my friends, with Mode + your SD-WAN.
David Hughes, I really want to thank you for your excellent article. I believe it's fair to say that Mode and Silver Peak share many elements of the same vision for SD-WAN. And that only makes sense, since Mode is one of the best things (we think the very best) you can do for your SD-WAN in 2019. And probably for quite a bit of time beyond that, but let's not get ahead of ourselves.
We're hoping your curiosity is at least piqued here, because ours most definitely is — and Mode Core is our product! Reach out to Mode with your questions or to learn more. We are here for you in the Year of SD-WAN.
We are pleased to announce our upcoming webinar:
Featuring: Andy Gottlieb CMO and Co-Founder, Talari Networks/Oracle
When: Wednesday, March 20th, 10:00 a.m. (PDT)
Make sure to mark your calendar and learn about failsafe SD-WANs and turning your Enterprise WAN into a No-Worry Network.
I really wanted to go with "dummy" but I was alerted to all the wonderful lawsuit potential. Still, I argued, we are a young company. No one will notice or care. And then I stared down at my weisswurst and spaetzle, and this happened. Not really. But let's imagine it anyway, like a magic trick we just want to believe.
A lot of the magic at Mode comes from research at Cornell by our co-founders, Drs. Tang and Michael. Their groundbreaking work defined packet networks as control systems for the first time — something many had previously labeled a fool's errand. And yet, there it was: the characteristic equations, swaddled in a delicate blanket of the Mode HALO algorithm, and math. Lots and lots of math.
When I first joined Mode I took a look at the original paper. I am no slouch at math, but I topped out at Linear Algebra (thanks to Professor Schultheiss). Could not make heads or tails of this stuff. Just take a deep breath and #believe.
Of course, Mode's victories in NSF and AT&T challenges have given all of us non-computer scientists great comfort. But it's really disconcerting to market a product you can't really understand, at its fundamental levels, isn't it?
Hence, the inspiration for this blog. Yes, dear reader, we are going to walk through a layman's version of Perfect Network ControlTM, the math-less version — and come out the other end with a pretty instinctive understanding of how it works and why it matters. The how is its ability to drive any packet network to perfection, every 150ms. The why is realizing that no-worry networks begin with no-compromise networks. We've come to accept that you can have ultimate performance or low cost, but never both. And that's a compromise that you no longer have to make once Perfect Network ControlTM comes to town.
But first, I'm told by our SEO guru that we are simply not peppering our prose with enough juicy SEO goodness. So, a paragraph to my dear friend, Google AI. If you're a human, you might find this as offensive as do I.
SD-WAN SDWAN software defined networking what is sd wan vs MPLS Cisco SDWAN software defined wan SD network sd wan benefits sd wan mpls why sd wan mpls alternatives cloud mpls mpls circuit cost VoIP call quality issues VoIP jitter #dontyoujustlovewritingforacomptuer Hey google read this!
And ... we're back. Let's start. The trick to understanding the math behind Mode HALO and Perfect Network ControlTM is to understand proportionality. We might never be able to understand the math itself, but we can think through the goal of the math and the common sense behind what things are proportional, or inversely proportional, to that result.
First, let's talk bang-bang. No, not the children's book. Fun fact — same author as the Bond series. Weird, huh? Bang-bang control in engineering models. Take a simple network — starting node, ending node, and two paths. Let's say you randomly select one of the paths and put all your traffic there. Then, you measure which path has more unused capacity (assuming they started equal). You'd wind up selecting the unused path. Then you'd redirect all your traffic to that path. Now, you remeasure. The "shortest" aka "optimal" path has reverted to the original, so you switch again. And again. And again. Ad Infinitum into the kind of wild oscillation seen in clubs in Vegas, not serious networks. If you graphed throughput, you'd see a sawtooth pattern for each path. And if you summed them up in phase, you'd get about 1/2 of the theoretical throughput potential. For latency, it's worse: tons of variation and jitter.
So, what if you didn't move ALL the traffic?
The question that changed everything. The basis of HALO and Mode. What if you moved only a portion of the traffic from the original to the optimal path? It's so simple in concept. But tough to derive and prove.
Calculating this number is, essentially, the foundation of Mode HALO and Perfect Network ControlTM.
It turns out that this number is different for every node on a network, at any given point in time. All a node requires to determine this magic number is, surprisingly, obtainable in no more than 150ms (which is essentially the time required to determine the state of a network on a planet the size of the earth, limited by the speed of light). Wow.
The biggest implication of this breakthrough is its potential for parallelization to support networks of any size with no impact on performance. If every node in a network can compute this number, in parallel, using pure math, and with a frequency limited solely by a physical law (3 x 108 m/s) — you're going to achieve the limit of network control efficiency, and it's going to be wholly independent of network size. Wow8
Here's where the math comes in. So let's take the B route and avoid it. While we might not be able to understand the math required to derive this magical number, we can rock it via proportionality, as shown this deceptively simple equation:
On the top is the initial value of the original path from which you're moving traffic.
