Hybrid WAN Deployment Architecture

Figure 1 shows a simple diagram of the Hybrid WAN solution. The cloud represents the service provider network to which the customer site is connected.

Figure 1: Hybrid WAN Solution

As mentioned previously, the Hybrid WAN deployment makes use of on-premises CPE devices in order to localize the delivery of network services and provide gateway router functionality. In this case, the Juniper Networks NFX Series or SRX Series devices act as the CPE devices.

In the case of an NFX Series device acting as the CPE, the gateway router function is provided by a built-in vSRX VNF and network services are hosted and provided from within an NFX device that is located at the customer site. This makes the network services extremely responsive from the point of view of the customer LAN, while negating the need for customer traffic to traverse the WAN in order to access the services.

In the case of an SRX Series device as the managed CPE device, only services native to the SRX (such as firewall, NAT, and UTM) can be provisioned and managed at the customer site by CSO. Other services(such as WAN optimization) must be provisioned and managed separately from the SRX and cannot be managed by CSO.

In addition to the CPE devices, the Hybrid WAN solution also makes use of a provider edge (PE) router in the service provider cloud. The PE router terminates IPSec tunnels and provides policy-based access to the service provider’s MPLS network. The PE and CPE devices communicate over one or more WAN links and make use of MPLS/GRE or IPSec tunnels for secure transport. Supported device types for a Hybrid WAN deployment and required software versions are shown in Table 1.

Selection of services, and some service management capabilities can be allocated to the customer by the service provider using the CSO Administration Portal. The customer would then access the allowed services and management capabilities by using the Customer Portal.

CSO manages the lifecycle of the VNFs hosted on the NFX CPE devices from creation in Network Designer, through instantiation, deployment, and finally through replacement or retirement.