Answer
Software-defined WAN, DMVPN and IPsec tunnels each have a place among enterprises. Our network expert compares each one and explains where they can be most beneficial.
By
- Andrew Froehlich,West Gate Networks
Published: 16 Dec 2019
While software-defined WAN has been the hot technology in the IT networking field for the past few years, not everyone can take advantage of it. IPsec tunnels and dynamic multipoint VPNs, or DMVPNs, still have a place in the enterprise and will continue to be viable options for years to come.
That said, IT leaders should figure outwhich remote connectivity options are optimalfor each individual use case. Let's look at SD-WAN vs. DMVPN vs. IPsec tunnels and go over the pros and cons of each.
SD-WAN
SD-WANis touted as a modern,cost-saving technologyfor connecting branch offices that require ultrareliable connectivity for low-latency and business-critical applications. SD-WAN requires two or more modes of WAN connectivity between locations. This connectivity commonlyconsists of MPLS and internet broadband -- or both. One goal of SD-WAN is to stretch the use of lower-cost connectivity, while meeting the same latency and throughput requirements. That's where enterprises can gain potential cost savings.
DMVPN
DMVPNcan be thought of as an evolution of the standard IPsec tunnel with some added redundancy benefits. While IPsec VPN tunnels are hardcoded and essentially "nailed up" between two locations, DMVPN builds tunnels between locations as needed. It does this using typical routers with no additional feature capability, as is the case with SD-WAN.
DMVPN tunnels are designed as amesh network, as opposed to hub and spoke. That means DMVPN can take a direct route from one remote site to another when transporting data, as opposed to being forced to route traffic through a hub location first. It can also route outbound packets around failed WAN links when they go down, if more than one WAN connection is installed at that location.
This type of WAN design is ideal when you want to build transport efficiencies between remote locations yet don't truly need the low-latency advancements found in SD-WAN. Note, however, that DMVPN usesdynamic routing protocolsas its routing mechanism. Incorrect use of dynamic routing protocols can cause serious security and reliability risks when not managed properly. It also somewhat adds to the configuration complexity. As a result, it's not advisable to build DMVPN tunnels between networks you don't fully manage.
IPsec tunnels
IPsec VPN tunnelsused to dominate remote site connectivity. Because network managers could build tunnels across low-cost broadband internet links, IPsec tunnels were incredibly cheap compared to private WAN connectivity options, like MPLS. They're also easy to set up, and nearly everyone can acquire low-cost hardware to build an IPsec tunnel, even low-end firewalls and routers.
Choosing the right option
Technologies like DMVPN and SD-WAN are taking over remote site connectivity because they provide more efficient paths and lower latency between locations -- as long as you control both sides of the WAN. Let's briefly compare SD-WAN against DMVPN and IPsec tunnels to be sure they meet your needs without going overboard.
SD-WAN vs. DMVPN. If you have remote sites that require low-latency connectivity for the streaming of voice and video or real-time apps yet can benefit from WAN connectivity cost savings, SD-WAN might be a good fit. Keep in mind, however, that SD-WAN oftenrequires specialized hardware, software and licensing to operate. The overall architecture can also prove to be more complex to configure and maintain. If that sounds like too much and your main concern is to be able to quickly fail over routing to a secondary connection, DMVPN may be a better fit.
SD-WAN vs. DMVPN vs. IPsec tunnels. If you need to connect your network to untrusted or temporary locations, IPsec tunnels are still the way to go. These locations include connectivity from your corporate network to third-party vendors andIaaS and PaaScloud providers, for example. IPsec tunnels are universal, and you can build one to virtually anywhere.
The same cannot be said for DMVPN or SD-WAN. If your branch offices don't require consistent and predictable latency or the ability to fail over to a secondary WAN link, you may as well stick with traditional IPsec tunnels. There would be no business or cost savings benefit. Plus, your overall architecture and configuration setup would become unnecessarily complex for what is needed.
Dig Deeper on WAN technologies and services
- SD-WAN vs. VPN: How do they compare?By: RobertSturt
- 3 important SD-WAN security considerations and featuresBy: KevinTolly
- The pros and cons of Netskope SASEBy: SteveGarson
- Evaluate the components of Cisco SASEBy: SteveGarson
Related Q&A from Andrew Froehlich
Cloud security vs. network security: What's the difference?
While network security focuses on solely protecting networks, cloud security provides protection for networks, servers, containers, apps and more.Continue Reading
Can Microsoft Teams chat be monitored?
The quick answer is yes -- IT administrators can monitor employees' messages in Microsoft Teams. But organizations need the proper license plans and ...Continue Reading
SOAR vs. SIEM: What's the difference?
When it comes to the SOAR vs. SIEM debate, it's important to understand their fundamental differences to get the most benefit from your security data.Continue Reading
