WAN Impact of Moving to a SaaS

1 WHITE PAPER

Subtitle

Beyond the Network …

Moving to Office 365, Google Apps, Salesforce or any SaaS? Here’s what it means for your WAN

Avoid application performance issues by upgrading your VPN to a CRN (Cloud-Ready Network)

www.ipanematech.com

2 WHITE PAPER

Cloud-Ready Network for SaaS

EXECUTIVE OVERVIEW

IT infrastructure directors today find themselves in one of two situations: the business side of their organization is planning for SaaS applications that the VPN will need to support, or existing SaaS applications are underperforming or impacting the performance of other business applications.

Gartner believes that through 2013, at least 60% of enterprises will experience slow or inconsistent application performance issues from externally placed applications, due to improper network design

1.

This is because VPNs and the tools used to manage them are optimized for traditional private applications residing in data centers, not those stored in the cloud. For example, SaaS collaboration applications, such as Google Apps, Microsoft BPOS/Office 365 and IBM LotusLive, consume much more network bandwidth than many traditional applications. Moving from traditional on-premise collaboration to a SaaS counterpart dramatically changes the way traffic flows across the WAN.

In order to avoid application performance issues and ensure optimal end-user experience, infrastructure directors need to make their VPN “cloud ready.” A cloud-ready network (CRN) is a network that provides full application performance visibility and total control of both SaaS and on-premise applications. Ideally, the best time to prepare is prior to your first SaaS implementation, so that the impact of SaaS on your VPN can be mastered from the pilot phase through full enterprise rollout. However, upgrading your VPN to a CRN can be done anytime and in stages, depending on your level of cloud adoption, and whether or not you choose to change your VPN architecture.

This paper is for the infrastructure director whose company:

Wants to migrate one or more applications to SaaS without application performance issues.

Is already using SaaS, and has application performance issues to address.

May or may not want to change VPN architecture to an MPLS + Internet hybrid network to better support cloud-based applications.

May already be running applications on a hybrid network and wants to optimize architecture to take full advantage of both MPLS and Internet bandwidth.

The paper explains:

VPN impact from SaaS applications: How SaaS applications are not all created equal; why legacy WAN solutions do not work for SaaS; how to guarantee SaaS performance; and how to ensure SaaS does not impact the performance of other business-critical applications.

Infrastructure options: How to upgrade your VPN to a CRN, depending on where you are with cloud adoption; and how Ipanema’s Autonomic Network System™ (ANS™) prepares your network for the cloud, so your organization can fully embrace SaaS applications and derive all performance, time-to-value and cost benefits.

Performance management: How an Applications Performance Dashboard can prove that your SaaS and legacy applications are performing during and after SaaS implementation; and how a WAN Governance approach to network management helps guarantee applications performance and ensure business continuity as SaaS applications are adopted.

By understanding the issues, tools and infrastructure options and by moving away from traditional network management to a WAN Governance approach, infrastructure directors are empowered to say:

Yes, the network is an enabler of cloud adoption, not a brake.

Yes, my private applications will still perform, and in fact, even better than before.

Yes, transitioning to the cloud can be done without disrupting the existing architecture.

1 Bjarne Munch, “Is Your Network Design the Weak Link in Cloud Computing?” Gartner, 27 August 2010

3 WHITE PAPER


TABLE OF CONTENTS

1. Adopting cloud-based collaboration: What does it really mean for the WAN? .................................... 4

2. Why conventional WAN solutions do not work for SaaS? .................................................................. 5

3. Stages of cloud adoption: Where are you? ........................................................................................ 6

4. CRN with central Internet gateways and advanced Application Visibility, QoS & Control ................... 7

5. MPLS CRN with in-MPLS Internet and branch office WAN Optimization ........................................... 9

6. CRN with unified hybrid MPLS + Internet .......................................................................................... 9

7. The Management Issue: Cloud adoption creates a critical need for WAN Governance ................... 10

8. Your business is cloud-ready, but is your network? ......................................................................... 10

About This Publication

Ipanema has created this publication as an educational resource for large enterprises adopting a new SaaS application or replacing on-premise software with a SaaS application. Contents of this publication are intended to inform and educate IT infrastructure directors about the impact of SaaS on the enterprise VPN and how to evolve their VPN to a “cloud-ready network” in order to avoid or solve application performance issues.

