2144 10 h10 alexandre cezar = juniper sd-wan
TRANSCRIPT
Juniper SD-WAN Alexandre Cezar – Consulting Systems Engineer, Security/Cloud [email protected]
MARKET DYNAMICS
Branch/WAN Evolution: PMOFMO Bring Agility and Enhanced Customer Experience Utilizing Cloud Technology
Router
NG Firewall
Switch
WLAN Controller
UTM Firewall
WAN Optimization
Expensive, complex all-in-one box or many vendor inline boxes and cumbersome refresh
Legacy Branch (PMO)
Simple, customizable and instantaneous refresh
VIRTUALIZED SERVICE
Juniper vSRX
Cloud CPE
Platform
• Services • Application
s
Future Branch (FMO)
Branch/WAN Disruption and Transformation Case for Cloud CPE w/ SD-WAN
User Experience Cloud/Connectivity Business
Hybrid WAN
Flexibility
Service Agility
& DevOps Visibility
and Control
Application
Aware WAN
On-Demand
Self Service Reduced
Capex/Opex
Open,
Flexible Choice
Centralized
Policy Control
Pay-As-You-Grow
Biz Model
What is SD-WAN ?
MPLS
Internet
Branch
Network Service Activator SD-WAN Controller Orchestrator
HQ
Data Center
SD-WAN has four characteristics
Must support multiple WAN connections MPLS, Internet, LTE etc.
Can do dynamic path selection Allows for load sharing across WAN links
Provides simplified WAN management Must support zero-touch provisioning of remote branch
Must support secure VPNs And have ability to integrate additional network services like Firewall, WAN Ops etc
Reference : https://goo.gl/IeJtbN
JUNIPER SOLUTION
Office365
Juniper SD-WAN Solution
NFX Series
App
Branch Campus
Branch
SRX Series
Managed
OTT
Managed
OTT
Managed
Juniper Sky ATP & Spotlight Secure
Service
Junos Space
vSRX
Service Orchestrator
Hybrid WAN
With Local Breakout Without Local Breakout
Secure Branch
MPLS
Internet
HQ
Optimized local break-out traffic
Branch
MPLS
Internet
HQ
Branch
Non-optimized backhauled traffic
Secure Cloud CPE Platform: NFX/SRX NFX Series
(NFX250 Shown)
• Router + switch + server providing robust foundation
to simultaneously deliver virtual services
• Automated provisioning and pre-integrated 3rd party
services and applications
CPU: Intel Multi-Core Xeon D
System Memory: up to 32 GB DDR4 RAM
System Drive: up to 400 GB SSD
Service T-Put: 20Gbps
Switch T-Put 88Gbps
SD-WAN | Security | Services | Applications
SRX Series
(SRX1500 Shown)
• Multipurpose security focused appliances, “right sized” for the need
SRX T-Put: 500Mbps – 10Gbps
(SRX300 – SRX1500 Series)
SD-WAN | Security
Open VNF Platform
Cloud CPE Product Portfolio F
lexib
ilit
y a
nd
Scale
Performance
Custom PFE
0.5-2.0 Gbps router
Crypto acceleration
Integrated Appliance/
No virtualization
VDSL, LTE
ATOM 4C/8C
2-4 VNFs
Crypto acceleration
Expansion slot / LTE
Server
Xeon D 6C /
Pentium D 4C
2-8 VNFs
AES-NI acceleration
1GE/10GE
Server + HW PFE
Xeon Multi-socket
High Performance
1/10GE and higher
Crypto acceleration
Expansion slots
Server
Shipping/SOPD
Investigation
SRX300
SRX320
SRX340
SRX345
NFX250 S2
NFX250 S1
NFX250 LS1
NFX Small
NFX Large
vSRX
VNF
VNF
VNF
vSRX
vSRX
Junos
CSO Automation, SD WAN, Security & LAN
Small Server Medium Server Large Server Small Appliances
Service Simplicity with Cloud CPE
NFX Series
Regional Branch
Campus
Local Branch
SRX Series
Centralized Management Automated Service Delivery
VNFs
Centralized Cloud CPE
Distributed Cloud CPE
vSRX
IT and Telco Cloud Consistency
Service Orchestrator/ Controller
Juniper Sky ATP &
Spotlight Secure Service
Ent. App
vSRX
Managed
OTT
Unmanaged VPN & POS
Application Aware (L7) Security Application Aware (L7) Routing
Centralized Policy Control
Secure and Managed VPN
Juniper SD-WAN Architecture
Branch Office
Managed Access
(Private WAN)
NFX
Corporate Office
Remote Office
vSRX VNF
Customer Premises
CSO with Network Services Controller
IPSec tunnels
Internet
BGP* App Perf Monitor* Net Act
SRX
SRX/MX Headend
*Roadmap items
Customer Premises
SRX and vSRX (with NFX) is the EDGE platform for the Juniper SD-WAN Solution
Configuration
Control (BGP)
App Analytics
IPSec VPN Connection
Standard data models for
• Device management
• VPN management
• Overlay Routing
• Policy Based Routing
• SLA measurement