It would make sense that if the initial value is very high, then the amount you'd have to move would have to be relatively bigger to make any difference at all. If that initial value were very low, then a much smaller magic number would still make a noticeable difference. So our magic number is proportional to initial value of the current path from which we are moving traffic.
On the bottom, two things. First, the total traffic FLOW.
Think of it this way. If you were diverting a river, the more massive the flow of the river, the more careful you'd have to be with diversion, or face a catastrophic event. You'd start small to make sure that things can handle the change. It's the same here. If the flow is super high, you have to be careful moving from one path to the other. The higher the flow, the slower you'd make the move just to be sure. So, the magic number is inversely proportional to the total flow.
Also on the bottom, network "geometry" of the shortest path is akin to the multifaceted complexity of that path.
How many hops, how much distance, how much branching. The more complexity of the new "optimal" path, the more risk. And the greater the risk, the less toe you want to dip into that pond. It's just common sense that a higher geometric complexity of the recipient path would require a smaller magic number.
Put all these factors together, and you've got a good sense of what each node is thinking as it's driving your network to perfection.
Imagine a network of a billion nodes. Every node on that network is gently pushing the perfect amount of data to its optimal connected path, every 150 milliseconds. Ebbing and flowing, surging and receding, a breathing, giant jellyfish with infinite tendrils pulsing its way across a vast ocean. A thing of beauty. But more than that. The heartbeat of your business. The foundation of your SD-WAN and your network. Always performing. Always secure. Limitlessly flexible. Intimately affordable. And for you — serenity.
Perhaps best of all, now you know how it works. Welcome to the Mode club.
Make sure to come back next week to learn about which amazing guest will be presenting on our March 21 webinar. Save the date!
Dear readers: I'm taking a break this week. You've heard my perspective across 20 blog entries. It's time for someone else. And that someone else is a very special guest blogger. Searl Tate.
Searl is the recent CIO and Managing Director of Paul Hastings, an Am Law 100 law firm, one of the largest in the world, and focused on servicing Fortune 100 companies. Searl is a veteran when it comes to maintaining the highest standards in an Enterprise Network, from high performance and availability to strict security, and Enterprise and client compliance.
At Mode, our goal is to work with the on-premises SD-WANs to deliver a No-Worry Network that helps folks like Searl sleep better at night.
We hope you enjoy his blog.
Let's start by covering the current state of networking. Particularly in light of our highly regulated conditions that all but mandate some form of special compliance above and beyond what many of us are already doing today.
If you have achieved your network compliance goals, congratulations. I suspect there are at least a few of us left wondering what cost-effective solutions are available as an option to upgrading our legacy network circuits. Yes, I regard MPLS as a legacy technology.
This blog is entitled Building Enterprise Compliance & High-Performance Networks since that's the path I see most technology managers debating when faced with their own network upgrade decisions.
I believe this is especially true in our current climate of extreme governance. While my experiences are colored by my time in professional services in Big Law, I think any enterprise manager will appreciate this discussion.
My aim is to cue a few provocative points that may stimulate your own questions, concerns, and challenges.
Our Carrier Journey
What is "Enterprise-Grade Security" and how do you achieve and maintain it?
In its most nascent form, enterprise security was simply a private circuit. We couldn't even count on physical separation, necessarily.
This is a case of picking from the options available — often borne of cost consciousness, performance characteristics, or some other non-security facet. It was only after our basic performance and functional needs were met that we were able to turn our attention to matters of security and compliance.
The long swing of the pendulum has landed us squarely in the middle of a security concern reawakening. There is no doubt that some of the fervor is amplified by government regulations, but the industry needs the wakeup call.
I think we can agree that however we arrived here, there is no question that we are expected to provide a stable, reliable, high-performance network at the lowest cost basis possible.
As a car guy, this reminds of me the old mechanics saw of "fast, good, or cheap — pick any two."
Back to security today, we know this means strong encryption and central key management. It's more, too — consider the attack surface your network faces. This is even before we get into application layer concerns. Keep in mind that a secure network can mitigate plain-text client-server communications. It is one of the easiest ways to shore up this basic compliance requirement.
Beyond this, there are issues of non-availability like you might see with Distributed Denial of Service attacks. This highlights the need for path diversity. Ideally, this failover and reconvergence is handled automatically...and without anyone noticing the hiccup. That always happens, right?
A Little History
You could read this as a lightly coded message to mean "only enterprise customers care about security" — and given the marketplace options until recently, you'd be right. We tend to vote with our wallets, and external pressures are making it clear that we must pony up and establish a better and more secure network platform.
