Private WAN V Hybrid WAN
What is a Traditional Private WAN?
In a traditional WAN environment, each branch office is connected using a single dedicated private network connection that is a point to point between the branch and head office sites.
Occasionally this single private line will be backed up by another link (normally a cheaper commodity connection and often from the same ISP as the main link) that acts as a failover connection, but not always – and certainly not without additional cost.
For example, we can see the head office local area network has two WAN connections. In red, we have a direct to public internet service and in blue, the connection to the managed WAN providers network that subsequently provides routing of traffic to the three remote branch offices (A, B, C)
It’s important to note that the branch offices do not have a direct internet connection at all. Instead, they each have a single dedicated link back to the head office location, so all internet access at the remote sites passes through the head office public internet link (shown in red).
​
When we look at the hardware involved to achieve this configuration we might see something like this:
At the head office location, we have two routers, one for public internet access and the other for access to the private WAN. At the branch office location, we have a single router that acts as the default gateway for the LAN clients there and sends all traffic back over the private network to the head office.
Example IP Addressing
To explain this type of configuration further, here is a diagram showing how the IP addressing might be configured for this type of Layer 3 traditional private WAN.
The head office network has a network subnet of 10.10.1.0/24 and uses the public internet access router (10.10.1.1) as the default gateway. The public internet access router has a static route with a supernet of 10.11.0.0/16 and the private WAN access router (10.10.1.254) as the target. In this way, any traffic destined for the remote branch offices reaches the default gateway router and is then forwarded to the private access router, enabling the sites to communicate with head office in a hub and spoke fashion.
What is a Hybrid WAN?
A Hybrid WAN combines private point-to-point links with public Internet links using encryption to ensure that any traffic sent over the public internet is secure.
The end result is a Wide Area Network made up of multiple connections between each location that can be actively used at the same time to improve connection reliability and aggregate bandwidth.
​
It requires the use of multi-WAN routers at each location that is capable of sending traffic securely over multiple WAN links at the same time from a remote branch office that is then also able to combine the traffic again when it reaches the destination.
​
Our Software Defined Network (SDN/ SD-WAN) and bandwidth bonding technology is the mechanism for creating a Hybrid SD network using multiple private and public links.
Hybrid SD WAN Example
If we wanted to use Hybrid SD-WAN technology in our previous example, the high-level design would look like this:
In this example, the head office network now has three routers. An SD-WAN device has been added to act as the default gateway for the network. This has the public internet access router and the private WAN access router connected to its WAN ports.
​
​
The remote branch location also has an additional SD-WAN device. This has the original private WAN router connected to its WAN ports along with new additional public internet access routers.
​
​
The two SD-WAN devices create a single logical connection made up of multiple secure connections between each other, across both the public and private networks. Both networks can send and receive traffic at the same time. The benefits to this Hybrid WAN approach are considerable:
-
Additional bandwidth can be added quickly using public internet links that tend to be cheaper with much higher bandwidth than dedicated private WAN links.
-
Using our Software Defined Network (SDN/ SD-WAN) technology, multiple network technology types (Fiber, DSL, Cellular, and even Wi-Fi) can be used at each location and combined to provide resilience.
-
The WAN links at each location do not need to be from the same ISP or managed service provider – allowing for provider diversity.
-
The end result is a more resilient, more agile, higher bandwidth, and secure WAN.
​
​
Hybrid WAN IP Addressing Example
The diagram below shows the network diagram for an example Hybrid WAN configuration using the topology from the previous traditional WAN example as a starting point.
Head Office Network
In the head office location, a new SD-WAN router is added that acts as the default gateway for the network. On its WAN1 is the existing public internet access router and on WAN2, it has the existing private WAN access router.
The private WAN access router (shown in blue) is configured with a new LAN IP in a different range than the head office LAN. The original head office LAN IP range (10.10.1.0/24) is maintained on the LAN to reduce the amount of reconfiguration needed on servers and infrastructure at this location.
​
​
The Software Defined Network (SDN/ SD-WAN) has an outbound policy added to tell it to route all traffic for the remote private WAN routers (in the remote branch offices) over WAN2. This outbound policy enables traffic to route between the WANs of the remote SD-WAN routers and the one at head office, which in turn enables secure tunnels to be created over the existing private WAN.
​
With this configuration in place, we have the level topology configured as illustrated.
