White Paper A hybrid cloud blueprint with Citrix SD-WAN for Microsoft Azure Citrix | A Hybrid Cloud Blueprint with Citrix SD-WAN for Microsoft Azure 2 Where the apps go, This guide explores four cloud migration stages designed to match an organization’s network and networks follow application requirements. It also looks at the benefits For decades, business-critical applications have provided by Citrix SD-WAN in terms of application resided in data centers – and for good reason: IT experience, security, and cloud on-ramp automation. had operational control for management, scale, and security. With the proliferation of cloud services as a viable alternative to on-premises computing, Scenario #1: the location of applications has taken a dramatic shift. Optimize the WAN for virtual 451 Research cites that 70% of enterprises are utilizing SaaS applications and that more than and legacy apps hosted in 32% are using a form of private cloud, IaaS, or PaaS.1 an on-prem data center Both virtual and legacy apps are used in many SD-WAN eases the transition to industries and their WAN networks are typically built in a hub-spoke model with legacy IP routers at the cloud the branches accessing applications in the private As organizations migrate their application workloads data center. This is most often architected with one to the cloud, the network needs to undergo a shift to active MPLS connection and an IPsec VPN connection align with this new paradigm. This means extending operating in standby mode. into public cloud environments, which could be any combination of IaaS, PaaS, or SaaS. Further, Challenges: organizations are leveraging the best of both worlds: data center connectivity combined with cloud • MPLS comes with a high monthly cost, is inflexible connectivity in the form of hybrid cloud. from a provisioning perspective, and bounds customers to lengthy contractual terms. This is where SD-WAN can help. A software-defined • Since MPLS does not allow for customer control wide area network (SD-WAN) is defined as a virtual over the network, poor user experience can result WAN architecture in which the control of network especially for latency-sensitive applications such as connections, application flows, policies, security voice, video, and virtual desktops. mechanisms and general administration is separated • Bandwidth on the standby link cannot be utilized from the underlying hardware. Everything is managed until failover occurs and cannot be combined with the via software on centralized consoles instead of at each primary link. physical location on individual edge devices • IT lacks control over infrastructure at each branch and infrastructures. increasing complexity and costs. SD-WAN leverages multiple connections (broadband internet, MPLS, 4G/LTE, satellite) to provide resiliency Solution: and performance. One of the unique SD-WAN attributes is the ability to identify and precisely steer traffic • Deploy Citrix SD-WAN in the data center and branches directly to the resources in data center or cloud as an overlay to the underlay physical network. environments. SD-WAN can provide cloud on-ramps • Use Citrix SD-WAN to bond up to 8 MPLS and/or so organizations can quickly connect branches and broadband links into a single virtual network with locations to applications running on public cloud all links active with sub-second failover in case of environments such as Microsoft Azure. blackout or brownout of a link. 1. Voice of the Enterprise: Cloud, Hosting and Managed Services, 2019 Citrix | A Hybrid Cloud Blueprint with Citrix SD-WAN for Microsoft Azure 3 • Automatically detect over 4,500 unique applications Scenario #2: and apply policies and optimizations that are configurable. Prioritize latency-sensitive traffic Extend the wan to optimize any streams such as voice and multimedia. workload in Microsoft Azure • Utilize bandwidth from all available links for better efficiency and increased traffic throughput. Organizations are migrating applications to the public cloud to leverage greater elasticity, Citrix SD-WAN Orchestrator’s Zero Touch Deployment self-service provisioning, redundancy, and capability quickly and remotely onboards SD-WAN flexibility through pay-per-use models. To ensure appliances remotely at branches. It also leverage a great application experience after a cloud migration, templates for zone cloning, application and firewall the network has to be extended into environments configuration to further save time. As a single-pane of such as Microsoft Azure. glass management and analytics tool, centrally manage your infrastructure through an informative dashboard and intuitive graphical interfaces. Challenges: • MPLS was not natively architected to connect to the Benefits: cloud. Therefore, customers have