4 WHITE PAPER


1. Adopting cloud-based collaboration: What does it really mean for the WAN?

Infrastructure directors are under tremendous pressure from business stakeholders to adopt cloud-based SaaS applications with the promise of lower IT costs and a better user experience. Some who have already migrated their first applications to SaaS are surprised by additional costs, extend-ed project cycles and/or lower than expected application performance. Cloud computing brings the promise of simplified application delivery, but often at the expense of additional network com-plexity that is often greatly underestimated.

“As cloud computing, virtualization, mobility, uni-fied communications and video drive more appli-cation traffic to the network, traditional network design practices will become increasingly signifi-cant constraints on the functioning of the business,” says Gartner analyst Bjarne Munch.

2

Bandwidth requirements vary greatly for SaaS applications. Collaboration applications such as Google Apps, Microsoft BPOS/Office 365, and IBM LotusLive have much more impact on network traffic than other SaaS applications. (see “Impact of SaaS Collaboration on Your WAN”). Collabo-ration consumes more bandwidth per user, typi-cally involves more users and is more likely to be extended to more workers.

The bandwidth involved with SaaS is not the only network issue. The way traffic flows across the WAN can also change dramatically when SaaS applications are used. Collaboration traffic no longer flows between a data center and branches but between one, a few or many Internet gateways to the branches.

While this paper focuses on preparing your net-work for SaaS collaboration, the discussion applies to any cloud-based applications with substantial WAN impact, including SaaS, IaaS or PaaS.

Why your VPN must evolve to a CRN?

When SaaS applications are brought into a com-pany, the infrastructure director must be able to make them work over the corporate network. This requires:

Forecasting the application’s usage patterns.

Understanding end-users’ network resource requirements.

2 Bjarne Munch, David A. Willis, “The Enterprise Network of

the Future Will Be Hyperconverged,” Gartner, 18 November 2010

Anticipating the impact on the network accurately.

Optimizing the network to ensure an excellent end-user experience, not only for SaaS but all applications.

The infrastructure director must consider:

How to guarantee SaaS performance?

How to ensure SaaS will not disrupt other applications?

How to ensure SaaS delivers a good end-user experience?

How to establish an optimized network design that fits their situation, budget and schedule?

The infrastructure director must make decisions without the required level of visibility. Unsure how traffic will change and how much bandwidth usage will increase, cautious (and expensive) decisions, such as upgrading bandwidth in branches, are made as a hedge against application performance risks. As the SaaS project is rolled-out and appli-cation performance concerns arise, further investi-gation and tactical fixes may be needed.

As a result, SaaS integration projects that were initially considered to be easy, cost-effective and fast can become progressively difficult, expensive and slow to implement. The cost advantages of moving to SaaS can easily be neutralized by the greater workload and expenses for network management.

Impact of SaaS Collaboration on Your WAN

Consider that standard email traffic from a data center to branch locations typically accounts for 30% of WAN traffic. For purpose of comparison, assume this requires a band-width sizing of 2.96 Kbits/sec/user with Outlook and Microsoft Exchange 2010. In contrast, browser-based email traffic from Internet gateways to branches using the web access of Exchange 2010 would require 6.79 Kbits/sec/user, substantially increasing compe-tition among WAN applications. As the SaaS collaboration is used beyond simple email with features such as document collaboration and document libraries including video, bandwidth requirements further increase by as much as a factor of three, requiring a network upgrade.

5 WHITE PAPER


2. Why conventional WAN solutions do not work for SaaS?

The adoption of SaaS requires perfect visibility into both the global traffic mix and the delivered user experience during each step of implementation (see “How an Applications Performance Dash-board Mitigates Deployment Risks”). SaaS also requires advanced QoS & Control tools to dynam-ically adjust the network resources allocated to each user of the private or public applications. Finally, as you are poised to use a hybrid MPLS + Internet network architecture, you must circumvent the limitations of traditional policy-based routing, which are too inefficient to both guarantee SaaS performance and take full advantage of the Internet as a business network.

Beyond these required capabilities, the historical approach to network management – using sepa-rate point solutions to address Application Visibility, QoS & Control, and path selection for applications traffic – just adds to the complexity of the project. For SaaS collaboration rollout or other cloud-based projects to be conducted effectively, a more integrated and automated solution is needed. (see “All-in-One Solution for Guaranteeing Applica-tion Performance”) .