Back to history, that has meant private or logically separated circuits was considered good enough.
Frame-relay networks gave way to MPLS, but the fundamental concerns were still there. Yes, there's some separation, but the real driver here was the value proposition compared to the very expensive and truly private network circuit options. Even if you went that uber expensive route, you only bought basic separation and did not necessarily gain strong security.
An examination of the ubiquity of MPLS networks will quickly reveal this was almost entirely fueled as a cost effective alternative to dedicated private links. With the proliferation of Ethernet backhauls, dynamic bandwidth increases were a reality. That may have been the final nail in the coffin. Only the most critical workloads stayed with expensive dedicated and private networks. There are plenty of examples of where even that gave way to cost consciousness in forums you would never think possible.
So, think about our homegrown IP VPN solutions as a parallel to the newer SD-WAN offerings.
We gained security at the cost of administrative overhead. I guess you could say this delivered cheap and fast. Good was conveniently left behind with the huge win we saw with the apparent cost savings.
Now, we are finally able to instrument and control Quality of Service and deal with our real-time protocol applications like voice and video. SD-WAN appears to be the answer.
The Need for Edge-to-Edge Security and Performance
One lingering area of concern remains with POP-to-POP optimization. Even CDN options do not do enough to run a typical hub-and-spoke partially meshed 30 office network with mixed workloads. Enterprise America has solved the streaming problem, but it did nothing for real-time protocol needs. You really need edge-to-edge and end-to-end performance and security (WAN optimization, network control, end-to-end encryption, etc.). Like the saying goes, you can buy bandwidth but not better latency.
We've Come to Accept Difficult as Normal
Other concerns come up around third-party reliance.
There are too many moving parts and that may equal poor stability and reliability.
Support headaches from the carrier and even your internal staff are to be expected. If you manage this space, you know exactly what I'm talking about here. For too long, we have just accepted this as ordinary housekeeping overhead.
Then why are performance and availability concerns considered vital components of compliance and security?
Consider whether your shop is pursuing an ISO certification based on client mandates, or you’re simply looking to avoid embarrassing/costly public disclosures, strong and reliable security matters.
Additionally, Distributed Denial of Service attacks are now commonplace. This ephemeral attack vector must be dealt with differently.
Even if you are not the intended target, downstream customers are affected. This is probably the most common way you’ll experience a DDoS attack with your provider. There are many under-documented victims with this type of attack.
Now, the following might sound provocative, but it is more intended as a statement of fact — there are NO cost effective single circuit Distributed Denial of Service attack mitigation solutions. Think about that.
When was the last time you saw an advertisement that promised to keep you safe from such a denial of service attack, only to fail in your time of need? What recourse did you have? Were you satisfied by the meter turning in reverse and issuing you a tiny credit? No, of course not.
Relying on a single high-end provider with a scrubbing center is setting yourself up for inevitable failure. IoT based attacks have proven that an army of nodes can be amassed to overwhelm nearly any size circuit! Even if you are not taken down entirely, you are likely left in a degraded state...for hours, or longer.
Beyond that, think about anything that threatens basic network availability to include path diversity. This is especially true for your last mile. How sure are you that you have true path diversity to your office building?
Many low-cost carriers do not know or cannot achieve actual physical path diversity with the other available network options in your building. The problem is complicated when it turns out your carrier is merely carrying the paper for the actual on-network provider. This could mean you are saddled with multiple down circuits in your time of need. This bit of housekeeping is crucial to your long-term success.
With Mode, you will hear more about the middle mile. This is my favorite space since it is what distinguishes Mode Core + any SD-WAN from ordinary IP VPN and related solutions. Yes, you can have security and performance with high availability at reasonable cost.
Invest in a Sustainable Solution
...yes, read that as NOT MPLS. I'm okay with that. Competition is good for the consumer, and this is no different. Disruptive forces find their way into our portfolio, and even they must pivot or perish. The world won't need MPLS much longer, and you will soon be telling war stories that were once relegated to the days of frame-relay circuits.
Get Off the Carrier Train
If you have been in this business as long as I have, you know the dance. Every few years you swap your currently failing or under-performing network operator out for one of the handful of other typical choices...Only to do it again in a few years. Was there ever a real technical advantage one carrier had over another? Were you ever happy? It really was our only choice. We had dubious improvements that quickly decayed only to leave us staring down the prospect of yet another contract negotiation. This is probably why we cannot get comfortable with long-term telecom contracts of any kind. They want long-term commitments to assure recurring revenue generation, but what do you get!?
In my experience, it rarely made sense to engage any carrier contract longer than a couple years. At renewal time you could count on getting more bandwidth for the same money — and we were supposed come away feeling like we won. It is not sustainable. What about the real security issue here?
