SDWAN Failover and Bandwidth Aggregation Explained

[@brandoncurrell1465]

Hi Tom. I work for a company in the UK that develops SD-WAN software and provides it as a managed service. This is the first video I’ve seen that nails the architecture, benefits and pitfalls so far. I was especially surprised you mentioned out of order packets, which is an issue we’re developing a fix for in our software stack right now. However, just to note, in our experience, VoIP doesn’t seem too affected by OOO packets, at least over here. Our maximum latency differences are less than 100ms 99% of the time, so I wonder if that has something to do with it, but I think VoIP has some sort of re-ordering built into it already. Our main issue has been with SMB file transfers, which basically covers samba on Linux, or any network share on Windows. We also noticed issues on files served over HTTP/S by a Windows web server. We confirmed it was caused by OOO packets when we loaded our dev software for testing and managed to improve a Windows based HTTP download from ~30Mbps up to the full ~200Mbps we had available.

[@LAWRENCESYSTEMS]

Thanks and that's interesting.

[@LAWRENCESYSTEMS]

@asdrubale bisanzio it does use UDP but in regards to the fail over the call still drops when there is not a SDWAN solution because of the NAT ports initiated for the call have to be recreated on the other interface.

[@pepeshopping]

@asdrubale bisanzio Finally, somebody that does know.

[@GiveThanks-54]

I’ve been trying to figure out this dual WAN thing in my lab for a couple days. I’m glad I revisited this video.

[@bw_merlin]

Great video, I had no idea SDWAN had both an onsite and offsite/hosted component, learnt something new.

[@JonMajorCCIE47884]

Just want to take a moment here to say, I run Speedify VPN directly on my VyOS router at home. It seamlessly allows me to aggregate 2x DSL connections and a 4G modem. If a line fails, I don't even notice it, when all lines are active individual flows see the agg. bandwidth (i.e. If I'm downloading/uploading, I'm getting the full bandwidth of all 3 circuits combined). Rock. Solid.

[@devinself2104]

But does Netflix still work or is the traffic flagged as coming from a VPN?

[@JonMajorCCIE47884]

@@devinself2104 they having streaming bypass to help with that, so Netflix doesn't go over the tunnel. It worked fine enough

[@ChrisNicholson]

@@JonMajorCCIE47884 blocked access to several sites thou. Charles Schwab, JC Penney, and other misc. Have to have the bypass button ready or add domains in the CLI.

[@JonMajorCCIE47884]

@@ChrisNicholson they do have a cli domain bypass I thought? But you're totally right, while it has its benefits, it needs a fair bit of tweaking lol.

[@ChrisNicholson]

@@JonMajorCCIE47884 I purchased the dedicated server option to try to avoid this sort of thing. Too bad it geolocates to Canada and breaks even more stuff. Found a public Server in Jersey that "more things work" on it rather than the paid for dedicated server.

[@RobbyPedrica]

Link aggregation and failover are sub parts of sdwan but a solution with aggr and failover is not necessarily an sdwan solution. Sdwan incorporates a lot more than just aggr and failover eg. Underlay/overlay, application steering, link quality monitoring, session persistence, etc. What you discuss here is oversimplified and more akin to simple aggr and failover.

[@eddieguinn2445]

Thank you for all the information and steady content!

[@nathanielswanson5730]

Thanks for your videos! I'm currently working on implementing flexiWAN which is an opensource SD WAN solution.

[@bleeb1347]

You can do perfect load balancing with Silverpeak as long as you are smart enough to deploy BGP or OSPF in your network. You’re never going to get true load balancing with static routing. We do BGP on the WAN interfaces to L3 switch stack interfaces, and do OSPF on the LAN interfaces from the L3 switch stack to the Silverpeaks. It would make more sense if I drew it for you, but it’s pretty simple. We’re POCing a SASE solution to replace SSL-VPN, SDWAN and Zscaler right now, and most SASE solutions give you much better aggregation and load balancing, without having to think about app control based egress or just failover.

