VeloCloud SD WAN & SASE Cybersecurity Solutions

VeloCloud SD WAN and SASE Solution: Comparisons, Review, Benefits, Use Cases, Pros & Cons

Author:Netify Research Team

If you have questions about VeloCloud and how their capability is aligned to your needs, email the Netify research team. UK: uk@netify.co.uk North America: northamerica@netify.com

(Please use the UK email for ROW - Rest of the World - questions or inquiries)

Netify Review

One of VeloCloud by VMware’s key features is that they are one of the only vendors to offer a global network of private SD WAN gateways - ideal for multinational enterprises and companies requiring high performance for access to cloud and SaaS applications and private data centres. Their WAN Edge is hypervisor-capable, allowing clients to chain multiple Virtualised Network Functions (VNFs), removing the need for numerous single-function appliances.

The solution is PCI DSS (Payment Card Industry Data Security Standard) certified - making VeloCloud a strong option for clients in industry verticals such as retail*, financial* and E-commerce. 

VeloCloud is suitable for remote workers as their solution (Workspace ONE) is fully integrated with SASE (see, What is the VeloCloud SASE Security Solution?) and uses the company’s SD WAN gateways. 

However, potential customers should take caution as VeloCloud offers SASE via an OEM agreement with another company. Those looking for a complete solution from a single vendor may not be suitable for this product.

*for more information on solutions for retail and financial industry verticals, please see our sector pages.

About VeloCloud

VeloCloud was founded in 2012 by Sanjay Uppal as a cloud networking company. In 2017, the business was acquired by IT giant VMware (a subsidiary of Dell Technologies) for $449 million. The acquisition allowed VMware (which primarily focused on the deployment and management of Virtual Machine (VMs) -based and container-based applications in hybrid and multi-clouds) to expand its Software-Defined Networking (SDN) product portfolio to include SD WAN. 

As of June 2022, semiconductor and infrastructure software manufacturer, Broadcom is acquiring VMware for a proposed $61 billion. Although this has caused concern for some current VMware clients due to Broadcom’s history of creating changes to their acquisition’s pricing, customer support and product development, VMware’s product and feature set is robust. Therefore it is predicted that Broadcom will keep the company the same.

VeloCloud is headquartered in Palo Alto, California, NA and offers SD WAN and SASE solutions to small, medium and large enterprises.

What is the VeloCloud SD WAN Solution?

VeloCloud’s SD WAN solution stands out as it leverages VMware’s global network of SD WAN gateways and is completely cloud-delivered. These gateways allow the solution to feature a Transport Independent Architecture, offering a choice of any combination of link types (Broadband, MPLS and Cellular, for example). Further, VeloCloud’s cloud-delivered design makes zero-touch deployment easy, with the ability to spin up new locations in minutes with no need for IT staff on-site. 

 The solution is comprised of three main components, which are licensed to be sold as a single software bundle:

• VMware SD WAN Gateways: A network of public gateways is deployed at global cloud data centres, designed to optimize data paths to all applications, branches and data centres.  
• VMware SD WAN Edge: Optimizes the VeloCloud SD WAN service by offering secure and efficient connectivity to private, public and hybrid applications, compute and virtualized services. Application recognition, application and packet steering, performance metrics and end-to-end QoS are also included in the offering, improving network speeds. 
• VMware SD WAN Orchestrator: VeloCloud’s cloud-based management platform. Data flow is orchestrated through their cloud network, alongside centralized and company-wide installation, configuration and real-time monitoring. This method of orchestration enables one-click provisioning of virtual services in the cloud, branch or data centre. 

Configuration-Based Key Features:

• Zero-Touch Deployment: Allows clients to remotely configure network connectivity and cloud-based business and security policies in a new location without needing an IT Team - ideal for expanding businesses or offices in remote areas. 
• Edge Computing and Internet of Things (IoT): Designed to help devices at the edge optimize throughput for the high amounts of data they produce. Devices would usually backhaul the data - however, this consumes both time and bandwidth. VeloCloud offers edge computing, allowing for local processing, meaning only actionable information is transmitted.
• Hybrid Cloud: This provides clients with increased agility for workloads across multi-cloud environments (including public and private clouds). Security and integrity are ensured for components that remain in the data centre whilst clients access vital cloud provider services such as big data analytics. A hybrid cloud provides an efficient and secure solution for enterprises needing to cross multi-cloud platforms. 
• Gateway Federation: This allows SD WAN gateways to be federated into individual networks globally, which connects service providers, enterprise networks, and the cloud. Gateway federation is ideal for a global workforce comprised mainly of remote workers (such as home-based or mobile enterprise workers) as it connects them with multiple network providers, clouds and data centres worldwide. 

