AT&T SD WAN & SASE Cybersecurity Solutions

AT&T SD WAN and SASE Solution: Comparisons, Review, Benefits, Use Cases, Pros & Cons

Analyst: Abigail Sturt  Contact: asturt@netify.co.uk 

If you have questions about AT&T and how their capability is aligned to your needs, email the Netify research team. UK: uk@netify.co.uk North America: northamerica@netify.com

(Please use the UK email for ROW - Rest of the World - questions or inquiries)

Netify Review

AT&T’s offering is ideal for both small and large businesses across any industry that require domestic or international multi or single site deployments. A behemoth within the global communications industry, AT&T are a reliable choice with coverage in most areas. However their domestic operations have always taken precedent, providing substantial strength and focus within the U.S. region.

About AT&T SD WAN and SASE security solutions

AT&T was founded in 1983 and is headquartered in Dallas, Texas, United States. The company is not only the largest communications company in the U.S but also the world.  J.D Power 2021 award for customer satisfaction 4 years in a row for large enterprise Wireline Service and two years in a row for Wireline Service for Medium Businesses. The company has the best global coverage of any U.S. wireless provider with calls and texts available in over 225 countries and territories, as well as the largest U.S. based provider of fiber for business. AT&T’s IP broadband network currently covers over 60 million customer locations.

What is the AT&T SD WAN Solution?

AT&T offer managed SD WAN overlay solutions for Cisco, VMware, Silver Peak and Palo Alto. Their solution is designed to be scalable, adapting to business needs with flexible hybrid WAN designs, that allow clients to add multiple firewalls and cloud security options to the service with traffic encryption and decryption. The solution has the capability to integrate with pre-existing network configurations, supporting connections to transport types such as LTE, MPLS and Internet broadband. Zero-touch provisioning means that devices are automatically configured, whilst a centralized management system offers network and application visibility. 

• Silver Peak: AT&T work with Silver Peak to offer clients integration via APIs, rules-based WAN routing and centralized orchestration and management. The solution leverages the EdgeConnect SD WAN Edge platform which can route applications to a chosen site, with end to end orchestration, security features such as service chaining and application performance using top down business policies. This can be deployed either as a virtual instance or as a hardware appliance, with secure connectivity to hybrid, public and private applications. Business overlays and policies are deployed throughout the entire network to automate traffic application routing with self-learning to monitor network status continuously and the Orchestrator which allows clients to segment applications, WAN services and users by defining end to end zones.
• VMware: AT&T offer overlay for VMware that connects sites to cloud applications and data centers, with Deep Packet Inspection (DPI) to recognize business critical application signatures such as Microsoft 365, and Dynamic Multi-path Optimization (DMPO) to steer applications to WAN links based on business policies and link quality. Further, dynamic per packet steering is designed to avoid link degradation with the ability to move a session (such as a voice call) midstream, with real-time remediation to augment latency sensitive applications such as UCaaS, VOIP and VDI. AT&T SD WAN with VMware is transport agnostic, which offers clients connectivity for LTE, MPLS, DIA and broadband underlay, with support for public Internet and private networks. The Orchestrator offers virtual services in the cloud, branch or data centers using one-click provisioning. The solution is deployed using VMware SD WAN Edges which are available as hardware or a virtual instance and provide secure connectivity to compute and virtualised services as well as hybrid, private and public applications
  
• Cisco: SD WAN based on Cisco leverages a cloud-first architecture which is designed to enable clients to connect users to their cloud and applications. The solution integrates security and centralized management for faster connections to the cloud, branch data centers, colocation facilities and campus sites, with WAN optimization for improved performance to multi-cloud environments, with a range of deployment options including hardware and software for on-premises and multi-cloud. AT&T SD WAN based on Cisco also offers embedded cloud security (see, What is the AT&T SASE security solution?). The solution can be deployed physically on branch and campus routers with integrated network services: Cisco ASR 1000 Series, Cisco ISR 1000 Series, Cisco ISR 4000 Series and Cisco vEdge Platforms. Virtual deployment options are also available such as the Cisco ENCS Platforms.
• Palo Alto Networks: AT&T SD WAN based on Palo Alto is cloud-delivered with APIs to simplify network operations, leveraging machine learning for path monitoring to improve connectivity between branch and cloud sites and the ability to implement application defined autonomous SD WAN abilities natively. Integrated security allows campus sites, branch offices and data centers to connect. The solution offers zero-touch provisioning and deployment, with application control for path monitoring for SaaS applications and traffic distribution and error correction by application, with visibility into application performance. AT&T SD WAN based on Palo Alto also includes a full SASE offering with continuous security monitoring and security enforcement (see, What is the AT&T SASE security solution?). The solution includes: Instant-On Network (ION) Devices which are offered in both hardware and software form factors, Bandwidth Subscription Options between 25mbps, 50mbps, 150mbps, 250mbps, 500mbps, 1 G, 2.5 G and Data Center and a Cloud Controller, which is included with the software subscription. 

