SD-WAN at Gap Inc. Snehal Patel Network Architect, Gap Inc. Twitter - @SnehalPatel1410 LinkedIn - https://www.linkedin.com/in/snehalpatel1410

Why SD-WAN at Gap Inc.? Reduce Costs!! Lack of Bandwidth and slow time-to-market constraining the business New store provisioning took time. Current T1 services are limited in bandwidth Current model will not scale for rapid delivery of new projects/initiatives Security Initiatives (Segmentation) Evolving threat landscape driving rapid and flexible security model Segmentation becoming hot topic to protect customer data Encrypting all transports Easy Orchestration Rapid provisioning of services due to automation High number of touch points delay simple operational tasks (software upgrades, ACL changes, adding VLANs, etc.) Reduce Costs!!

High Level WAN design before SD-WAN Internet (ISDN/DMVPN) Non-Flagship MPLS Store Routers Store Switches Primary Path 1xT1 Primary Path 2xT1 Backup-broadband Data Center-1 Data Center-2 Multiple Hubs MPLS Router Flagship

How difficult is it to build a DIY IPSEC overlay? How about thousands of tunnels? How about managing PSK on thousands on end points? Each endpoint can have multiple circuits too? OMG….now you have to build multiple tunnels from each end point?

SD-WAN POC: Discovery & Evaluation Multiple vendors were chosen to participate in the POC. There are at least 20 SD-WAN vendors. List available on www.packetpushers.net Prepared a list of technical requirements and key-features that we wanted to test: Fully Routed Secure Overlay with Centralized Policy Management Segmentation for various business initiatives Easy to maintain templates for zero-touch deployments and mass-config changes These translated to four key areas for scoring: Platform Capabilities Security Operations Automation/Management Routing Scale-out PfR QoS … Defacto encryption Automated key mgmt Segmentation RBAC Syslog SNMP API Integration Auditing SW Upgrades Config Templates Policies ZTP

SD-WAN POC: Scorecard Example Platform Capabilities Area ID Test Case Weight (1 to 5) Vendor 1 Vendor 2 Score (1 to 5) Total Score Platform Capabilities A1 BGP 4 5 20 A2 OSPF 3 15 2 6 A3 Transport Agnostic 25 10 Security B1 RBAC B2 Radius/Tacacs 12 8 Sections were weighted to make sure vendors couldn’t just win by dominating one

SD-WAN POC: Results was selected for Gap Inc.’s SD-WAN deployment in stores after an extensive proof-of-concept and evaluation process. Immediate planning and roll-out of >1,200 stores on Viptela 1100+ stores done to date MPLS T1 circuits replaced with Dual-Broadband and/or LTE Head-Ends deployed at two Data Centers to terminate IPsec tunnels Peer with Gap Inc. Data Centers using BGP Capable of carrying multiple segments (VRFs) vEdge 1000 deployed in all stores (2 x vE1000 for Flagship stores) Control components deployed in Viptela Cloud

SD-WAN: Key features for Gap Full routing stack – BGP and OSPF Scalable Routing over the VPN that you can actually see and control via Centralized Policies IKE-less automated encryption and very cool key exchange mechanism Active-Active data paths with Performance Visibility on all paths Network Segmentation and L3VPN on any transport Easy Router Bring-up using Zero Touch Provisioning (ZTP) Operations – easy code upgrades, circuit stats and usage, centralized template configs, policy changes Operations team to leverage Dashboard for simple tasks

SD-WAN: High Level design Internet Data Center - 1 Data Center - 2 Store IPSEC Data tunnels vEdge 1000 vEdge 2000 TLS Control tunnels Viptela Cloud All stores use dual broadband or broadband and LTE circuits Viptela vEdge 1000 is the store router Routing, security, PfR, Segments & Local Exit via centralized policies

SD-WAN: Where are we today?

SD-WAN: Internet as WAN Average Latency Average Latency Average Jitter LTE Secondary Primary LTE Primary Secondary

SD-WAN: Deployment Challenges/Lessons Learned Ensuring true redundancy for circuits is critical to Store’s success Stores with a common DSLAM and/or non-redundant providers can lose both circuits at the same time – Not real HA. Designed around these via LTE circuits at some locations. Found issues with NAT on some circuits. Leadership Buy-in for Flexibility during SD-WAN roll-outs Coach leadership on new operating model. Not your traditional WAN project! Test the new firmware and features in the lab first. Test the interoperability with other network devices and end hosts. LRT guns are a big pain. Leverage centralized provisioning/software upgrades/roll-backs. Train Operations team(s) EARLY! Training curve varies for different groups. Engaging them early and often helps.

Future of SD-WAN @ Gap Inc. Stores project almost finished! Corporate WAN deployment is well underway US Field/Regional offices being deployed on Viptela WAN APAC Corp SD-WAN network being deployed that has 10 sites in 5 APAC countries Using regional mesh capabilities New Stores & Small Corp offices in US standardized on Viptela SD-WAN Europe Stores in progress for 2016

SD-WAN: What we eventually delivered Performance and Agility New stores provisioned rapidly (deploy 25+ night) New circuits in the Stores have 10-15x more bandwidth now and its easier to deploy services that need more bandwidth. Plenty of headroom to scale for new initiatives and projects Security Initiatives Centralized routing and data policy management (ACLs) Segmentation functionality introduced for various functions Encrypted ALL transports with AES-256 Automated & Cost effective Operations Agile operations with centralized management Mass configuration changes and software upgrades are done faster than ever before …All while maintaining the quality and also reducing the Operations cost.

Thank You !!!