In the past decade, enterprise networks have become significantly more complex. Applications that used to be in a single data center now run across public clouds, private infrastructure, SaaS and edge locations at the same time. Users connect from corporate, home networks and mobile devices. Traffic flows that were once predictable in nature, traversing from branch to data center now branch every which way. Traditional WAN architectures, designed for a simpler topology, have trapped IT teams in a paradigm where they have very little visibility to what is traversing the network and how individual applications are performing.
By design, SD-WAN solves the visibility gap. Unlike destination-based routing which treats all traffic the same, an SD-WAN network classifies traffic at the application level and implements policy based on what it is, who generated it, and what performance requirements it has. This application-aware design forms the basis of the visibility and control improvements SD-WAN provides over traditional WAN solutions.
Organizations seeking to understand how SD-WAN capabilities apply to application performance and traffic governance will find a useful starting point in the technical resource on SD-WAN network for application visibility, which outlines how SD-WAN’s core components work together to provide traffic classification, path selection, and centralized policy enforcement across distributed environments.
Traditional WANs have a visibility problem
Legacy WAN routers were designed to transport packets from one place to another based on IP routing tables. They knew (understood) source and destination addresses, and made forwarding decisions based on them. However, they were unable at least without a lot more tooling around the process to determine which application a given flow was associated with, whether that application was within SLO or not, or automatically redirect traffic based on changing conditions.
The end result was a largely black-boxed network to the teams in charge of running it. IT admins could see that bandwidth had been consumed and latency was present on a given link, but relating that information to an app that is having degradation, why and how it can be corrected required cross-correlation of multiple separated tools through manual investigation. Which mean that in distributed enterprises with dozens or hundreds of sites, this visibility deficit meant slower response times and higher operational cost and lower quality user experience which were difficult to diagnose and take a longer time to resolve.
How SD-WAN Achieves Application-Level Classification
SD-WAN edge devices can perform Layer 7 deep packet inspection to detect application traffic. Unlike the approach of only analyzing port numbers or IP headers, deep packet inspection (DPI) inspects packet content and behavioral signatures to identify what application is producing a flow: from a video conferencing platform to an ERP system; SaaS productivity application to general web browsing.
This occurs at the point of ingress, on the first packet of a new flow, allowing the SD-WAN to apply appropriate policy right away instead of waiting for a flow to establish and them recategorize it. First-packet classification is most relevant for latency-sensitive applications, where misdirected traffic causes visible degradation even within milliseconds.
The principles and technical mechanisms used for collecting, exporting, and consuming network flow data including the telemetry methods that underpin network visibility are described in the network telemetry framework overview published by the IETF as RFC 9232, which classifies data collection techniques across the forwarding, control, and management planes and provides the conceptual architecture that modern network monitoring approaches draw from.
Centralized Policy and Traffic Management
When traffic is classified, the SD-WAN controller must apply policies to determine how each application type will be treated over the network. Such policies are defined centrally and pushed automatically to every edge device in the deployment; in other words, a policy change happens everywhere at once without needing reconfiguration on a site-by-site basis.
Policies can be configured per granule. Low-latency, low-jitter voice and video traffic is always routed over the best available path. Paths with available capacity (not demanding path) are assigned for bulk file transfer and backup traffic. For example, business-critical applications can be prioritized over MPLS links while general internet browsing is routed to lower-cost broadband connections.
Dynamic Path Selection as per Current Conditions
What makes SD-WAN Application Steering so effective is the constant measurement of performance on WAN links. SD-WAN edge appliances continually test for packet loss, latency, and jitter across all available paths, measuring them in real time and comparing the results against application policy performance thresholds. The system detects a degradation in the link even before total failure and routes the affected application traffic to another path that meets policy requirements.
This is the only dynamic aspect of SD-WAN, and it allows you to differentiate SD-WAN from WAN in practical terms. In a typical WAN environment, an organization running VoIP over a link that starts to see packet loss will notice this in their calls, degrading and dropping, and in many cases human resources are required to escalate the issue so it can be addressed. In an SD-WAN scenario, the solution detects the degradation and automatically reroutes VoIP traffic to a different path within milliseconds, without human intervention.