MPLS Classes of Service (CoS): Insufficient control for today’s dynamic network environments.

MPLS Classes of Service (CoS) – a static, labor-intensive, and insufficient approach to QoS & Control – do not precisely address the require-

ments of application flows for MPLS network resources and are more difficult to apply to SaaS performance, for several reasons:

Based on invalid assumptions using IP addresses and port numbers: Many appli-cations can use HTTP port 80, including SAP, SharePoint, Facebook, Skype, etc. Some can be business-critical, most are not. With stan-dard MPLS implementations all are assigned the same priority level.

Unable to account for the “any-to-any” nature of traffic: Today’s WANs must support multiple data centers, multiple Internet gate-ways, branch-to-branch networking, etc. CoS deal with managing competition between flows on a local basis, but have no way of managing competition at end points – where multiple sources of traffic can compete for the destination network resources.

Cannot match real-time network demands: CoS require per-application bandwidth as-sessments at each site. Not only is this difficult to achieve for any one point in time, but this process must be repeated each time an appli-cation is updated, a new application or site is deployed, and whenever there is an increase or decrease in users at a site. CoS are static when demands on network resources are dynamic. CoS parameters can never be up-dated to match the current situation, which makes application performance guarantees impossible.

How an Applications Performance Dashboard Mitigates Deployment Risks

Like on-premise software, SaaS collaboration is deployed in phases with a pilot implementation and phased enterprise rollout. At each step of deployment, risks rise from the increasing competition for network resources. Having an Applications Performance Dashboard to monitor network and end-user impact during each step of the project helps to ensure acceptable performance of all applications or pinpoints where bandwidth sizing needs to be updated.

All-in-One Solution for Guaranteeing Application Performance

Ipanema’s Autonomic Networking System (ANS) tightly couples QoS & Control, Application Visibility, WAN Optimization and Dynamic WAN Selection (hybrid network unification) into a single, all-in-one solution. With ANS, all application performance challenges can be managed with a holistic approach over the global network. The autonomic networking solution automates tasks that IT organizations cannot perform with traditional approaches. Orchestrating network traffic in real-time, ANS manages the complexity of the hybrid cloud and guarantees application performance for public and private applications. ANS not only helps to guarantee the performance of SaaS during and after implementation, but the end-user experience for all applications over your WAN, and much more cost-effectively.

6 WHITE PAPER


Policy-Based Routing (PBR): Complex, outdated approach limits hybrid network benefits.

If you use or plan to use a hybrid MPLS + Internet VPN, you need advanced path selection for appli-cation flows created for hybrid networks, not PBR. Too often, the operational complexity and poor performance of PBR is such a burden that the benefits of a hybrid network are nullified.

While PBR is designed to balance packets across multiple networks, it introduces a number of major drawbacks when used in modern environments:

Operational complexity: PBR requires per- router configuration and specific engineering skills, which are cumbersome and error-prone. As bandwidth costs decrease (from greater utilization of less-expensive Internet band-width), management costs increase (from greater network complexity and workload).

Static nature: Routing applications based on their port number on one or another network doesn’t take into account loads on links or routing based on link quality.

Inability to base decisions on Layer 7 application visibility: All applications through Port 80 must use either MPLS or Internet, not both, which means routing business-critical and less important applications at the same priority level.

Local decisions based on local information: As VPN traffic becomes meshed, resource allocation based on global network decisions is required. Otherwise, unwanted and uncon-trolled congestion occurs.

Fundamentally, PBR is a legacy technology that does not integrate with other important man-agement tools for a modern WAN, including Appli-cations Visibility, QoS & Control, and WAN optimization. (See pg.5 “All-in-One Solution for Guaranteeing Application Performance”).

3. Stages of cloud adoption: Where are you?

Large enterprises operate several core applica-tions that reside in their private data centers. Those are unlikely to move to SaaS in the short term (or midterm) because they are too custom-ized or considered too sensitive. As SaaS collabor-ation tools with email, presence, and portals become standard and the offerings richer and more financially compelling, it is likely that one of your first impactful move to SaaS will be a collab-oration tool, such as Google Apps, Office 365 or LotusLive.

