WAN Governance

Amazon outage lessons

Frank Lyonnet, VP Product Marketing at Ipanema Technologies, talks about lessons learnt from the recent Amazon outage, applied in networking architecture.

The cloud sounds magic, the IT becomes immaterial. You need only an Internet connection and applications flows, ready to empower enterprise users. Amazon major outage in April 2011 is a strong reminder that, with all IT projects, availability, security and performance requires an appropriate design and architecture. Cloud or not, the enterprise has and will always have to choose the appropriate architecture based on real needs, constraints and budget.

Because it's a pillar of the cloud, the network and its architecture are critical to the quality delivered to users of applications. Far from becoming a commodity, the network becomes richer; it needs to guarantee the performance of cloud based applications down to the desktop. It also needs to ensure a perfect co-existence of cloud applications and the other applications that will stay in the enterprise own datacenter. As enterprises embrace the cloud, they need to look carefully at the different design options they have. A VPN can be collapsed into the Internet, fully. Why a VPN when any Internet provider and SSL are enough? This is an extreme choice that some company could be tempted to look at. Just like the ones that chose the lowest cost options at Amazon.

More careful (or richer) Amazon customers didn't saw much trouble from the outage; they just built upfront their cloud IT with appropriate resilient architecture. And this saved their business. For the enterprise VPN, the same options exist: public or private; redundant or not. At Ipanema we believe the future is hybrid. Small business or non critical branches might be satisfied with single public Internet access and take the risk of an outage. Very critical locations and datacenters will rely on highly available and redundant MPLS networks. And all other combinations (like dual Internet and MPLS + Internet) will also apply.

The VPN needs to leverage the best of both worlds. MPLS is part of the future, just like Internet is. The Ipanema Autonomic Networking System is here to support the architecture that fits best the enterprise needs, constraints and budget. From pure MPLS to hybrid Internet + MPLS or even dual Internet, ANS provides all that is required to make sure the network delivers the appropriate level of availability and performance to business critical applications and to deliver WAN Governance for cloud-ready networks. 

Illustration: Winged human-headed bull. Neo-Assyrian Period, reign of Sargon II (721-705 BC) Khorsabad, ancient Dur Sharrukin, Assyria, Iraq – Musée du Louvre, Paris.

Cloud computing and the hedgehog mutation

To continue with the Datacenter de-consolidation we were recently writing about, I just would like to share a simplistic view of what's going to happen at the branch office: its hedgehog mutation.

Forces in presence are transforming enterprise branches from a traditional spoke to a complex hub, the global network moving from the traditional "hub and spoke" topology to a "hub and hub" situation:

• the application-centric nature of Cloud-based IT infrastructure (rather than location-based);
• the large number of applications used by the remote workforce;
• the many options of connecting branches and public/private datacenters (centralized Internet access, distributed Internet access, Internet peering from the MPLS core, hybrid networks, etc.);
• and of course the steady development of peer-to-peer communication like voice and video-presence.

Multiplied by a large number of branch offices, this situation will rapidly become inextricable. In a Cloud computing world, only a top-down, global approach like WAN governance powered by Autonomic Networking can offer the full control and optimization to application traffic delivery across the global enterprise.

If you know how to handle it, a hedgehog looks like a pretty and harmless animal – if you don't, better to wear gloves…

Illustration: Hedgehog. Aryballos - 600 BC

Cloud computing = Datacenter de-consolidation

The datacenter consolidation movement was triggered a few years ago by the need to simplify application delivery and to lower IT costs. The concentration of application servers has many advantages: it breaks local IT silos, it simplifies application maintenance and it unifies business processes. By reducing the number of remote servers, it significantly decreases hardware, software and operation cost. Of course, concentrating application servers from many remote offices and regional datacenters into a single location implies to rely on a WAN able to support a variety of application flows in a secure and efficient manner anytime. Bandwidth increase, MPLS and Internet ubiquity completed by WAN optimization and control technologies proved to be able to sustain this challenge. As a matter of fact, most of large enterprises are accomplishing or have already accomplished their servers' consolidation into one, two or three large central locations.

While Cloud computing can be seen as the next step of datacenter consolidation (collapsing private datacenters of many enterprises in one or a few shared mega-datacenters), I trust we can also see it as a very different animal. Like platform standardization (Intel, Windows, VMware) allowed to build and run efficient while flexible consolidated datacenters, application standardization and SaaS model (Salesforce, MS Exchange, Googleapp…) are transforming the consolidation movement from an infrastructure to a business application standpoint. Scale effect has its own asymptotic limit. What matters to the business is not to have more and more servers in a single location. What matters to the business is to select, customize and manage the right set of applications to run and transform its processes.

Enterprises will pick-up the general or specialized applications they need, wherever they are over the "Cloud". Starting from the application perspective, they will use as many "application-centers" as they have applications – honestly, who cares?

• Virtualization + Efficient WAN à Datacenter consolidation à Efficient IT
• Cloud-based applications + Efficient WAN à Application consolidation + Datacenter de-consolidation à Efficient business

Of course, this movement stresses the importance of the network as a key enabler of efficient business, in a hybrid [IT + network] environment without hard-center. This makes WAN governance more strategic than ever to understand, control and manage this new and open environment.