[@joshsmith4998]

Thanks for the explanation! Always love watching and learning from your vids.

[@ravneillal]

Hi, Im using a TP-Link TL-R470T for over 5 years now to wan bond connections at my home. I have 2 dsl and 2 lte services. I get combined speeds of all 4 connections at any given time, if a isp connection drops i dont notice it at all. Everything is seamless. I just had to create a policy in the router to instruct source ip's to go over all the wan ports and thats all. Im not using any VPS either free or paid to have this. This router supports WAN bonding natively out of the box.

[@LAWRENCESYSTEMS]

Load balancing and bonding are not the same thing.

[@AfifAhmad]

Can you please do a video on BGP?

[@allynonderdonk7577]

I'm not heavily into the pros and cons of the subject, but I have used Pfsense and Carp to great effect. It does much the same as what your were talking about.

[@AIONizandoCR]

But pfsense can't keep the sessions when the public IP address changes, and that will happen, if you have two different internet connections

[@allynonderdonk7577]

@@AIONizandoCR True. Typically other than a voice call most would establish a new session quickly enough. In the age of high availability internet connections who wouldn't just call back. The first thing a business does is usually get a call back number. The person on the other end of the phone wouldn't know who hung up the call. It might happen to 1in 10000 or 1 in 100000 calls for large businesses. Though Carp routers are essentially sdwan type appliances which will route information between multiple available servers at multiple locations. Honestly I don't know enough to say if carp would kill a session or not. It just works for me, never had an unrecoverable issue. Basically never had a problem at all. Pfsync manages the sessions and for me hasn't dropped the ball. Basically it can seamlessly route the traffic flow to a new firewall no problem. So well I don't know if it hasn't worked in actual practice.

[@allynonderdonk7577]

@asdrubale bisanzio No I don't think it does true bonding at all. It is basically failover, but pfsync does a really good job of maintaining connections. In multi wan configurations it does a really good job on a pfsense router.

[@RyanPetty]

Would be great to see an explanation of how to do this with UniFi.

[@wizdude]

It would be awesome to see this natively supported on the edgerouter. It has been discussed on the forums but there is nothing included as part of the default distribution that permits this. I’m trying not to make the edgerouters I deploy too non-standard. Perhaps if you are interested in this too you could join the Ubiquiti forums and upvote or comment on some of the posts about this.

[@mrhacker99999]

FlexiWAN

[@shubinternet]

I would also like to see a comparison of Speedify versus Peplink versus Silverpeak versus ZeroTier versus other SDWAN solutions you know that integrate with the firewall software you're familiar with.

[@LAWRENCESYSTEMS]

I won't have time to do that anytime soon.

[@shubinternet]

@@LAWRENCESYSTEMS dang. Because that is the type of comparison that seems to be missing in the industry. 😔

[@kylelaker539]

Now i know why wireguard can't fail over seamlessly but untunneled devices does failover. Edit: I have to do full restart or router and manage switch just to make it work on wireguard when wan1 got a packetloss.

[@chucksw1]

My employer has decided to use SilverPeak SDWAN for our remote offices...

[@dr.oliebol]

Excellent choice. Designed quite some SDWAN solutions in the past years and SilverPeak is still my favorite.

[@aandecomputers1]

Awesome work and great explanation 👍 thank you.

[@berndeckenfels]

Sd-wan means use overprovisioning IP to replace MPLS? ,) Maybe one das we get proper MPTCP devices then we can skip the Proxies and service providers.

[@wizdude]

I have customers that have replaced their MPLS services with dual commodity internet providers as part of their private WAN solution. Some of them have been using the Citrix SD-WAN solution. It works really well. I’d be keen to see a really well designed open source solution that provides the same level of functionality.

[@Skipp28TN]

Let me help here. Using voice or video. Use per packet. Not using per session might work. Have a data center need in bound there is 1 to consider.

[@Viettzz]

Nice video man! So where can I order the SDWAN device? and how much is it?