This move will create a de facto hybrid network with a mix of public and private applications, increasing the competition for network resources dramatically. More cloud applications will event-ually follow, which further drives the need to evolve your VPN to a CRN with the necessary manage-ment capabilities.

“In the two years after our migration from Lotus Notes to Google Apps, we have seen tremendous collaboration bandwidth growth as users embraced new tools in the Google Enterprise portfolio,” says Alain Meuro, IT Infrastructure Director at Valeo, one of the world’s largest automotive suppliers with approximately 52,000 network users.

Since every enterprise is different, IT strategy on whether or not to change network architecture for SaaS collaboration varies from one company to another. You do not necessarily need to change your architecture to make your network “cloud-ready”.

All companies, however, must implement a minimum set of capabilities in order to avoid application performance issues during and after SaaS implementation, or to fix issues resulting from a prior SaaS deployment. Companies that use or plan to use a hybrid (MPLS + Internet) network architecture will also want to consider additional capabilities to further optimize their “cloud-ready network” (CRN).

NOTE: If you are in the process of modifying network architecture for SaaS applications, moving to a hybrid is strongly recommended.

Start with a small group of enthusiasts

Progressively migrates mailboxes

Migration study Planned or unplanned usage growth

Before After Later

Lotus Notes

Exchange

SMTP/POP

GoogleApps

Office 365

LotusLive

More usage

• Collaboration sites

• Usage of video…

The SaaS collaboration adoption

lifecycle

7 WHITE PAPER


MPLS CRN: Making your network cloud-ready by leveraging an existing MPLS architecture.

An MPLS CRN applies to any company with a tra-ditional MPLS VPN and is considering or already using a SaaS application.

Objectives: Improve Applications Visibility, QoS & Control

Guarantee performance of SaaS collaboration across your WAN

Ensure that SaaS collaboration does not impact the performance of other business-critical applications already delivered across your WAN

Prove SaaS collaboration is performing as ex-pected during the various phases of imple-mentation and enterprise rollout, and does not impact other business-critical applications by using an Application Performance Dashboard

Shift from network management to “WAN Governance” to plan and grow your network according to business needs

Hybrid CRN: Optimizing your network for the cloud and fully exploiting an Internet + MPLS architecture.

The following applies only to companies consider-ing or already using MPLS + Internet hybrid archi-tecture. It enables using MPLS and Internet re-sources in an optimal fashion, eventually leverag-ing local internet breakouts for SaaS applications.

Objectives: Maximize MPLS + Internet efficiency

Take full advantage of the Internet as a business network

Multiply available bandwidth (on average, by a factor of 3)

Minimize overall network costs

4. CRN with central Internet gateways and advanced Application Visibility, QoS & Control

Ipanema’s ANS brings full Application Visibility and coordinated, dynamic, QoS & Control without having to change your network architecture. Making your network cloud-ready can be as simple as deploying a few ANS devices in key locations, such as your private datacenters and Internet gateway locations. ANS overcomes the limitations of MPLS CoS (described earlier in Section 2) to guarantee the performance of SaaS collaboration

and existing applications over your network–during and after SaaS implementation.

Datacenter #1

Datacenter #2

XaaS

SAP Sharepoint Internet Gateway

Internet

Branch Office

MPLS

An MPLS Cloud Ready Network with central Internet gateways and appliances only in key locations

RETURN ON INVESTMENT: With ANS, the full capacity of the network can be put to use. A network exhibiting 70% available bandwidth peaks with on-premise solutions requires upgrading in order to prevent any risks to business-critical application performance. On the other hand, a network fitted with ANS can be fully utilized without any risk for business application performance. In many cases, ANS pays for itself as it removes the need to upgrade network links to cope with the traffic increase resulting from the SaaS migration. The typical cost for ANS with appliances only in key locations, at 0.5€ per user per month (amortized over three years), is marginal compared to the cost of SaaS collaboration (from 4€ to 25€ per user per month) and is quickly recovered by fewer if any requirements for network upgrades over the three-year period.

8 WHITE PAPER


Dynamic QoS and Control driven by per-user

Application Performance Objectives.

In place of CoS, where QoS parameters must be manually assessed per application, per site, ANS provides dynamic, automatic, session-level control driven by Applications Performance Objectives. The Layer 7, applications-level classification with ANS is extremely important for SaaS, which is based on HTTP and shares the same Port 80 as many other applications.