Relentlessly powered by Moore's law, filtered through the implacable selection of business reality, IT's evolution has not finished its course. Species we're living with right now are just temporary links in a long chain we're discovering a bit more each day…

Hybrid Network Unification – Two birds with one stone [business continuity + application performance]

In his "Cost Cutting by Rightsizing Network Reliability" report, Neil Rickard (vice president in Gartner Research) suggests that "Enterprises should grade their sites by reliability needs because this is the biggest factor driving WAN costs" and proposes three key findings:

• Combining multiple, less-expensive services in parallel can deliver the same levels of reliability at lower prices than a single, high-quality connection.
• Reducing the reliability target for a location by one "9" (for example, from 99.99% to 99.9% availability) will typically save 30% of the WAN costs for that site.
• Transition costs, such as installation charges for new services, will typically eliminate half of the first year's savings.

This statement is the traditional driver for hybrid networking: adding a secondary link over Internet would provide the expected availability improvement (basically an additional "9") sought by IT and network managers while being (most of the time) cheaper than a second MPLS access line.

Now that the "network centric" approach to business continuity has been accepted, it's time to take it from an "IT centric" or even "business centric" perspective. Once you have "continuous access to the network", you need "continuous application performance". This is more important that it seems at first thought; let's remember the application brownout formula (5' = 1%) that states that only 5 minutes of poor performance a day decrease the enterprise productivity by 1%.

On average, preventing application performance brownouts (like unexpected variations in response time, too long transfer delays, demoralizing login time, etc.) and ensuring a perfect user quality of experience have an impact of the same order of magnitude (may be even larger) as moving network availability from 99% up to 99.9% or even 99.99%, i.e. from plain domestic Internet quality to business grade reliability.

That requires the same agility to handle application flows in the space dimension (which network?) as in the time dimension (acceleration, priorization, shaping…). Autonomic networking, enabling a strong coupling between QoS and control, WAN optimization and dynamic WAN selection seems the perfect candidate to get these two birds with one stone: perfect [business continuity + application performance] in a world of unified hybrid networks.

Illustration: la grande famille – René Magritte (1898-1967)

Hybrid network unification – Fast or large?

SearchEnterpriseWAN.com recently published an article from Jessica Scarpati about performance issues that may arise from using Internet as a backbone for Cloud and SaaS traffic ("Backhaul Internet traffic over the WAN? Cloud, SaaS performance may suffer"). Jessica rightfully insists on the lack of control across the Internet: "You can't write an SLA for the Internet", "Assessing SaaS performance (…) over the Internet is nearly impossible since the parameters constantly fluctuate"; etc.

On the other hand, Internet ubiquity and low cost makes it impossible to resist for Cloud and SaaS based applications, and already appealing for VPN traffic. So the question is no more "Internet or not Internet" but rather "how to get Internet benefits without its weaknesses?" This is becoming an important question that WAN governance has to answer.

A solution to this dilemma is to combine a predictable MPLS network with larger, cheaper but less stable Internet. While this is not a new situation, reality is that in most case this combination is "either MPLS or Internet (as a backup)"; in some case, router-based static PBR (policy based routing) is painfully configured to send low critical traffic to Internet and critical applications to MPLS. None brought the expected benefits, performance and agility that enterprises are looking for.

On the other hand, Dynamic WAN selection using real-time network performance assessment and application performance objectives allows enterprises to get the best of Internet (large bandwidth, access to public Cloud and SaaS) while assuring the performance of their critical applications with MPLS networks. Because of the variability of networks' performance and the dynamicity of the application traffic, dynamic WAN selection requires the ability of Autonomic Networking to learn and adapt in real-time to any situation and solve complex cases, like when several networks match the objectives – or none of them. Real life shows that Internet may be faster than MPLS – or not – or not everywhere - or not always… So voice and SAP can use Internet – or not – or not everywhere – or not always… How would you manage this manually?

Properly unified from an application performance point of view, hybrid networks can move us from the classical Fast OR Large? dilemma to a more appealing Fast + XXL situation.

Will enterprises jilt MPLS for Internet?

I was recently told by the IT director of a large chemical company that "with 20,000 users, 200 sites and +4G$ of revenues, why do I need a dedicated network? The Internet is already my backbone!" One of the arguments he used was that some of his most important applications, like SAP and emails were actually accessible through Internet in order to make them available for home and nomad workers.

His company actually moved forward with this idea and now all sites are connected with Internet VPNs and MPLS is used as a back-up for 30% of the premises where a poor SAP performance or availability will not be acceptable, for business as well as for psychological reasons (this approach might have been perceived as too much disruptive by some people in the company). The application traffic is managed according to hybrid network unification principles, ensuring the best of both worlds: cheap and ubiquitous Internet and business grade, predictable MPLS.

Although such a radical opinion is not yet common and MPLS having yet a lot of arguments to defend, we can see this move participate to the growing stream of hybrid IT that includes SaaS and other cloud computing approaches and which puts Internet in a very central position.

I trust that it will help us, enterprise network stakeholders - telcos, vendors and IT departments - to mature our thinking and clarify benefits, risk and overall value of enterprise networking for the business. If we all work well, alternative service architectures will rise, innovative products will grow and added-value services will flourish. If we don't, they will anyway…

Feel jilted? May be good news if lyrics are true: "…. I'm finally free - To try new ambitions - And learn new friends names …"

Illustration: "L'homme qui marche" – Alberto Giacometti (1901-1966)