WEBVTT

1
00:00.000 --> 00:08.310
So next, let's talk about sort of the more current design, which is direct

2
00:08.310 --> 00:10.000
internet access.

3
00:10.000 --> 00:15.040
Now of course, this has several advantages over the centralized internet

4
00:15.040 --> 00:15.840
gateway, but

5
00:15.840 --> 00:18.920
that's what we need to talk about in this video.

6
00:18.920 --> 00:25.160
Now understand, this video is just an introduction to direct internet access.

7
00:25.160 --> 00:29.590
If you look over the rest of this skill, you'll see that most of the upcoming

8
00:29.590 --> 00:30.400
videos are
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

8
00:29.590 --> 00:30.400
videos are

9
00:30.400 --> 00:35.600
sort of different renditions of implementing direct internet access.

10
00:35.600 --> 00:39.130
So let's get an introduction to direct internet access, and then we'll be

11
00:39.130 --> 00:40.260
talking about different

12
00:40.260 --> 00:43.440
variants of that model moving forward.

13
00:43.440 --> 00:48.680
But let's just take a look at it in general to get started.

14
00:48.680 --> 00:55.740
So the whole idea behind direct internet access or DIA is that the branch

15
00:55.740 --> 00:57.320
offices don't have

16
00:57.320 --> 01:00.080
to go through this central site anymore.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:57.320 --> 01:00.080
to go through this central site anymore.

17
01:00.080 --> 01:04.550
Instead, they're going to go directly to the internet through their own local

18
01:04.550 --> 01:05.200
internet

19
01:05.200 --> 01:06.960
connection.

20
01:06.960 --> 01:11.560
And this is a fairly straightforward decision, particularly these days, because

21
01:11.560 --> 01:12.000
a lot of

22
01:12.000 --> 01:17.690
our sites were sort of already using an internet connection to back up the

23
01:17.690 --> 01:18.180
private

24
01:18.180 --> 01:21.160
WAN circuit that they already had.

25
01:21.160 --> 01:25.690
So if they already had an internet connection, it's really not that difficult

26
01:25.690 --> 01:26.760
to simply say,

27
01:26.760 --> 01:31.880
"Okay, well, go ahead and use that for going directly to the internet as well
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:26.760 --> 01:31.880
"Okay, well, go ahead and use that for going directly to the internet as well

28
01:31.880 --> 01:32.480
as backing

29
01:32.480 --> 01:34.320
up the WAN circuit."

30
01:34.320 --> 01:41.010
Now, in a design like that, internal or internet traffic would still traverse

31
01:41.010 --> 01:42.600
that same private

32
01:42.600 --> 01:46.880
WAN link that we discussed in the previous video.

33
01:46.880 --> 01:52.610
And that might even include something like, you know, an IPsec VPN or DMVPN,

34
01:52.610 --> 01:53.520
maybe even

35
01:53.520 --> 01:58.400
a GRE tunnel that's sort of already using that internet connection.

36
01:58.400 --> 02:05.590
Now, if it's more of a traditional WAN circuit, so if that private WAN circuit
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:58.400 --> 02:05.590
Now, if it's more of a traditional WAN circuit, so if that private WAN circuit

37
02:05.590 --> 02:07.120
is dedicated,

38
02:07.120 --> 02:12.790
meaning again, something like maybe MPLS or dark fiber, we could actually use

39
02:12.790 --> 02:13.280
that to

40
02:13.280 --> 02:15.880
back up the internet connection as well.

41
02:15.880 --> 02:19.920
And we'll talk about this more in some of the upcoming videos.

42
02:19.920 --> 02:23.780
But essentially, what we could say is if the local internet goes down, we could

43
02:23.780 --> 02:24.160
still

44
02:24.160 --> 02:30.190
revert back to that centralized internet gateway design where the traffic goes
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
02:24.160 --> 02:30.190
revert back to that centralized internet gateway design where the traffic goes

45
02:30.190 --> 02:30.960
back to the

46
02:30.960 --> 02:34.680
central location and then goes out through the internet.

47
02:34.680 --> 02:39.180
So again, depending on how this is designed exactly and what circuits we have

48
02:39.180 --> 02:40.000
available,

49
02:40.000 --> 02:46.520
we could actually use that private WAN as a backup for the internet connection.

50
02:46.520 --> 02:50.760
Now of course, one of the big things we have to be concerned with here is when

51
02:50.760 --> 02:51.520
these sites

52
02:51.520 --> 02:56.340
are sending the traffic directly to the internet, they're going to need

53
02:56.340 --> 02:57.280
security.

54
02:57.280 --> 03:02.240
So it's going to have to have its own security stack as well as any other edge
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
02:57.280 --> 03:02.240
So it's going to have to have its own security stack as well as any other edge

55
03:02.240 --> 03:03.160
services that

56
03:03.160 --> 03:05.040
we wish to provide.

57
03:05.040 --> 03:10.240
So each site is probably going to need its own firewall, some sort of device to

58
03:10.240 --> 03:10.760
do port

59
03:10.760 --> 03:18.020
address translation or PATT, maybe IDS or IPS, again, anything that we want

60
03:18.020 --> 03:19.160
between that

61
03:19.160 --> 03:22.160
remote site and the internet.

