How SD-WAN and the Cloud Helps SAP HEC

[Former Member]

The cloud has changed how companies build their IT teams, and SAP HANA Enterprise Cloud (HEC) changed the way we thought about SAP. With HEC, companies gained the benefits of SAP with agility, expertise, and management of a SAP-backed, private cloud.

At the same time, adopting HEC may require IT to reevaluate its networking architecture. HEC supports connectivity via MPLS or IPsec tunnels across the Internet, but MPLS connections are costly leading to companies look into reliable and affordable MPLS alternatives. As for IPsec, adapting traditional wide area networks (WANs) architectures to support Internet connectivity may lead to poor performance and introduce a single point of failure.

The convergence of software-defined wide area networking (SD-WAN) and the cloud offers an intriguing alternative.

 

Traffic backhaul: easy to implement, bad for performance

Traditional enterprise networks are designed in hub-and-spoke architectures. Traffic from distribution facilities, factories, and other branch offices is sent to a hub  location— the headquarters or a datacenter. The location typically houses the SAP HANA instance and the company’s firewall for accessing the public Internet.

 



Figure 1: Traffic from locations is backhauled to the company’s SAP instance running in the global datacenter

 

The enterprise could, in theory, establish IPsec tunnels from the firewall in the datacenter to HEC. SAP supports dual IPsec tunnels to a private IP. But such an approach poses several problems. For one, the firewall becomes a potential choke-point and a single point of failure. What’s more the user experience for all users may suffer depending on the distance, Internet routing, traffic congestion and jitter between the datacenter and HEC. Mobile users in particular struggle, often having to connect back to a location and then to firewall before reaching HEC.

“Our current WAN architecture could not handle the SAP migration,” says the IT manager at one major manufacturer who moved to SAP HEC. His 30 manufacturing plants initially established IPsec tunnel across the Internet to centralized SAP instance in the company’s datacenter. With the move to the cloud, he needed to give all sites more direct access to SAP HEC.

 



Figure 2: SAP HEC performance may be compromised by the additional leg between the headquarters and the HEC instance in Germany.

Firewall mesh: better performance, but impossible to implement

Such an architecture could address both reliability and performance issues, if it was possible. Instead of backhauling traffic to a hub, firewalls in branch offices would maintain Internet-based, IPsec tunnels with SAP HEC and every other location. Traffic would be sent directly from each site to HEC.

Such an approach, though, is no longer possible as HEC only supports two IPsec tunnels to a private IP address. In theory, IT could establish a firewall near the instance. Locations would connect to the firewall who in turn would maintain the IPsec tunnels to HEC. The problem? Companies often lack an in-region datacenter or site. Deploying one adds complexity, cost, and firewall becomes a potential choke-point and a single-point-of-failure.

Cloud-based SD-WAN: performance and easy to implement

The emergence of cloud-based SD-WAN (also called SD-WAN as a Service), such as Cato Cloud, provides an alternative. With cloud-based SD-WAN, providers build an SD-WAN in their network core across multiple tier-1 backbones. Sites send their traffic across an encrypted tunnel to the provider’s closest point of presence (PoP). Software running in the PoP routes HEC-bound traffic across the optimal path to the PoP nearest to the company’s HEC instance, which maintains the dual IPsec tunnels into the HEC cloud.

 



Figure 3: Cloud-based SD-WAN connects all locations enabling fast, easy access from anywhere to SAP HEC

Cloud-based SD-WAN eliminates backhaul and a single point-of-failure. The provider builds optimal routing, resiliency, and secure connectivity into the network. Depending on the implementation, mobile users can also access SAP directly through the cloud-based SD-WAN without the added delay of going back to a location.

SAP plays too critical a role to most companies to risk running over compromised infrastructure. At the same time, modern budgetary requirements force most organizations to reevaluate their traditional networking cost structures. Cloud-based SD-WAN offers a compelling alternative for addressing both of those needs.

Dave Greenfield is the secure networking evangelist at Cato Networks