Turns out, MPLS providers know this too. Have you seen how many MPLS providers that are turning to third-party solutions to bolt on a VPN or yet another in-line appliance to boost security features. How do you think support will work when things go wrong?
How Mode Gives you a No-Worry Network
I am not saying you should fire your MPLS provider now, but instead start your SD-WAN journey NOW and you may find that you don't need your backup MPLS provider. You have one of those, right?
So, build your confidence with some demonstrated progress. You will save a lot of money along the way too. In time, you will see you do not need your legacy MPLS circuits at all.
The Secret Sauce is explained by Mode Core. If you have not had a chance to read the excellent set of white papers, you really need to check it out. If math is your thing, read their CTO's PhD thesis where this whole thing was invented. Dr. Michael and his colleagues are onto something very special here.
To be clear, underlying networks still matter. Elsewhere in our infrastructure, it is the same way server choices still matter. Maybe you're an HP Enterprise shop, or a Cisco shop — lured by promises of Optane, but you are probably not a Dell shop any longer. How you spend here says a lot about how you actually value risk mitigation.
Virtualization was supposed to make brand-name servers a thing of the past, but it did not play out that way for the risk-averse enterprise! We spend the money freely as insurance against the risk poorly managed servers present us. We just do not have the time to deal with that. No, insurance still does not have a Return on Investment!
Still, this SD-WAN advent goes a long way to democratizing secure and high performance networks.
This time around, evolution leads to revolution. Just as we gained confidence with our IP VPN solutions as a backup to MPLS, you can make the jump to SD-WAN to create a truly tier-one primary network — at a cost basis that is nearly the same as your backup network. Depending on your workloads, you just may be able to achieve this overnight. Literally. What does it take to carve out two or three nodes and find out for yourself?
Unlike your IP VPN, you can have QoS with Mode Core — just like you do with MPLS.
So, what does it take?
What are your biggest security needs?
If client compliance drives the concern, you can follow some pretty well-defined recipes for success. That is, you do everything your client tells you to do, or negotiate terms and apply compensating controls. Sound familiar?
Until now, you could not do it at a price point that is about what you would pay for ordinary IP VPN. Turns out even your VPN solution won't satisfy them completely.
Further, given the risks of the unknown, we can't know actual details of new risks waiting to ambush us — but we know the risk areas, and that is why we absolutely need path diversity. No effective SD-WAN solution can do this with a single path.
Mode Lacks a Pioneer Tax
I like "pioneer tax" as an expression. If you're like me, you have paid your dues!
Anyone else here on their fourth or fifth AppleWatch? Sure, it took a bit, but they really nailed it with the Series 4. It just works...finally. No kidding, it's a thing of beauty.
Sometimes iteration is necessary, but there isn't any pioneer tax with Mode because all of the underlying platforms are mature. It is why you can put nearly any network under the power of Mode Core and see huge performance benefits while achieving your security goals. It is not advertised here, but I happen to know they have a number of premium networks to power Mode Core. Ericsson's impressive global network is one such example. Many more are lined up.
One day, the underlying network won't matter nearly as much. As the baseline improves, and even the cheapest providers prove they can deliver, the cost will drop considerably.
I would like to point out the fact that you can implement Mode today. If you spin this up to service utility traffic or a controlled workload, you can see the benefits and begin moving specific network workloads in short order.
What is not covered here are the many ways you can integrate into your existing ecosystem. This means some of your favorite WAN optimization devices will soon offer a drop-down selection to use Mode for your SD-WAN. Drop the folks at Mode a line to hear more about that.
Different Core Categories for SD-WANs
Let's take a look at the following Infographic:
Basic Internet Core is just garden variety Internet access with all the quirks and foibles you've come to love. If you are going this route, you are probably doing it as cheaply as possible. It has its place for basic use cases.
Optimized Internet Core can describe any offering beyond basic Internet service to include CDN, compression, and optimization.
Finally, Private Core is where things get very interesting. It is where you want to be if achieving MPLS performance at much lower costs is your goal.
To further delve into Private Core, I would like to direct your attention to the far right Mode column. You'll see all of the expected performance attributes fully bubbled in end-to-end encryption, high availability and performance, granular SLA, any SD-WAN support, etc. — with the exception of price. It's depicted as 75% of Basic Internet pricing, and that is fair. There's a nominal cost on top of your basic network service.
And now, a few questions and answers:
Welcome to the No-Worry Network
We know what keeps CIOs up at night. Compliance worries. Security worries. Network downtime worries. Performance worries. Even cost worries.
SD-WAN brought control to the edge of the Enterprise network, and it helped, but sleepless nights persisted. Why?
Before I answer that, let me remind you about two things that have been keeping me up at night...
First, don't miss our upcoming webinar, featuring Searl Tate, Recent CIO, and Managing Director Paul Hastings, an AMLAW 100 Law Firm with strict SD-WAN performance, security, and compliance requirements. The topic: Securing The Enterprise with your SD-WAN + Mode Core.