• Telemetry/Analytics
Standardized
Overlay with P2P,
Hub/Spoke IPSec,
Auto VPN, AD-VPN
Netconf /
Openconfig for
configuration
BGP for Overlay
Routing
Standardized
probes: RPM
Contrail Service Orchestration (CSO)
Network Service Designer
• Define services
• Specify VNF onboarding process
• Create service chaining templates
Administration Portal
• Manages End-to-End Solution
• Allows Admin to Monitor and Troubleshoot
• Provides Workflows and Site Management
Network Svc Activator/Controller
• Downloads the image
• Configures the device
• Orchestrate device egress WAN policies
Customer Portal
• Provides Web Portal to Customer
• Select deployment model
• Self-select Network Services
• Application and User* aware policy based routing
• Load balance traffic over WAN Ifs based on link perf (RPM)
Advanced Policy
Based Routing
Carrier Class Routing
Highly Secure
Management and
Automation
SRX and vSRX SD-WAN Capabilities
• Multiple WAN interfaces types : TDM, DSL, LTE, Ethernet
• Full routing stack with overlay protocols (MPLS, GRE etc)
• FIPS 140-2 complaint IPSec VPN with flexible deployments
• Advanced threat detection & mitigation with IPS, UTM, Sky ATP
• Zero Touch Provisioning with centralized mgmt & orchestrator
• On-box / off-box scripting capabilities automate repetitive tasks
Zero Touch Provisioning
Activation Server
www.nfxweb.juniper.net/nfx
Contrail Controller
SRX320
Juniper Hosted Redirect tool
1
2
3
4
5
6
1. Administrator installs and setup activation server
and adds device info to the activation server and
Juniper hosted redirect tool
2. Device is powered up at remote branch and user
adds activation code to the device
3. Remote device communicates with the Redirect
tool and obtains contact info of activation server
4. Device authenticates itself to activation service
using activation code and X.509 certs. After
which it downloads Junos and configuration
5. Activation server sends a notification to the
management server
6. Once device upgraded and configured itself, it
connects to management server for further
device management and orchestration
Work Flow
Advanced Policy Based Routing (AppRoute/APBR)
Applications N
MPLS
Internet
Corporate HQ
Branch
Enterprise App Server
• APBR supports DPI and pattern-matching capabilities of AppID to identify application traffic or a user session within an application
• Benefits:
• APBR allows you to define the routing behavior based on applications
• APBR provides flexible traffic-handling capabilities with granular control for forwarding packets based on application attributes
• Supports 3K+ application signatures
• Enables exception path routing for SD-WAN
• Application groups for easy policy selections (Web, Gaming, Multimedia etc)
• Supported from Junos Release 15.1X49-D60 onwards on SRX/vSRX/NFX
SD-WAN - R2.1 Application Routing with vSRX/SRX/NFX
Telco POP/ Infrastructure
Branch /
Campus
Managed Access
Internet (IPsec)
NFX/SRX
Contrail Service Orchestration
VNFs
Edge Router (Existing PE device)
Network
Controller Admin Portal
MPLS Core
SD-VPN GW
Distributed Cloud CPE
Self Care
Portal
APBR Enhancements
GRE
• Support for following types of link level monitoring via SLA profiles on SCP
• Monitoring with Route Failover
• Monitoring with a DHCP Backup Interface
• Monitoring with Interface Failover Using Advanced Boolean Selection
• Monitoring in a Virtual Router
• Probe types supported in SLA profile
• HTTP GET request to a target URL
• HTTP GET request for metadata from a target URL
• ICMP echo request to a target IP address (the default)
• ICMP timestamp request to a target address
• UDP ping packets to a target device/IP
• TCP ping packets to a target device
• Dynamic failover to default path when threshold exceeded
SD-WAN - R2.1 Application Monitoring – Basic Link Level
Telco POP/ Infrastructure
Branch /
Campus
Managed Access
Internet (IPsec)
NFX/SRX/vSRX
Contrail Service Orchestration
VNFs
Edge Router (Existing PE device)
Network
Controller Admin Portal
MPLS Core
SD-VPN GW
Distributed Cloud CPE
Self Care
Portal
Link Level Monitoring
GRE
QUESTIONS?
Thank You