With ANS, you set per-user Application Perform-ance Objectives for each application once, based on business criticality, and the system dynamically adjusts utilization of available network resources in real-time for all applications according to those pre-determined business objectives.

This per-user control is important, because you subscribe to SaaS collaboration based on a number of users and what is required for each user. ANS adjusts network resources automatically rather than having to manually partition your network. You never need to go back and manually adjust network parameters for changes in users or applications usage.

A global approach to master the network’s hyper convergence.

MPLS CoS are unable to account for the “any-to-any” nature of traffic. ANS global network control takes into account all network resources, the requirements of each application and the instantaneous behavior of each network user. Control relies on QoS actions that are coordinated among appliances across your entire network. Unlike MPLS CoS, ANS manages flows not only as they enter the network, but also at the end points, where multiple sites compete for resources.

Real-time Applications Performance Dashboard expedites issue recognition and mitigation.

ANS provides a dashboard-available in multiple display formats, including iPhone, to monitor the real-time performance of all applications across the network. The dashboard shows a holistic view of usage and performance with an Application Quality Score (AQS) KPI for each application, which can be used to instantly identify issues and adjust bandwidth sizing or classification as needed.

You set the objectives

Before After Later

At each step of the project you are able to monitor the performance of all business critical applications

You can safely rollout the SaaS application

You can upgrade your WAN based on performance facts

• Bandwidth upgrade following Rightsizing recommendations OR

• Move to unified hybrid MPLS + Internet network

A CRN supports the full SaaS adoption lifecycle

You set the objectives

ANS dynamically adjusts

9 WHITE PAPER


5. MPLS CRN with in-MPLS Internet and branch office WAN Optimization

In some cases, enterprises have decided to outsource the management of Internet gateways to their MPLS providers. The Internet traffic directly enters the branch without any appliance able to control the flows at the gateways. This situation requires the Internet traffic to be controlled through an appliance deployed within each branch office. The presence of the appliance will allow additional ANS features such as WAN Optimization. In addition to the benefits described in the previous paragraph, enterprises will receive among other benefits expanded WAN capabilities through redundancy elimination and reduced response time for legacy, bandwidth- hungry and delay-sensitive applications.

6. CRN with unified hybrid MPLS + Internet

As your IT evolves toward a mix of private applica-tions, public cloud applications and Internet-based applications, changing your network architecture can help you make full use of both MPLS and Internet strengths. A hybrid MPLS + Internet

network provides, in many cases, the most favor-able cost and performance. Managing a hybrid network for optimal performance, however, re-quires a different approach than conventional PBR, which is still the mostly widely used technology.

As described earlier in Section 2, the operational complexity and poor performance of conventional PBR is such a burden to manage that the benefits of upgrading architecture to a hybrid MPLS + Internet network are quickly nullified. ANS instead deploys special devices in branches to implement Dynamic WAN Selection, which automates path selection for application flows so that your MPLS and Internet networks operate as one network.

ANS Dynamic WAN Selection:

Takes full advantage of the Internet as a business network

Increases available bandwidth (on average, by a factor of 3)

Minimizes overall network costs

Real-time sense-and-respond approach

PBR requires configuring and reconfiguring net-work routers as applications, sites and user counts are added or changed. ANS Dynamic WAN Selection implements automatic, per-application, per-user control with a real-time, sense-and-respond approach to traffic routing.

Full utilization of Internet bandwidth

PBR bases application routing on port numbers without taking into account line loads or path performance. ANS Dynamic WAN Selection is able to use Internet bandwidth for business-critical traffic when permitted by Internet performance.

RETURN ON INVESTMENT: Enterprises that have chosen to move to a unified hybrid net-work controlled by ANS typically chose not to upgrade their MPLS bandwidth in favor of the less-expensive Internet bandwidth. Including the price of the deployed ANS solution, typi-cally 1 to 2 € per user per month , most enter-prises were able to obtain a 20% decrease in overall network costs, upgrade available band-width by a factor of three, and adequately pre-pare for traffic increases over the next three to five years.