Featuring: Searl Tate, Recent CIO and Managing Director, Paul Hastings LLC;
When: Thursday, January 31st, 10:00 a.m. (PDT)
As I was saying... SD-WAN brought control to the edge of the Enterprise network, and it helped, but sleepless nights persisted. Why?
The core. I could say something about "rotten" but that's so predictable. But what isn't predictable is that ever-present Internet Core wedged between your SD-WANs. It's unreliable. Uncontrollable. Insecure. It's a big ball of worry.
We've talked about bringing the kind of control SD-WAN gives you at the network edge, and extending it to the long-haul core. We've reviewed the various core control approaches — Optimized Internet Core and Private Core. For high-security WANs relied upon by compliance-oriented organizations in need of high performance and high availability, a Private Core is the best practice.
But here’s the secret: if you do it right, your SD-WAN and the right core control will give you a No-Worry Network. OK, maybe a Worry-Less Network, but let's be honest — that just doesn't sound as good.
Our friends at Talari Networks, now part of Oracle, call it Failsafe SD-WAN. That's pretty cool. We can't call it the same thing, but we're talking about the same thing, and working together to make it so. Your CIO: less worry, more sleep.
That's exactly why we built Mode — to make your task of delivering an affordable, high-performance, secure, reliable WAN — that simplifies achieving compliance — much less stressful.
End-to-End vs. POP-to-POP
No-Worry Networks require high performance and high security to live up to their name.
It's Mode's position that you can't achieve either if your performance gains happen at the POP. Today's Cloud MPLS providers, for example, rely on POP-to-POP, and that's simply not worry-free. Here's why:
First of all, if your performance techniques — let's say WAN Optimization — happen at the POP, data decryption outside the Enterprise is implied. That requires the Enterprise to share their keys. And that's a no-no for ultimate security and facilitated compliance. Zero trust, remember?
Secondly, if the magic happens at the POP, your performance gains are going to be limited to POP-to-POP, instead of end-to-end. That can make a huge difference with large file transfers, and frankly any high-performance applications like video and voice. You want to worry less? You need end-to-end performance.
At Mode, we believe all optimizations, encryptions, and security policies should take place on the Enterprise premises. We work with our SD-WAN CPE partners to do just that. None of our amazing performance gains require decryption, and all of those gains are realized end-to-end across the Mode Core Private Global Network as a Service. And not just WAN optimization, but Perfect Network ControlTM, with global control changes at every node on the network, every 150 milliseconds — for untouchable, guaranteed WAN performance and availability.
End-to-end vs POP-to-POP preserves the highest standards of security, AND delivers the ultimate levels of performance. And that makes Mode and Your SD-WAN a true No-Worry Network, by design.
Now, you'll have forgive me, but I've got to go worry about our upcoming CIO dinner, two shows, this and next-month's webinars, and a Basecamp task list that is growing scarily large. If anyone happens to know of a No-Worry Marketing solution, please let me know so I can sleep as well as our CIO customers ;)
No, seriously. Please?
Want to talk? MODE will listen. Contact us today to get started.
I have pretty eclectic music taste. These days, I'm into Buddy Guy. I can swing from Duke to Zeppelin to Shostakovich in a single sitting. But you won't catch me listening to the top 40. No how, no way.
Except at the gym.
There you'd find me working out to Ariana Grande or something equally shameful (she and I went to the same high school), so if you're reading this Ariana, I'm sorry).
Point is, different music works for different moods or settings. Embarrassingly true.
Turns out, it's the same for SD-WAN. Sometimes, the internet fits the bill. Sometimes you need something completely different. But there's no need to be embarrassed — unless you make the wrong choice.
2019 is an inflection year for SD-WAN. The market is beginning to fill with different SD-WAN connectivity options. The good news is, there is now something for everyone.
Before we launch into this blog, I wanted to announce a fantastic upcoming webinar, featuring Searl Tate, Recent CIO, and Managing Director Paul Hastings, an AMLAW 100 Law Firm with strict SD-WAN performance, security, and compliance requirements. The topic: Securing The Enterprise with your SD-WAN + Mode Core. If you're responsible for delivering always-on connectivity with high performance, security, and compliance requirements, you don't want to miss this event.
Featuring: Searl Tate, Recent CIO and Managing Director, Paul Hastings LLC;
When: Thursday, January 31st, 10:00 a.m. (PDT)
First things first: Mode is NOT for everyone. Yes, they pay me (at least until they read this blog). But the point of these blogs isn't propaganda or marketing schlock. It's about delivering real information and a unique perspective, so you can make informed decisions. And that starts with a trustworthy source. And that source is telling you that Mode is not for every use case or every business. And that's ok because there are a ton of use cases where Mode is the best connectivity solution for your SD-WAN.