The Single-Pane-of-Glass Management Advantage
A primary visibility enhancement leveraging SD-WAN is the reduction of management silos; deployment to an integrated platform. Network administrators of traditional multi-site WANs must typically manage an isolated tool for routing, another to monitor performance, a separate security solution, and yet another for ensuring that the application is running well with each solution contributing its own data model, alert system, and operational workflow.
SD-WAN condenses this down to a single management console with live monitoring across all locations, such as links as well as application flows at the same time. Administrators can then notice what applications are running at each physical location, how each link is performing against pre-defined thresholds, all the policies that are active and where degeneration is occurring all from a single interface without the need to hop around between different tools.
That consolidation has immediate operational implications. Mean time to resolution for network performance issues is reduced because the information necessary to diagnose a problem is at your fingertips contextually. Because real application consumption data within the network is used rather than performing capacity planning based on sampled or other aggregate metrics, you can achieve much higher accuracy here.
Role of Application Visibility in QoS and Policy Governance
In a traditional WAN environment, quality of service is usually implemented using differentiated services code point markings applied at the edge, a crude approach requiring applications to be correctly tagged and precise treatment at each hop in the network path. Real-world QoS configurations had problems such as inconsistent implementation, impracticability in auditing, and difficulty in adaptation for changes in application portfolios.
With SD-WAN, QoS policy pivots from a per-device configuration problem to app-aware governance that is centrally defined. On the other hand, because SD-WAN systems continuously recognize application traffic in real time and their QoS policies are based on what that traffic is (not simply how it gets tagged), they provide a more detailed per-application Traffic Management (QoM) treatment. An application can be newly introduced in the policy definition from a single point and automatically replicated across the network.
The challenge of understanding application performance in distributed, cloud-adjacent environments and the operational tools needed to meet it is examined in the application performance management overview published by InformationWeek, which traces the evolution of APM from on-premises diagnostics toward the real-time, distributed visibility requirements that SD-WAN architectures are now designed to address.
SaaS and Cloud Application Performance Visibility
Most of the business applications that have become most important to overall productivity today are treated as SaaS – they reside completely outside the enterprise network (and are accessed through the Web via public internet). Legacy WAN architectures were not built to accommodate this traffic paradigm and their monitoring tooling frequently highlighted gaps or offered no visibility into the performance of SaaS applications as experienced from the branch.
The answer to that is SD-WAN with its SaaS visibility and optimization capabilities. Edge devices can monitor the performance to all the major SaaS endpoints (productivity platforms, CRM, collaboration tools etc.) and choose best internet breakout paths based on real-time performance to those destinations You can route traffic to SaaS businesses directly over the internet all the way into their nearest cloud point of presence instead of backhauling it all the way through a central DC, which improves both latency and reliability.
This is what makes SD-WAN such a compelling technology at a time when cloud adoption has outstripped the WAN architecture that was designed to support it, which is just about any enterprise environment you can think of.
Frequently Asked Questions
How SD-WAN Recognizes Application Traffic without Using Port Numbers.
Through deep packet inspection, SD-WAN looks at the contents of packets and how they behave, going beyond Layer 4 headers. Last but not least, most modern applications do not make use of fixed ports and well-known port numbers, which means that it becomes impossible to identify encrypted traffic by simply performing a payload inspection. To solve this, SD-WAN platforms are implementing application-aware analysis, typically by combining DPI signatures, flow behavioral analysis and application-specific fingerprinting to amend (classic port-based) traffic classification.
If the preferred WAN path is down, how is application traffic handled?
SD-WAN keeps track of the performance of all available paths, continuously monitoring for changes and maintaining live data on the experience users have with each. The system detects when a preferred path degrades under the threshold established in the application policy, or fails and can automatically reroute all impacted traffic from that application to the next-best available path based on the current network state. This failover is handled in milliseconds for most implementations, allowing active connections to continue without manual administrator intervention.
SD-WAN Visibility: Can You See The Encrypted SaaS Application Traffic?
SD-WAN platforms solve for encrypted traffic visibility through a suite of solutions. For traffic that cannot be inspected in the payload due to encryption, application identification is based on properties of connections (connection metadata), server name indication from TLS handshakes, IP address and DNS resolution data gathered against various known SaaS endpoints, and behavioral flow signatures. Most SD-WAN platforms keep up-to-date databases of SaaS application fingerprints so that they can classify the applications even without decrypting the content of the traffic.