Datacenter #1

Datacenter #2

XaaS

SAP Sharepoint Internet Gateway

Internet

Branch Office

MPLS

An MPLS Cloud Ready Network with in-MPLS Internet gateways and WAN Optimization in branches

10 WHITE PAPER


Technical and logical Integration of components required for today’s WAN

PBR is a legacy technology that does not integrate well with other modern WAN tools. ANS Dynamic WAN Selection combines Application Visibility, QoS & Control, and WAN Optimization in an all-in-one solution for real-time traffic routing based on Application Performance Objectives.

7. The Management Issue: Cloud adoption creates a critical need for WAN Governance

Cloud adoption adds complexity to network management. Cloud applications such as SaaS collaboration bring many of the same issues as licensed software, but each IT implementation project can have a larger impact because of its reliance on your WAN. By aligning your network with business and Application Performance Objectives, WAN Governance puts you in control of this complexity and network impact.

WAN Governance improves the IT Governance you already have in place by providing:

A holistic approach to global visibility, control and optimization of application performance, as opposed to conventional solutions operat-ing as independent agents

Business continuity and control as SaaS appli-cations are adopted

Guaranteed application performance for any network architecture

Network capabilities to absorb enterprise requirements for agility, flexibility and growth

Next-generation solutions for implementing and managing a cloud-ready network

Using WAN Governance, your organization can:

Understand the nature of application traffic

Control and optimize this traffic

Guarantee application performance

Improve users’ Quality of Experience

Simplify network operations

Control network costs and leverage savings

8. Your business is cloud-ready, but is your network?

Hybrid networks are the future of VPNs. While wholesale adoption of public and even private clouds is not realistic in a large enterprise, SaaS applications–such as Google Apps, Office 365 or LotusLive for collaboration–will create a de facto hybrid network and increase the competition for network resources dramatically. More cloud applications will eventually follow, which further drives the need to evolve your VPN to a CRN with the necessary management capabilities.

Using Ipanema ANS, enterprises are deploying cloud-based applications safely, faster and at lower cost – ensuring business continuity, optimal

Valeo Embraces the Cloud and Maximizes Value

Valeo, one of the world’s leading suppliers of components, integrated systems and mod-ules for automotive CO

2 emissions reduction, rolled

out a hybrid network with MPLS + Internet for its migration from conventional email and collaboration applications to Google Apps. Valeo’s network supports approximately 160 sites worldwide, 52,000 users, and the delivery of applications such as ERP and CATIA. Using Ipanema’s ANS to dynamically manage application performance over their hybrid network, Valeo successfully deployed Google Apps with full Applications Visibility, QoS & Control, and Dynamic WAN Selection. “With Ipanema, we divided by three the transfer cost of each Gbyte of band-width over our global network,” says Alain Meurou, Infrastructure and Network Manager at Valeo.

Datacenter #1

Datacenter #2 XaaS

SAP Sharepoint

Internet

Branch Office

MPLS

A unified hybrid MPLS + Internet CRN

11 WHITE PAPER


applications performance and superior end-user experience. ANS reduces the complexity of cloud applications and hybrid networks, enabling infrastructure directors to say:

Yes, the network can support this new cloud application

Yes, legacy applications will still perform, in fact, better than before

Yes, we can smoothly transition applications to the cloud

Related reading

Ipanema, “Farewell VPN: The rise of cloud-ready networks,” May 2011

Ipanema, “Cloud-ready networks - WAN Governance for cloud computing,” November 2010

Gartner, “Magic Quadrant for WAN Optimization Controllers,” December 2010

Dr. Jim Metzler, “The 2010 Cloud Networking Report,” November 2010

WAN Governance Blog, http://www.wan-governance.com

Gartner, “Is Your Network Design the Weak Link in Cloud Computing?” August 2010

www.ipanematech.com

Beyond the Network…

ABOUT IPANEMA TECHNOLOGIES

The Ipanema System enables any large enterprise to have full control and optimization of their global networks; private cloud, public cloud or both. It unifies performance across disparate networks. It dynamically adapts to whatever is happening in these networks and guarantees constant control of critical applications. It is the only system with a central management and reporting platform that scales to the levels required by Telcos and large enterprises.

For more information www.ipanematech.com

Copyright © 2011, Ipanema Technologies - All rights reserved. Ipanema and the Ipanema logo are registered trademarks of Ipanema Technologies. The other registered trademarks and product names mentioned in this document are the property of their respective owners.

Documents

WAN Impact of Moving to a SaaS