SD-WAN Policy Filtering for Secure Mobile Device Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional WAN architectures are limited in bandwidth, security, and complexity management, hindering business productivity as businesses become more mobile and rely on Internet-based cloud applications.
Innovation Solution
A system and method for distributing software-defined networking (SD-WAN) policies to mobile devices, involving a router that filters and communicates device-specific policies based on device information, using VRF enterprise IPsec and SSL/TLS gateways to extend SD-WAN capabilities to mobile devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional WAN architectures are used with dedicated MPLS circuits, then security protection and reliable connectivity are improved, but bandwidth availability and complexity management deteriorate
Solution Approach 1:
An SD-WAN controller is introduced as an intermediary component that centralizes policy management and distributes policies to multiple routers and mobile devices. This mediator handles the complexity of managing security and connectivity across diverse network paths (MPLS, Internet, cellular), allowing individual network elements to operate with simpler local policies while maintaining enterprise-wide security and reliability through centralized coordination.
2Reliability
If traditional WAN architectures are used, then dedicated circuit security is improved, but bandwidth and adaptability to mobile devices deteriorate
Solution Approach 1:
The SD-WAN system creates a universal policy framework that functions across multiple device types and network interfaces. The controller distributes adaptive policies that can be applied to traditional MPLS circuits, Internet connections, cellular networks, and mobile devices alike. This multi-functional approach allows the same security and connectivity management system to serve diverse platforms including enterprise routers, access points, and mobile smartphones, enhancing both security and adaptability simultaneously.
3Adaptability or versatility
If SD-WAN policies are distributed to mobile devices, then adaptability and bandwidth are improved, but policy management complexity increases
Solution Approach 1:
The system extracts policy management functionality from individual mobile devices and routers, centralizing it in the SD-WAN controller. The controller receives policy definitions, processes them, and distributes appropriate policy subsets to each network element based on its capabilities and requirements. This extraction eliminates the need for each device to independently manage complex policy logic, reducing local complexity while enabling broad adaptability through centralized policy distribution.
4Reliability
If dedicated MPLS circuits are used, then security is improved, but bandwidth availability and productivity deteriorate
Solution Approach 1:
The SD-WAN system implements dynamic policy distribution that adapts to real-time network conditions and device requirements. Policies are not static but can be updated and redistributed by the controller based on changing bandwidth availability, security requirements, and device states. This dynamic approach allows the system to optimize bandwidth utilization across MPLS circuits, Internet connections, and cellular networks while maintaining appropriate security controls, thereby improving productivity without sacrificing security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In one embodiment, a router includes one or more processors and one or more computer-readable non-transitory storage media coupled to the one or more processors. The one or more computer-readable non-transitory storage media include instructions that, when executed by the one or more processors, cause the router to perform operations including receiving software-defined networking in a wide area network (SD-WAN) policies from a component of an SD-WAN network. The operations also include establishing a session with a mobile device and receiving information associated with the mobile device in response to establishing the session with the mobile device. The operations further include filtering the SD-WAN policies based on the information associated with the mobile device to generate SD-WAN device-specific policies and communicating the SD-WAN device-specific policies to the mobile device.