[@viscopaul18]

Just wondering if you could do a review of entry level tp link tl-r605 failover or aggregation(if supported). Cheers mate!

[@greggcollins1821]

Great explanation and illustrations.

[@saibot293]

Good work. More videos like this please.

[@manslayerdbzgt]

Way to go Lawrence you rock

[@berndeckenfels]

Tom :)

[@Max6711]

Hi, what are your thoughts on the OpenSource FlexiWAN? I think they are from Israel.

[@joeltyler3427]

There is Oneweb satellite and others. As well starlink.

[@agbefii8453]

speedfusion from peplink

[@oussamakarem5744]

hello, please can you tell me the name of software used to draw diagram of network architecture, tanks.

[@LeGoog2008]

Sorry wrong link: www.diagrams.net/

[@oussamakarem5744]

thank you ❤️

[@LAWRENCESYSTEMS]

kzbin.info/www/bejne/hmTMlougfpyNic0

[@oussamakarem5744]

@@LAWRENCESYSTEMS thank you 😇✌️

[@JzL]

Excelent explanation

[@FaithMediaChannel]

Thanks again

[@dannythomas7902]

I'm having real problems with pfsense wireguard maybe it need updates

[@Harry_Bl44346]

great explanation!

[@IamKhoramdin]

Thank you

[@thegrizzlytech3416]

What product are you using for the visio like presentation?

[@LAWRENCESYSTEMS]

Diagrams.net kzbin.info/www/bejne/hmTMlougfpyNic0

[@chrismeyers2575]

@@LAWRENCESYSTEMS How do you make your connecting lines move?

[@fooey88]

How are you able to use the exact same WAN IP between 2 different ISPs?

[@LAWRENCESYSTEMS]

That is a feature and SDWAN service can provide

[@MrHector6711]

Hey there what program did you use for creating the diagram?

[@LAWRENCESYSTEMS]

kzbin.info/www/bejne/o6GpYpxvqMt4gJI

[@lolololowbx280]

Netmaker and wiretrustee please

[@wizdude]

These both look like awesome projects, but they both look like mesh network solutions and I can’t see if either of them support multiple WAN connections. Perhaps I am wrong and can’t find it in the documentation. Do you know if either of these projects support multiple WAN connections?

[@AlupMare]

How about BGP between ISP?

[@LAWRENCESYSTEMS]

BGP is a completely different topic.

[@thatLion01]

Does this require special setup on the isp side?

[@LAWRENCESYSTEMS]

Nope, they are just transporting the data to the VPS server of the SDWAN solution.

[@thatLion01]

@@LAWRENCESYSTEMS do you recommend any good sdwan provider?

[@ArthursHD]

Wouldn't it increase latency?

[@LAWRENCESYSTEMS]

Yes, but very very slightly.

[@ChrisNicholson]

@@LAWRENCESYSTEMS kind of depends on the VPS.

[@monamoralisch264]

plz shave nxt time ;) :)

[@pepeshopping]

You CANNOT aggregate bandwidth with multiple uplinks!!! Need to go back and learn how TCP flows work, but in a few words, you can send 2 different streams/flows through the 2 uplinks, but just like LAGG, one stream/flow can only travel one path, not both! Zerotier makes it clear: Traffic distribution and balancing can either be PACKET or FLOW based, where ONLY packet based protocols can be multiplexed among multiple uplinks (i.e. UDP, which is NOT used for most communications). And Nah. If you are gonna go and have to use a VPS, you may as well do it yourself and not rely on their servers? (using VPN and NAT can work around overlapped network addresses easily). Doing this for a customer so they can have any 2 local ISPs but their VPN connectivity to their app provider is done in a VPS host and that way business continuity is assured.

[@LAWRENCESYSTEMS]

You CAN aggregate bandwidth with multiple uplinks when using a SDWAN solution that supports it.🙂

[@ChrisNicholson]

@@LAWRENCESYSTEMS like Speedify. So long as the server you need to connect to, doesn't ban you for using a VPN.