With a growing number of companies beginning the shift towards software-defined networking and adopting SD-WAN solutions, there is an increased focus and discussion around SD-WAN security issues. Is SD-WAN secure? The answer to this question lies in proper implementation and selection of right software and hardware for the job.
In this article, we’ll be looking at seven hardware features to integrate into your SD-WAN appliance for both enhanced security and improved efficiency. There are of course a multitude of different varieties of hardware that aim to improve and enhance SD-WAN appliances so, in no particular order, here is our list.
7 Hardware Based Feature Considerations for SD-WAN Security and Efficiency
1. IPMI
Centralization has become an essential aspect in platform management, so much so that specific standards have been devised to enable servers to be monitored and controlled centrally.
These solutions are known as IPMI or Intelligent Platform Management Interface and their focus ranges from monitoring hardware temperatures and power consumption to logging all a server’s event states and initiating boot up or shut down.
Some of the benefits of IPMI include its universal support from hardware suppliers and vendors and the fact it enables servers to be managed without the need for onsite staff, as well as being able to issue notifications and alerts when server health drops below a certain threshold.
2. LAN Bypass
Power outages are an unfortunate but unavoidable occurrence in everyday life. Fortunately, there are solutions available designed to reduce or even eliminate the impact on your network connectivity when they do. LAN Bypass fault tolerance features are one such solution.
The utilization of LAN Bypass ports allows for uninterrupted network traffic by bridging WAN1 and LAN1 ports as and when a power outage occurs. These solutions are often available as built in features but can sometimes need to be acquired separately then integrated.
Third generation LAN Bypass improve upon previous iteration by incorporating remote bypass control, multiple watchdogs dedicated to different bypass pairs and packet-loss prevention if bypass is enabled during the system’s just on state.
3. Intel QAT/DPDK
Intel’s Quick Assist Technology (Intel QAT) is a software enabled solution designed to improve both performance and security by accelerating compute-intensive operations. When integrated into software-defined infrastructure, Intel QAT provides an ideal foundation for software-enabled security features, authentication, and compression as well as improving symmetric encryption and authentication, digital signatures, and lossless data compression.
Open source Data Plane Development Kit (DPDK) is a set of network interface controller drivers and data plane libraries designed to provide a programming framework for faster development of high-speed data packet networking applications with the goal of achieving faster packet processing.
Utilizing a selection of different drivers such as PMD and User Mode driver, DPDK aims to enhance and improve network performance and various other software optimizations.
Lanner’s Secure SD-WAN Appliances are tested and approved by top SD-WAN Software solution providers
4. SR-IOV/AES-NI
Single-Route I/O Virtualization (SR-IOV) is a particular specification that revolves around allowing a PCIe device to appear to be multiple, separate physical PCIe devices. This is mainly done to promote interoperability. This is done by introducing two different types of functions; physical and virtual functions.
Intel’s Advanced Encryption Standard New Instructions (AES-NI) looks to improve upon the AES encryption algorithm by accelerating and enhancing the encryption of data. These solutions can be used to protect both personal data and corporate IT infrastructures as well as network traffic.
By including seven new instructions to AES, Intel’s AES-NI is able to accelerate encryption and decryption while also improving key generation, matric manipulation, and carry-less multiplication.
5. Secure Boot/Boot Guard
With security becoming increasingly essential to nearly every aspect of online business and activities, it is no wonder businesses, institutions, and enterprises are looking for even more secure ways to protect their data and infrastructure. Secure Boot and Boot Guard are two ways in which this could be done.
Boot guard is a feature in many modern processors that makes sure a computer is not running firmware images not released by the system’s manufacturer. It does this by verifying the signatures contained within firmware images. This helps to protect the system before Secure Boot initiates.
Secure Boot is a security standard developed to help ensure that computers only boot up using software that has been specifically deemed trusted by its OEM. These solutions are able to help protect systems from infection and compromise from malware and other malicious software.
Whitepaper: 3 Intel® Tests Prove Lanner NCA-2510 a Highly Reliable vCPE Option for Telcos
6. TPM
Trusted Platform Modules (TPMs) are dedicated micro-controllers designed as part of an international standard for secure crypto-processing.
TPMs are handy for several reasons, firstly they help raise security levels far above regular consumer standards, secondly, they can detect whether a system has been compromised and start up in “quarantine” mode if so, and finally, they can also be used to help keep computers running smoothly.
TPM chips can also be used for the secure storage of encryption keys, certificates and passwords used for logging in to online service accounts. This is a vastly superior method of storage than being saved onto software on a hard drive.
7. Dual BIOS
Dual BIOS are any computer motherboard that features both a primary BIOS and a backup BIOS.
There are several reasons as to why a motherboard may contain dual BIOS including to assist in a motherboard’s recovery after any issues during or after a BIOS update as well as helping to protect the BIOS from other threats such as viruses or data corruption.
In the event of a power outage during an update, for example, a built-in board features would check to see whether the BIOS was starting correctly or not. If not, the dual BIOS allow for the motherboard to automatically switch to the back-up BIOS, allowing the possibility to overwrite the corrupted BIOS and initiate a new start-up process.
Centralized management, software-defined infrastructure and security, and faster packet processing are but a few of the ways in which SD-WAN appliances are now being enhanced to provide a higher level of performance and functionality in an increasingly virtualized world. Doing the due diligence when selecting the hardware can save you and your organization a lot of time and money in the long run.