62
03:22.160 --> 03:26.760
And honestly, this was sort of a holdback in our legacy systems.

63
03:26.760 --> 03:30.810
I mentioned this in the previous video where I mentioned one of my previous
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
03:26.760 --> 03:30.810
I mentioned this in the previous video where I mentioned one of my previous

64
03:30.810 --> 03:31.600
customers that

65
03:31.600 --> 03:35.720
I was working with had like 520 remote sites.

66
03:35.720 --> 03:41.280
That would be a lot to manage from a firewall and edge services perspective.

67
03:41.280 --> 03:48.190
However, SD WAN has gone a really long way in making this design far more

68
03:48.190 --> 03:49.840
manageable,

69
03:49.840 --> 03:56.690
because now we can just write a policy and push that policy out to 520 remote

70
03:56.690 --> 03:57.560
sites.

71
03:57.560 --> 03:59.760
So it becomes much more manageable.

72
03:59.760 --> 04:04.680
And along with that, we can also offer some advanced capabilities.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
03:59.760 --> 04:04.680
And along with that, we can also offer some advanced capabilities.

73
04:04.680 --> 04:10.830
Some of those are things like having multiple local direct internet access

74
04:10.830 --> 04:11.700
exits.

75
04:11.700 --> 04:16.640
We can use this either just for redundancy or with load sharing.

76
04:16.640 --> 04:21.220
Now this is going to be controlled by those policies we were talking about just

77
04:21.220 --> 04:21.800
a moment

78
04:21.800 --> 04:22.800
ago.

79
04:22.800 --> 04:27.440
And again, that allows us to configure all of the devices at the same time.

80
04:27.440 --> 04:32.660
That part of the manageability comes down to all of this being automated and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
04:27.440 --> 04:32.660
That part of the manageability comes down to all of this being automated and

81
04:32.660 --> 04:33.480
doing smart

82
04:33.480 --> 04:38.440
selection of whatever the best performing path is.

83
04:38.440 --> 04:45.940
We can also support things like having a separate default route per VPN for

84
04:45.940 --> 04:47.080
this direct internet

85
04:47.080 --> 04:48.480
connection.

86
04:48.480 --> 04:49.880
Why do we care?

87
04:49.880 --> 04:55.850
Well, this can be used to do things like local or regional breakout for traffic

88
04:55.850 --> 04:56.480
that's

89
04:56.480 --> 04:59.360
not necessarily going directly to the internet.

90
04:59.360 --> 05:03.800
So this allows us to have a lot more control over the traffic flow.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
04:59.360 --> 05:03.800
So this allows us to have a lot more control over the traffic flow.

91
05:03.800 --> 05:08.390
And it also allows us to do some more advanced models, such as having a

92
05:08.390 --> 05:09.800
regional hub rather

93
05:09.800 --> 05:16.560
than one central hub that we can use for our internet access with SD-WAN.

94
05:16.560 --> 05:21.030
So this is sort of a model in the middle where we have a regional hub rather

95
05:21.030 --> 05:21.920
than one big

96
05:21.920 --> 05:26.710
central hub for everybody, but it does still fall into the direct internet

97
05:26.710 --> 05:27.920
access design.

98
05:27.920 --> 05:31.280
We'll talk about this a little bit more coming up.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
05:27.920 --> 05:31.280
We'll talk about this a little bit more coming up.

99
05:31.280 --> 05:34.520
And of course, it supports those edge services that we were talking about

100
05:34.520 --> 05:35.080
before.

101
05:35.080 --> 05:40.120
We have to have that ability to do NAT and PAT at most remote offices.

102
05:40.120 --> 05:45.600
They're generally not going to have dedicated purchased internet address space.

103
05:45.600 --> 05:49.720
We're almost always going to have to be doing NAT or PAT.

104
05:49.720 --> 05:56.840
And part of what makes all of this possible is the cloud on-ramp for SaaS.

105
05:56.840 --> 06:01.000
We're going to be covering this in more detail in the next video.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
05:56.840 --> 06:01.000
We're going to be covering this in more detail in the next video.

106
06:01.000 --> 06:04.640
So let's wait and talk about it there.

107
06:04.640 --> 06:09.820
So in this video, we jumped in and just got an introduction to the idea of

108
06:09.820 --> 06:11.120
direct internet

109
06:11.120 --> 06:14.040
access for the remote sites.

110
06:14.040 --> 06:19.040
And again, this is simply the remote sites going directly to the internet

111
06:19.040 --> 06:19.800
without having

112
06:19.800 --> 06:26.070
to first traverse some sort of central location such as headquarters or a data

113
06:26.070 --> 06:27.040
center.

114
06:27.040 --> 06:32.960
Now one of the cool features we have in SD-WAN to help with this design is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
06:27.040 --> 06:32.960
Now one of the cool features we have in SD-WAN to help with this design is

115
06:32.960 --> 06:34.040
cloud on-ramp

116
06:34.040 --> 06:36.240
for SaaS.

117
06:36.240 --> 06:40.960
So in the next video, let's jump in and take a closer look at that feature.