We've told you before that SD-WAN gets its benefits by bringing control to the network edge. Typically, it's connected to the basic Internet. Today, a new category of connectivity for SD-WAN has emerged. It gets its benefits by bringing software-based control to the network core. We call this category SD-CORE. And there are two variants of SD-CORE: Optimized Internet Cores and Private Cores.
Nearly all of these options use the last-mile Internet for initial connectivity to an SD-WAN. That's OK because extensive studies have shown that last-mile connectivity is capable of supporting the performance and security requirements of the most stringent business use cases, especially when coupled with the last-mile redundancy features of SD-WAN. What happens once data leaves the local last mile and travels over distances is a completely different story.
So when is the Internet best for your SD-WAN? Who needs Optimized Internet? And when is a Private Core the best SD-WAN solution? Read on, my friend.
Basic Internet Core
Basic Internet is the ideal solution when low cost is the primary goal. Period.
It's not acceptable for applications and data that require high levels of guaranteed performance. Experience, and lots of studies have shown the Internet Core to have high levels of latency variation and jitter, dropped packets, and daily localized outages — all severely impacting predictable performance particularly for long routes.
If your business deals with sensitive information and compliance burdens, using a public IP backbone for associated applications — even with data encryption — is not best practice. A high attack surface and rampant BGP hijacks and misdirects (see China's Maxim – Leave No Access Point Unexploited: The Hidden Story of China Telecom's BGP Hijacking and Google goes down after major BGP mishap routes traffic through China) will eventually put your company, and your job, at risk. Just a matter of time.
Beyond price, another advantage of the basic Internet is that is works with any SD-WAN, and doesn't lock you into any single provider, so it's very flexible.
Optimized Internet Core
An Optimized Internet Core is ideal for your SD-WAN when better-than-internet performance (but not SLA-backed MPLS-level performance) is required.
Optimized Internet is as it sounds. At its core, it uses the same public IP backbone as the basic Internet. Similar to CDNs, various WAN optimization techniques are used to improve performance. Because the underlying network is not visible or controllable at the node and link level, the performance of these solutions cannot approach true MPLS performance, despite claims to the contrary. Ever.
For the very same reasons, MPLS SLAs are not possible (SLAs covering not only uptime but also packet loss, latency, and jitter, etc.). Public IP simply cannot be guaranteed, or certainly shouldn't be.
Optimized Internet Core solutions use a public Internet core for transport, so they share similar security and compliance profiles — meaning they aren't best practice for companies seeking ultimate enterprise-class end-to-end security or tasked with satisfying compliance hurdles.
In addition, many Optimized Internet Core providers require decryption of corporate data to achieve their performance gains, necessitating a level of vendor trust that is incompatible with a Zero Trust security goal, and further complicating compliance.
In general, Optimized Internet Core solutions are slightly more expensive than basic Internet, but not nearly as costly as traditional private networks like MPLS.
Finally, some Optimized Internet Cores are designed to work with any SD-WAN, while others require you to use the provider's SD-WAN. Read the fine print.
When MPLS-level, ultimate performance — guaranteed by a true MPLS SLA — is necessary, you need a Private Core for your SD-WAN. Applications requiring high-performance over long distances, like voice and video, typically fall squarely into this category.
All Private Core vendors see and control every node and link in their network, enabling a predictable level of performance not possible from basic Internet or any CDN-like optimization of the Internet.
What differentiates Private Core vendors are their approach to performance, and the downstream impact to cost, security/compliance, and network flexibility.
MPLS is the granddaddy of Private Cores. It's expensive. It's not an "as a service" offering, so it takes a while to set up and its pricing and usage are fairly rigid. Historically, most enterprises assumed a private network with a low attack surface was enough for security, so data was sent unencrypted. Meaning you have to trust the operator and their virtualization, which most CIOs know to be far from perfect. MPLS does not have a built-in encryption capability, so work must be done to use it in a compliance-sensitive environment with Zero Trust security aspirations. MPLS can be used with any SD-WAN, which is a good thing if you can afford it.
Another Private Core variant can be labeled "cloud MPLS." It takes a carrier MPLS core and makes it POP-accessible, dramatically increasing the flexibility of this solution vs. traditional MPLS. But this approach makes the cost of these solutions essentially the same as MPLS. Furthermore, the only vendor offering this type of Private Core requires data decryption and key sharing with the enterprise — big no-no's in a Zero Trust environment with rigorous compliance requirements. This same vendor requires you to use their SD-WAN with their Private Core, so flexibility is limited.
Mode Core is a Private Core based on a high-performance private underlay from Ericsson and nearly 100 major operators with superglobal POP coverage. Mode has complete visibility into, and control over, this underlay. Mode exclusively uses our version of software-based core control — Perfect Network ControlTM — to drive the global network to perfection every 150ms.