Configuration-Based Key Features:

• Over the Top (OTT) Model: AT&T SD WAN can be deployed as an OTT model using the AT&T Universal FlexWare Device, a VNF, or with an SD WAN appliance or it can be deployed as transport agnostic, offering an overlay network on any public network such as DIA, 4G or broadband, or any private network such as Ethernet or MPLS VPN.
• Network-Based Model: Network-based models leverage the AT&T FlexWare Device which is a universal Customer Premises Equipment (uCPE) with the capability to run multiple Virtual Network Functions (VNFs) including VeloCloud SD WAN VNF. AT&T’s Software-Defined Networking enabled cloud nodes automatically adjust gateway bandwidth as site bandwidth changes. The solution supports SD WAN and non-SD WAN sites and is available in over 200 countries worldwide

Security-Based Key Features:

• AT&T offer a full SASE security solution - (see, What is the AT&T SASE security solution?).

Performance-Based Key Features:

• FlexWare: AT&T’s global network virtualisation solution, enabling the deployment of network functions in the cloud or on a single device - replacing legacy hardware equipment for each device. The solution leverages Network Function Virtualisation (NFV) and Software-Defined Networking (SDN) to allow clients to deploy and manage virtualised network functions. The solution includes: uCPE to support bandwidth up to 10G, Virtual Network Functions (VNFs) supplied by AT&T vendor partners to support routing, SD WAN, WAN optimization and firewall and carrier agnostic connectivity underlay options such as Internet/Ethernet, MPLS, wireless and fiber (4G, 5G, LTE), switched Ethernet on demand and Dedicated Internet Access (DIA). The solution is available in 200 countries worldwide and is offered as a managed or DIY service.

What is the AT&T SASE security solution?

AT&T’s Secure Access Service Edge (SASE) solution is offered by technology providers overlaid upon managed SD WAN services. The SASE solution is offered as Branch via Fortinet, or standalone via Palo Alto Networks. Please see below for a breakdown of each offering: 

AT&T Branch SASE with Fortinet:

• The AT&T Branch SASE solution is powered by Fortinet and offers branch connectivity through an integrated single box solution. This offering provides proactive AI-informed threat protection and granular network performance analytics. The AT&T/Fortinet solution is managed 24/7for tasks such as: monitoring, SD WAN policy and firewall configuration, deployment and ongoing maintenance. By removing these everyday tasks corporate IT teams are available to focus on more critical operations thereby improving efficiency and employee productivity. This solution can help improve the performance and security of the enterprise network though the combined use of integrated Next Generation Firewalls (NGFW) and SD WAN. 

AT&T SASE with Palo Alto Networks:

• AT&T SD WAN with Palo Alto Networks: For details regarding the Palo Alto SD WAN solution please refer to “Palo Alto Networks” under, What is the AT&T SD WAN Solution?
• AT&T Secure Remote Access: AT&T Remote Access is provisioned by the technology providers, Zscaler and Palo Alto Networks. The AT&T Remote access solution offers features such as: Secure Web Gateway, VPN options, Domain Name System (DNS) security, Zero Trust Network Access (ZTNA), Machine learning-powered threat prevention and Firewall as a Service (FWaaS). The Remote Access solution can be deployed as either a managed or co-managed solution with 24/7 monitoring and help desk support. This solution improves the user experience and network security by ensuring that teleworks are only able to securely access the required applications and resources applicable to their role.
• AT&T Secure Web Gateway: The AT&T Secure Web Gateway is a single pane, cloud based, managed service that offers deep packet inspection of encrypted web traffic and content access restrictions to provide unified protection from web based threats, reporting and visibility into all network locations. The managed service offers 24/7 monitoring from the AT&T Security Network Operations Center. This solution helps to secure teleworkers, ensure compliance with industry regulations and accelerate the migration of corporate resources to the cloud.

AT&T SASE with Cisco:

•  AT&T recently launched a new managed SASE solution based on Cisco. The service offers clients constant management, policy design and configuration and security. Dynamic traffic routing and WAN optimization are also included.

AT&T Managed Threat Detection and Response (MDR):

The AT&T MDR solution is built on the AT&T Unified Security Management (USM) Platform and is powered by AT&T Alien Labs threat intelligence. This solution offers 24/7 monitoring and disruption of advanced threats as well as investigation by AT&T expert SOC analysts. Alien Labs offer continuous and automatic threat intelligence and visibility into the global USM sensor network, AT&T IP backbone and the Open Threat Exchange (OTX). 

Endpoint Security:

 AT&T offer various solutions to secure and manage endpoint devices including: SentinelOne, VMware Workspace One, IBM MaaS360, McAfee Endpoint Protection, MobileIron and Lookout Mobile Endpoint Security.

How does AT&T access cloud vendors?

