Traffic flows

Corporate traffic (site-to-site) never leaves organization boundaries. It can be spoke-to-spoke, spoke-to-hub (when there are workloads behind the hub), or—rarely—hub-to-spoke. This traffic will usually travel via one of the available overlays protected by the IPsec suite. In spoke-to-spoke traffic, the IPsec tunnel will be dynamically built by ADVPN to provide direct communication. In this case, only the first few packets will flow through the hub until an ADVPN shortcut is built.

Direct internet access (DIA) is also known as local breakout, and this traffic leaves organization boundaries directly from the site edge. Usually, it will follow a default route, and there will be no dynamic routing peering involved. Depending on what is available on a particular site, it can use one or more underlay links connecting to the public internet.

Remote internet access (RIA) is also known as remote breakout, and it means that the traffic must be backhauled through the hub (located in a datacenter or on MSSP premises). In that case, the traffic will flow through one of the available overlays toward the hub, similar to the corporate spoke-to-hub traffic. Customer policies can mandate RIA, but they can also be used as a better alternative to DIA for business-critical traffic, for example, when the quality of the local internet access degrades. At the same time, premium MPLS services can guarantee better application performance.

Cloud on-ramp provides optimized access to the workloads running in the cloud. Rather than accessing the cloud services through the public internet, an overlay can be established to the closest cloud POP in the area. Cloud providers offer optimized access using their built-in gateways, but deploying FortiGate VMs in the cloud is also possible. Cloud on-ramp connections can be from a central location (behind the hub) or directly from the spoke sites. From the SD-WAN’s perspective, this type of traffic flow is similar to a corporate spoke-to-hub and RIA since it will leave the site edge through one of the available overlays.

Let us now take a closer look at a typical SD-WAN configuration for this topology. See SD-WAN configuration.