SD-WAN and Secure Service Edge for DoD and Ultra-Secure Deployments

Built Using IETF Standards-Based Protocols: Based on BGP/MPLS VPN and Ethernet VPN, with the use of a Private SAFI (Sub Address Family Identifier) to carry SD-WAN- related information such as:

• Key management
• Access circuit state and status
• NAT-related information
• Information about SLA to critical applications

Key management and certificate management

• True emulation of IKE without using IKE.
• A branch’s secret is never sent on the wire and can be rotated as often as every four minutes.
• A unique shared secret is algorithmically derived between every pair of branches.
• Advanced certificate management capabilities.
• Support for OCSP, CMPv2, SCEP, and ACME
• Support for external key management using Key Management Interoperability Protocol (KMIP) for deployments requiring keys generated by the tenant/customer.

Ability to be deployed in DDIL (Denied, Disrupted, Intermittent, and Limited) environments

• Three VM images – The minimum set of images to operate completely disconnected is three. All updates of security images are supported in a completely disconnected environment.
• License centrally managed by Versa Director. Versa Director is one of the three images where the license is loaded and does not require reaching back to or through the internet.
• Versa Analytics is one of the images. It provides operators with full visibility of security, connectivity, and performance.
• Single Pane of Management as well as Centralized Provisioning, Management, Monitoring, Visibility, and Big Data Analytics for all SASE services (SD-WAN, SSE) and multi-cloud.
• Most widely deployed SD-WAN solution by Satellite-Based Service Providers, Shipping, and Maritime. Support for up to 14 underlay transport domains per node. It can simultaneously accommodate multiple underlays such as SATCOM (LEO, MEO, GEO), Private MPLS, LTE/5G, terrestrial fiber, broadband, and others.

Versatile Traffic steering, Traffic Conditioning, and Advanced TCP Optimization

• Traffic steering based on any layer3-layer7 fields of the packet, Layer7 application, URL category, user, group, device posture, Entity Confidence Score, Geo-Location, Security Tag associated with the source, time of the day, and other factors.

  • Tunnel-less on a per-flow basis. Versa can support Tunnel-less SD-WAN where and when required. Please refer to the section “Versa’s Tunnel-Less SD-WAN Solution.”
  • Encryption can be enabled or disabled on a per-flow basis.

• Versa solution is very well suited and provides the best application experience for satellite, maritime, and federal networks that leverage NSA High Assurance Internet Protocol Encryption (HAIPE) or Commercial Solutions for Classified (CSfC)-based architectures that might experience DDIL and adverse conditions. Please refer to the section “Versa SD-WAN for Classified Solution.”

• Traffic steering is based on the visibility of end-to-end dynamic path characteristics such as packet loss, latency, and jitter. This feature provides more accurate and resilient end-to-end application SLAs. All other vendors select the best path based on SLA to the immediate next hop. Only Versa can steer traffic based on end-to-end path metrics.
• Traffic conditioning using FEC, replication, and other measures, which are all automatically triggered when SLA degrades and stopped when the SLA improves. These capabilities are available for all traffic types rather simply for voice and video.
• Support advanced TCP optimization and congestion control algorithms like BBR, Hybla, SACK, Recent Acknowledgement.

Comprehensive QoS Capabilities Versa solution supports very comprehensive QoS (Layer3-QoS-Policy, AppQoS Policy, Policer, Marking, HQoS with 4K shapers and 64,000 queues) and SD-WAN traffic steering capabilities. Based on the layer3-layer7 fields within the received traffic, including application, URL category, and device posture, a forwarding class (FC) and packet-loss priority (PLP) is associated with a traffic flow. The FC and PLP prioritize and schedule the traffic within a VOS platform. Additionally, rewrites of inner and outer headers and egress-shaping are done based on the FC and PLP. Hence, mission traffic is prioritized over less-critical traffic within a Versa appliance as well as on transmission.

Very well suited for brownfield network deployments.

• Support all major layer2 and layer3 (IPv4 and IPv6) protocols.
• Support for IPv4, IPv6, and dual-stack for VRFs, as well as underlay transport.

Support for complex topologies such as Full Mesh, Hub and Spoke, Partial Mesh, Spoke-Hub-Hub-Spoke, Hub-Controllers, Controller behind the hub, and many more.

Very rich template infrastructure: Versa supports a very rich template infrastructure that supports a hierarchy of templates. Using this hierarchy of templates, global policies can be defined with specific policies having higher precedence. This makes the overall configuration management simple and efficient.

A device group is a collection of devices with similar but not identical configurations. A device group is typically associated with a device template and a set of service templates of different types, such as security service template, application steering service template, QoS service template, General service template, and others. A device group can be associated with multiple security service templates which are applied in an operator-specified order. Additionally, there can be device-specific security service templates.

CGNAT for v4 and v6 NAPT-44, DNAT-44, Dynamic NAT-44, Basic-NAT-44, Twice Basic NAT-44, NPT66, NAT64, MAP-E

Multiple options for Zero Touch Provisioning.

