1. SD-WAN at Gap Inc. Snehal Patel Network Architect, Gap Inc.
Twitter
LinkedIn -

2. Why SD-WAN at Gap Inc.? Reduce Costs!!
Lack of Bandwidth and slow time-to-market constraining the business
New store provisioning took time.
Current T1 services are limited in bandwidth
Current model will not scale for rapid delivery of new projects/initiatives
Security Initiatives (Segmentation)
Evolving threat landscape driving rapid and flexible security model
Segmentation becoming hot topic to protect customer data
Encrypting all transports
Easy Orchestration
Rapid provisioning of services due to automation
High number of touch points delay simple operational tasks (software upgrades, ACL changes, adding VLANs, etc.)
Reduce Costs!!

3. High Level WAN design before SD-WAN
Internet (ISDN/DMVPN)
Non-Flagship
MPLS
Store Routers
Store Switches
Primary Path 1xT1
Primary Path 2xT1
Backup-broadband
Data
Center-1
Data Center-2
Multiple Hubs
MPLS Router
Flagship

4. How difficult is it to build a DIY IPSEC overlay?
How about thousands of tunnels?
How about managing PSK on thousands on end points?
Each endpoint can have multiple circuits too?
OMG….now you have to build multiple tunnels from each end point?

5. SD-WAN POC: Discovery & Evaluation
Multiple vendors were chosen to participate in the POC.
There are at least 20 SD-WAN vendors. List available on
Prepared a list of technical requirements and key-features that we wanted to test:
Fully Routed Secure Overlay with Centralized Policy Management
Segmentation for various business initiatives
Easy to maintain templates for zero-touch deployments and mass-config changes
These translated to four key areas for scoring:
Platform Capabilities
Security
Operations
Automation/Management
Routing
Scale-out
PfR
QoS …
Defacto encryption
Automated key mgmt
Segmentation
RBAC
Syslog
SNMP
API Integration
Auditing
SW Upgrades
Config Templates
Policies
ZTP

6. SD-WAN POC: Scorecard Example Platform Capabilities
Area ID
Test Case
Weight
(1 to 5)
Vendor 1
Vendor 2
Score (1 to 5)
Total
Score
Platform Capabilities A1
BGP 4 5 20 A2
OSPF 3 15 2 6 A3
Transport Agnostic 25 10
Security B1
RBAC B2
Radius/Tacacs 12 8
Sections were weighted to make sure vendors couldn’t just win by dominating one

7. SD-WAN POC: Results
was selected for Gap Inc.’s SD-WAN deployment in stores after an extensive proof-of-concept and evaluation process.
Immediate planning and roll-out of >1,200 stores on Viptela
1100+ stores done to date
MPLS T1 circuits replaced with Dual-Broadband and/or LTE
Head-Ends deployed at two Data Centers to terminate IPsec tunnels
Peer with Gap Inc. Data Centers using BGP
Capable of carrying multiple segments (VRFs)
vEdge 1000 deployed in all stores (2 x vE1000 for Flagship stores)
Control components deployed in Viptela Cloud

8. SD-WAN: Key features for Gap
Full routing stack – BGP and OSPF
Scalable Routing over the VPN that you can actually see and control via Centralized Policies
IKE-less automated encryption and very cool key exchange mechanism
Active-Active data paths with Performance Visibility on all paths
Network Segmentation and L3VPN on any transport
Easy Router Bring-up using Zero Touch Provisioning (ZTP)
Operations – easy code upgrades, circuit stats and usage, centralized template configs, policy changes
Operations team to leverage Dashboard for simple tasks

9. SD-WAN: High Level design
Internet
Data Center - 1
Data Center - 2
Store
IPSEC Data tunnels
vEdge 1000
vEdge 2000
TLS Control tunnels
Viptela Cloud
All stores use dual broadband or broadband and LTE circuits
Viptela vEdge 1000 is the store router
Routing, security, PfR, Segments & Local Exit via centralized policies

10. SD-WAN: Where are we today?

11. SD-WAN: Internet as WAN
Average Latency
Average Latency
Average Jitter
LTE
Secondary
Primary
LTE
Primary
Secondary

12. SD-WAN: Deployment Challenges/Lessons Learned
Ensuring true redundancy for circuits is critical to Store’s success
Stores with a common DSLAM and/or non-redundant providers can lose both circuits at the same time – Not real HA.
Designed around these via LTE circuits at some locations.
Found issues with NAT on some circuits.
Leadership Buy-in for Flexibility during SD-WAN roll-outs
Coach leadership on new operating model. Not your traditional WAN project!
Test the new firmware and features in the lab first.
Test the interoperability with other network devices and end hosts. LRT guns are a big pain.
Leverage centralized provisioning/software upgrades/roll-backs.
Train Operations team(s) EARLY!
Training curve varies for different groups.
Engaging them early and often helps.

13. Future of SD-WAN @ Gap Inc.
Stores project almost finished!
Corporate WAN deployment is well underway
US Field/Regional offices being deployed on Viptela WAN
APAC Corp SD-WAN network being deployed that has 10 sites in 5 APAC countries
Using regional mesh capabilities
New Stores & Small Corp offices in US standardized on Viptela SD-WAN
Europe Stores in progress for 2016

14. SD-WAN: What we eventually delivered
Performance and Agility
New stores provisioned rapidly (deploy 25+ night)
New circuits in the Stores have 10-15x more bandwidth now and its easier to deploy services that need more bandwidth.
Plenty of headroom to scale for new initiatives and projects
Security Initiatives
Centralized routing and data policy management (ACLs)
Segmentation functionality introduced for various functions
Encrypted ALL transports with AES-256
Automated & Cost effective Operations
Agile operations with centralized management
Mass configuration changes and software upgrades are done faster than ever before
…All while maintaining the quality and also reducing the Operations cost.

15. Thank You !!!