AT&T offer a range of cloud solutions, which provide secure connectivity to multiple different cloud providers and applications, such as: AWS, Oracle Cloud, DXC Technology, IBM Cloud, BlueJeans, Google Cloud, Azure, VirtuStream, Sunguard Availability Services, Office 365, SalesForce, Box, Cisco Jasper and Cisco. Their main cloud offering is NetBond, for cloud networking solutions, however they also offer a number of cloud consultation services: 

• Cloud Networking for Business: AT&T NetBond for Cloud offers clients secure and scalable cloud connectivity with access to thousands of cloud applications, creating an integrated network with public and private clouds and data centers in a hybrid environment. This direct connection to cloud providers reduces the risk of cybersecurity threats such as Distributed Denial of Service (DDoS) attacks. The solution supports connections to: AWS, Oracle Cloud, DXC Technology, IBM Cloud, BlueJeans, Google Cloud, Azure, VirtuStream, Sunguard Availability Services, Office 365, SalesForce, Box, Cisco Jasper and Cisco. All network implementation and bandwidth location can be simplified using the AT&T web based portal.
• Cloud Consulting Services: AT&T offer expertise to help businesses to migrate to the cloud, potentially reducing costs and helping to identify vulnerable areas in cloud architecture. The solution leverages a team of consultants to create an architecture that aligns with business needs. The service offers support throughout the process, with analysis of current solutions and architecture, research to choose solutions best suited to be included in the design, migration design for public and private clouds with support for the deployment of public, private and hybrid IT models, support for business IT teams with design and deployment of private cloud transformation and support for multi-cloud connectivity to applications hosted in colocations, data centers, the Internet and cloud service providers.
• AT&T Colocation Ecosystem: AT&T’s Colocation Ecosystem offers clients access to over 465 facilities globally, with connections to a centralized location providing connectivity to a business’ cloud service providers, business partners and private compute infrastructure. The service provides support for hybrid architectures including SD WAN, voice, transport, security and mobility, with flexible cloud interconnectivity for premise to head-end, premise to head-end to cloud service providers and premise to head-end and cloud service providers, all with customer support from AT&T’s Client Executives. The solution leverages secure physical locations that offer connectivity to the AT&T global network - all data centers are SSAE/ISAE and ISO certified, with a majority also certified for HIPAA, FISMA, FedRAMP and PCI.
• AT&T Content Delivery Network: The Content Delivery Network includes mobile and web applications which offer improved speeds and cloud-based security features providing protection from threats such as ransomware and malware, including a web application firewall for DDoS attack mitigation and bot management. Clients can also manage use policies for guest Wi-Fi services in business offices, stores or branches.
• AT&T Dynamic Exchange: The AT&T Dynamic Exchange allows businesses and their partners to connect using AT&T Virtual Private Network (VPN) or AT&T Switched Ethernet on Demand, using the AT&T Business Center to provision additional connections to business partners. Clients can use AT&T’s nationwide fiber and wireline network to connect to over a thousand PoPs across the USA, with security for data and connections using MPLS and Ethernet private networks.

Does AT&T offer WAN acceleration and optimization?

AT&T optimize application performance over hybrid or Internet links offering users secure direct access to enterprise and cloud applications. Their WAN optimization offering varies slightly depending on which vendor solution is selected, however it can be provisioned using software, without the need for a hardware appliance:

• VMware: SD WAN based on VMware offers clients Dynamic Multipath Optimization (DMPO) to direct applications to optimal WAN links based on business policies and link quality.
• Cisco: SD WAN based on Cisco utilises WAN optimisation to provide connections to multi-cloud architecture and a predictable user experience for applications. 

How does AT&T support remote users?

AT&T offer secure remote access using their Zero Trust Network Access (ZTNA) solution. ZTNA works to stop malware attacks by reducing access to the network by isolating endpoint devices and only allowing access to data and applications that are required to complete tasks. Outbound connectivity authorizes users access to applications without exposing the network’s IP address. The service can also integrate with VPN to provide improved performance for access to applications with unified visibility. Support for remote workers is delivered via the AT&T Palo Alto Networks solution and Zscaler solution.

What is the AT&T managed, co-managed and DIY services solution? 

AT&T offer managed SD WAN solutions for VMware, Silver Peak, Palo Alto Networks and Cisco. They also offer managed Internet of Things (IoT) services.

What Reporting and Management is available via the AT&T Portal?

Visibility and management of all AT&T services is available via the Business Center online portal. Access to the AT&T Business Center is available online 24//7 for management of all wireline services. The services featured include: support, ordering, ticketing, billing, network map and reporting. AT&T Business Center supports the following products: AT&T Flexware, AT&T NetBond for Cloud, AT&T Switched Ethernet with Network on Demand, AT&T Dedicated Internet, AT&T IP Flexible Reach, AT&T SD WAN Network Based and AT&T VPN. The reporting feature allows users to investigate performance patterns to identify trends whilst the network mapping feature provides 24/7 bandwidth alerts to manage and monitor the company global network.

What is the AT&T SLA?

The Service Level Agreement applicable to AT&T Business Internet Services (Including AT&T Internet for Business, AT&T High Speed Internet Business Edition and FastAccess Business DSL.)