Universal CPE to host multiple VNFs. Service Chaining hosted VNFs and external physical PNFs.

Versa also offers a Tunnel-Less SD-WAN solution, which makes the network more scalable, and bandwidth-efficient, eliminating fragmentation of packets and better security. Some of the use cases that drove this tunnel-less solution were satellite, maritime, and federal networks that leverage NSA High Assurance Internet Protocol Encryption (HAIPE) or Commercial Solutions for Classified (CSFC)-based architectures.

In the case of all Tunnel-less solutions, the inner packet is divided into mutable and immutable fields. Figure 3 shows all the common fields of an IP header, TCP header, and UDP header. A subset of immutable fields within an IP header, TCP header, and UDP header, which are invariant for the duration of a 5-tuple flow are show in blue color. All solutions associate some form of a cookie, label, flow-id, or a (source-port, destination-port) pair with the immutable fields.

This cookie/label/flow-id/port-pair is communicated with the entire payload packet from a sender SD-WAN CPE (SDWAN-CPE1) to a receiver SD-WAN CPE (SDWAN-CPE2) at least once. Once a remote SDWAN-CPE (e.g., SDWAN-CPE2) has learned the mapping of the sender (e.g., SDWAN-CPE1) and communicates it to the sender, the sender (SDWAN-CPE1) encodes its flow-id in the SDWAN-header and skips all immutable fields of the payload packet in the traffic that is sent from SDWAN-CPE1 to SDWAN-CPE2. Please note that within the Versa Tunnel-less solution, a sender SD-WAN CPE skips many other IP, TCP, and UDP fields of the payload packet when sending traffic to a peer SD-WAN CPE. These are not described in this white paper.

SD-WAN creates a virtual private network that is transport-agnostic, application-aware, and supports centralized management and provisioning. It is essential that an SD-WAN solution can easily insert itself into a brownfield network and allow for gradual migration from the existing MPLS or DMVPN networks to the SD-WAN network.

As explained above, in the case of all Tunnel-less solutions, the inner packet is divided into mutable and immutable fields. All solutions associate some form of a cookie, label, flow-id, or a (source-port, destination-port) pair with the immutable fields. This cookie/label/flow-id/port-pair is communicated with the entire payload packet from a sender SD-WAN CPE (SDWAN-CPE1) to a receiver SD-WAN CPE (SDWAN-CPE2) at least once. Once a remote SDWAN-CPE (e.g., SDWAN-CPE2) has learned the mapping of the sender (e.g., SDWAN-CPE1) and communicates it to the sender, the sender (SDWAN-CPE1) encodes its flow-id in the SDWAN-header and skips all immutable fields of the payload packet in the traffic that is sent from SDWAN-CPE1 to SDWAN-CPE2.

Because of the different ways (flow-ids, combination of outer source-port and destination-port) that various vendors have chosen to encode the immutable data, they can only inter-operate at the boundaries (NNI: Network to Network Interface) of the different vendors’ SDWAN networks. Some of the reasons this is indeed the case is because key management, encoding of packets, encryption/decryption, the control plane (propagation of routes), management plane (configuration and monitoring), and visibility plane (big data analytics) are very different for all the vendors.

Two vendors can inter-operate using IETF-based protocols like E-BGP, IKE-based IPsec, and TWAMP. Two vendors can also add the capability to decode and encode each other’s data-plane formats.

The Versa Real Time Monitor provides real-time information about all the networking, SD-WAN, and security services that are configured on each Versa appliance. It also provides information relating to the health (CPU, Memory, Bandwidth on each of the interfaces, Load) of the VOS instances.

Versa Analytics is a big data solution that analyses logs and events and provides powerful reports, analytics, and feedback to Versa Director. It integrates natively with third-party data reporting and SIEM products, such as HP ArcSight, Splunk, IBM QRadar, LogRhythm, and Elastic Search. VOS™s at branch sites continuously provide Versa Analytics monitoring information related to links, network paths, security events, services, applications, etc. Additionally, every service on the VOS™, such as the next-generation firewall, IDS/IPS, URL-filtering, CASB, SWG, DLP, RBI, UEBA, DNS Proxy, and other modules, generate flow-level and aggregate log messages that are consumed by the Versa Analytics platform.

All this information can be leveraged for functions such as capacity planning and security forensics. Figure 6, Figure 7 Figure 8 , and Figure 9 provide a few examples of information available using Versa Analytics.

Versa Analytics sends these logs to Versa UEBA over a KAFKA bus. Versa UEBA can track and flag anomalous events by all entities, such as users, laptops, phones, IoT devices, and more. If a user or an IoT device exhibits anomalous behavior, then its Entity Confidence Score (ECS) is degraded. This ECS is used in different types of policies, such as the Security Access Control Policy and Traffic Monitoring Policy. If the ECS of an entity degrades, then it is published to all subscribers (such as Versa Cloud gateways) using the Versa Message Service. The Versa Cloud Gateways can enforce real-time remediation when the ECS degrades.