Perfect Network ControlTM is based on the Mode HALO algorithm developed at Cornell and has been proven in tests by the NSF and AT&T to dramatically outperform other core control methods. In the AT&T test, Mode optimized a massive network in 30 seconds, while the second-place core control algorithm took nearly 24 hours. I'm not allowed to tell you who that was, because that would be embarrassing. Perfect Network ControlTM makes for a vastly more efficient Private Core and allows Mode Core to deliver real-world MPLS performance at a price point competitive with business Internet or Optimized Internet Cores.
Mode Core is a Zero Trust Network. It features full end-to-end encryption. Security keys and policies are under the exclusive domain of the enterprise and never shared with Mode. We achieve our SLA-backed MPLS-level performance (MPLS-level uptime, dropped packets, latency, and jitter, worldwide) without compromising security. This makes it easier to satisfy strict compliance requirements.
Finally, Mode Core works with ANY SD-WAN. Your SD-WAN — now with an affordable, high-performance private global network in under 60 seconds.
Mode Core is the ideal SD-WAN connectivity option when flexible, SLA-backed MPLS performance and ultimate enterprise security and compliance matter the most — all while keeping costs far lower than other Private Core options.
Mode Core is the No-Worry Network for Any SD-WAN.
Which begs the question: what is Perfect Network ControlTM and how does it achieve this amazing mix of affordable performance and security?
That, my friends, is for another blog, and another day. See you soon!
Another holiday, another cultural controversy. Are we having fun yet?
Still, as tempting as it might be to wade into these particularly murky musical waters, we should probably focus on something we can ALL agree on...
... the euphonious hum of an always-on business, powered by a hybrid cloud-enhancing network that energizes your SD-WAN and never lets you down.
But now, our first great news of (almost) 2019: Business Insider has named Mode as one of 44 enterprise startups to bet your career on in 2019! That's a pretty strong endorsement. Question: will this be enough to stop my dad from asking me to stop playing in technology and return to medicine? Answer: probably not. That said, we are really thankful for the recognition. Without a doubt it's going to help keep our business always-on. We will gladly pay this benefit forward to our SMB and enterprise customers who have been living on borrowed time by trusting the Internet Core for mission-critical connectivity. And if you're super-talented and in the SF Bay Area, check out our careers page.
Now, back to (always-on) business:
In our last installment, network control was front and center in our discussion of how to enhance SD-WAN. It was our intention to segue into the vital topic of security, and we will. But we'll do it next time.
Our last blog generated a ton of requests to enumerate the differences between two common approaches to Internet Core alternatives for SD-WAN: Optimized Internet vs. Software-defined Private Networks.
To recap: if you're using the best-efforts Internet to connect your SD-WAN CPE, you're leaving your network open to the outages, performance irregularities, and security risks of public IP. If it hasn't caught up with you yet, it will. Instead of popping Maalox waiting for the other shoe to drop, we humbly suggest getting instant peace of mind by pairing your SD-WAN with a more reliable backbone. But how do you choose?
"An Optimized Internet core and a Software-defined Private Network core (like Mode Core) are not the same thing, and the differences can have a significant impact on your ability to run an always-on business with your SD-WAN."
First, a point of clarification. Many Optimized Internet providers position their network as "their" network, and imply it's "software-controlled." Not trying to be mean — but this is highly misleading. Their POPs are, indeed, theirs, but everything in between them — the vast majority of infrastructure and distance across which your critical business data will travel — is nothing more than best-practices internet, decidedly not "theirs." As for software control: yes, they control their POPs, but they have no direct visibility or discrete control of the massive, global internet hairball stuffed between those POPs.
With that out of the way, let's consider the four meaningful differentiators of Optimized Internet vs. a true SD-CORE for SD-WAN: measurement, control, security, and service-level guarantees.
Perfect control comes from realtime, global knowledge of granular network performance. Every node. Every segment. Every 150ms.
Optimized internet approaches use a series of POPs distributed around the world to probe the behavior of the Internet. In between these POPs is a massive collection of various providers' nodes and segments, all of which are completely invisible to this class of provider. To the Optimized Internet provider, the core network is a black box. They can measure the performance among their POPs, a time-consuming attempt to guess what's going on inside. It's less granular knowing and more ballpark guessing. And their rate of observation is often far lower than the actual rate of global network change, so you're left chasing your own tail.
An ideal software-defined private network like Mode Core sees each node and every segment of the underlying global network — in real time, every 150 ms. That's because the underlay network is made available to us, and guaranteed by partners like Ericsson and nearly 100 service providers around the globe. In fact, Mode Core grows more capable and comprehensive with each new operator underlay added to its pure, software-control fabric. The ability to continuously know real-time network performance — at a granular level, globally — enables Mode Core to react instantly to rapid network changes. Perfect Network ControlTM begins with perfect knowledge of the network.