to look to services such as Azure ExpressRoute. However like MPLS, • Improve WAN operational costs by leveraging ExpressRoute is also expensive particularly because lower-cost broadband connections (Internet, cable, egress data charges occur on a metered basis and it is 4G/LTE and satellite). These connections can either subject to lengthy provisioning times. replace or augment MPLS and provide better • For control, security, and compliance reasons, traffic reliability and performance through link bonding and is commonly backhauled from branches to the data load balancing and sub-second failover. center adding more bandwidth on the already strained • Steer the right traffic to the most optimal links for MPLS circuits. The data center then connects to Azure the best possible application experience in branches. via ExpressRoute or the internet which, due to a hairpin Improve critical and real-time application performance effect, adds latency when branch users access through automatic detection and optimization. cloud resources. • Provide the best experience for all applications. • Centrally and easily provision, monitor, and manage the entire network from a cloud service. Figure 1: Citrix SD-WAN Phased Migration Scenarios Host in Private Data Center MPLS & Internet Citrix Virtual Apps & Desktops Transition to Azure Internet Gateway Transit to VNET & Cloud VPX Data Center Branch Migrate to Desktop-as-a-Service Users Citrix SD-WAN Internet Citrix Managed VPX Desktop Citrix | A Hybrid Cloud Blueprint with Citrix SD-WAN for Microsoft Azure 4 • Connecting branch offices directly to Azure today Benefits: involves utilizing manual IPsec VPNs over the public internet which is time consuming, prone to human • Lower cost and greater flexibility compared to error, link congestion and packet loss. A single Azure ExpressRoute. IPsec tunnel from a branch to Azure does not mitigate • Maximum uptime and productivity through highly the risk of outages. available connectivity. • Configuring connections between a large number • Secure and reliable connectivity from branch of branches and SD-WAN instances on Microsoft to Azure. Azure could be time intensive and complex. • Agility through fast onboarding and ease of scale for SD-WAN resources on Azure. Solution: • Deploy Citrix SD-WAN as a virtual instance on Microsoft Scenario #3: Azure to avoid the complexities and costs associated with using Azure ExpressRoute. SD-WAN seamlessly Migrate Citrix virtual apps and extends enterprise networks to the public cloud. desktops to Microsoft Azure • Avoid data center backhaul by directly and automatically connecting branches directly to In the next phase of the hybrid-cloud implementation, virtual SD-WAN instances on Azure VNets. organizations are looking to migrate their virtual • Establish secure, reliable connections between workloads to Azure. Organizations can do this with branches and Azure VNets, leveraging SD-WAN their on-premises Citrix Virtual Apps and Desktops capabilities including: link bonding and load balancing, deployment or with the Citrix Virtual Apps and subsecond failover, selective packet replication, Desktops service (where the management or bi-directional QoS, etc. control plane for a customer deployment is • Citrix SD-WAN Orchestrator provides automated provisioned and managed by Citrix on on-ramps to Microsoft Azure through point-and-click Citrix Cloud). provisioning of SD-WAN VPX instances on new or existing VNets. Figure 2: Citrix SD-WAN enables branch-to-branch connectivity and automated on-ramps to Azure workloads Azure Workload & Applications Internet Internet Citrix SD-WAN VNet Azure Backbone VNet Citrix SD-WAN Azure Networking US Branch US Branch Citrix | A Hybrid Cloud Blueprint with Citrix SD-WAN for Microsoft Azure 5 Challenges: • Use Citrix SD-WAN to optimize Microsoft Office 365 traffic by leveraging APIs and direct local breakout • Running virtual desktops in a data center requires to steer traffic to the closest Office 365 front door significant upfront infrastructure capital and ongoing without backhauling it through Azure. operational costs. • Citrix HDX optimization technology for Microsoft • Productivity can be hampered by a bad experience Teams traffic offloads audio and video processing when the network is not optimized for virtual desktops. as well as screen sharing to the user’s device in the • For a hybrid cloud scenario (applications in the data branch. Then, as the Citrix SD-WAN appliance at center and the cloud), backhauling cloud traffic to an the branch sees the Teams traffic, it identifies and on-prem data center can degrade performance and categorizes it, and then directly steers it to the closest add latency. Office 365 front door. • Additionally, backhauling virtualized Microsoft Office