Once Optimized Internet providers identify an "optimal path" from their POP approximation of "black box" Internet performance, they move traffic onto that path. After some time, when a new "optimal path" is identified, traffic is switched from the old path to the new. Typically, this "path switching" is far slower than actual dynamic network changes, often with significant time (hours) between switches.
In the language of control systems, this is known as "bang-bang" control, and in the world of packet networks, it is chock full of performance problems. If one were to examine bang-bang control between two possible paths, you'd see a saw-tooth pattern of segment throughput for each path, with 180 degrees of shift. The end result is a severe underutilization of the underlying capacity of both paths over time. The story with latency is just as bad. Bang-bang control systems experience wild latency swings (and jitter), and an average latency that's far from the ideal physical limit. Combine this with the inherent (and uncontrollable) latency and performance variation of the Internet Core, and you have real problems.
A few years ago, a group of researchers at Cornell did something previously considered impossible by computer scientists: define packet networks as control systems. Their math-based control solution, Mode HALO, went on to wow the academic world and dominate NSF and AT&T software-defined networking competitive evaluations. It also served as the foundation for Mode, and Perfect Network ControlTM.
We know what you're thinking. Perfect is pretty cocky. But in this case, it's not marketing exaggeration, it's truth. As we monitor real-time changes for every nook and cranny on our global private network as a service, every node in our network computes the perfect control solution for every packet, based on math — instantly, and in parallel. This allows Mode Core to drive the network towards utilization, throughout, and latency perfection in the face of dynamic changes that would crush any other network. And it allows Mode, and Mode alone, to offer a unique mix of carrier-grade performance and affordability.
So while Optimized Internet providers may have fancy names for their magical measurement and control techniques (some of them use Artificial Intelligence!) nothing beats perfect, math-based autonomy for keeping your network always-on.
There is a best-practices approach to business security called Zero Trust Architecture. You can read more about it here. The basic premise is an IT design where your business security is not predicated trusting ANY third-party vendor used in the design. That's revolutionary.
So why would you spend the time to create a Zero Trust business architecture, and then connect those business branches and multi-clouds with a network that REQUIRES you to trust the network provider, or worse, the Internet?
Many Optimized Internet providers require you to decrypt your network traffic in order to achieve their performance or functional benefits. You have to trust them with your security keys and security policy. Not good.
In addition, since the majority of their transport infrastructure is Internet (e.g. not under their supervision, control, or liability), it is subject to redirection errors or flat-out BGP hijacking — both of which are happening ALL the time. (See China's Maxim – Leave No Access Point Unexploited: The Hidden Story of China Telecom's BGP Hijacking and Google goes down after major BGP mishap routes traffic through China). All of this impacts performance, but are also major security vulnerabilities. Sure, your data is encrypted. But when this same, sensitive data is hijacked to a malevolent state entity with virtually unlimited resources, are you willing to bet your business on it?
That's the idea with a Zero Trust NetworkTM — your data is safe precisely because you don't have to trust the provider, or anyone else. Mode Core is a Zero Trust NetworkTM. We achieve our tremendous performance levels without decrypting your data. All security keys and security policies remain under the exclusive control of your business. And we are a private network, with the lowest of attack surfaces (especially vs. Public IP) — meaning we are hijack-immune. If you've implemented or are considering a Zero Trust architecture for your business, it only makes sense to pair it with a network that preserves your security investments.
All of these factors contribute to the most-important of bottoms lines — the kind of guarantees your network provider offers.
The gold-standard from traditional enterprise networks like MPLS is a carrier-grade SLA. It covers uptime, and discrete performance metrics like packet loss, jitter, and latency variation. They can offer these guarantees because the network is theirs, and under their control.
Not so with Optimized Internet providers. They can offer "uptime guarantees" that cover the uptime of their POPs. They can't guarantee the uptime of the Internet, after all. Nor can they control (or guarantee) its performance.
Mode Core, like MPLS, offers a carrier-grade SLA. Uptime, jitter, latency variation, and packet loss, worldwide. The essential elements of giving you an always-on business that hums. But unlike MPLS, with Mode Core you can spin up a global network that supports hybrid and multi-cloud businesses with remote workforces in under 60 seconds. Really.
It's a New Year. 2019. And in this year of explosive SD-WAN growth, there is nothing better you can do for your business network than to pair your SD-WAN with the right SD-CORE, Mode Core. Getting and maintaining a reliable WAN was never this easy or affordable.
This month we are very pleased to host a webinar featuring the Managing Director, IT of one of the world's largest law firms. He worries about keeping his business secure and always-on, all the time. If that sounds like you, you owe it to yourself to listen in. Dates and info coming in our next blog.