Security-Based Key Features:

• Multi-Cloud Strategy (SaaS, PaaS, IaaS): Using a combination of SaaS, PaaS and IaaS multi-cloud allows clients to access each cloud’s unique services. This service is valuable as clients do not have to rely on a single cloud provider, which reduces the risk of localized failure and improves security. 
• SASE: See, What is the VeloCloud SASE Security Solution?

Performance-Based Key Features:

• Traffic Steering Services: Leverages VeloCloud’s cloud-based transport-independent WAN architecture. The independent architecture allows the cloud-based WAN to connect to any combination of MPLS, broadband and 4G LTE. The platform can recognize links automatically and measure bandwidth. Traffic steering services leverage this, as traffic is parsed and steered most economically, following business and security policies. 
• Cellular: VeloCloud can offer its clients the option to prioritize applications over cellular networks. Should bandwidth speeds drop, applications will be diverted over 4G/5G avoiding instances of blackouts and brownouts.

What is the VeloCloud SASE security solution?

VeloCloud offers clients their SASE security solution via an OEM agreement with Menlo Security. The solution provides secure access to applications via their Secure Web Gateway Functionality platform and next-generation firewalling for securing corporate traffic.

The SASE Solution combines cloud security and networking, providing secure access to applications via 150+ global VMware SD WAN Gateways, with IaaS interconnect providing secure access to various cloud providers, including; AWS, Azure, and Google Cloud Platform. Zero Trust Network Access (ZTNA), Secure Web Gateways (SWG), and Cloud Access Security Broker (CASB) functions are also available.

SASE is also available to remote users, as the platform is powered by the VMware Workspace ONE Solution, which is designed to allow those working out of the office to access enterprise applications securely. Workspace ONE is now integrated with SASE, meaning that out-of-office workers can access SASE PoPs remotely.

How does VeloCloud access cloud vendors?

VeloCloud accesses cloud vendors through VMware SD WAN Gateways. Service providers deploy the gateways on-premises or deployed worldwide at cloud data centres. The VeloCloud offering allows for secure global access to the cloud and network services via service insertion.

VeloCloud’s offering is fully integrated with AWS, supports access to Google Cloud and Azure, and is natively built into the VeloCloud solution via an Azure branch IPsec partnership and Integrated Virtual Hub NVA partner. Cloud access supports the enterprise’s ability for dynamic scaling with the flexibility of a network-as-a-service offering.

Does VeloCloud offer WAN acceleration and optimization?

VeloCloud’s Dynamic Multipath Optimization (DMPO) enhances data traffic flow between any SD WAN components dealing with forward data traffic. It also offers application acceleration services and has several key features:

WAN Optimization: 

• Automated Bandwidth Discovery: Establishes DMPO tunnels between SD WAN gateways whilst running bandwidth tests to select the most efficient path to the gateway. The software can bypass network address translation (NAT) and port address translation (PAT) devices.
• Continuous Path Monitoring: Continuously monitors performance metrics (jitter, loss, latency) on each packet travelling between two DMPO endpoints, using active and passive monitoring approaches. DMPO quickly reacts to changes in underlying WAN conditions, further protecting against brownouts and blackouts.
• On-Demand Remediation: Error correction software is deployed when there is a disruption on multiple links or traffic flow cannot be steered onto a better connection.
• Class of Service (CoS) Marking: Manages traffic in a network by grouping similar types of traffic together (such as voice, video, and large documents). Each group is classed with its level of service priority.  
• Policing Traffic Class: Allows IT managers to closely monitor high-priority business collaboration traffic, ensuring that service-provider SLAs are honoured.  

Application Acceleration: 

• Application-Aware Per-Packet Steering: This allows customers to prioritize up to 3,000 applications without impacting data flow. User experience and active flow are protected against blackouts and brownouts as traffic flow is steered away from applications.
• Quality of Service (QoS) Scheduling: VeloCloud allows clients to prioritize applications at different times.
• Multiprotocol Label Switching Class of Service (CoS): Designed for private links with a CoS agreement, as DMPO can take CoS agreements into account in monitoring and application steering decisions. MPLS CoS allows for granular, application-aware decisions for private links with CoS agreements.
• Bandwidth Aggregation: If an application requires more bandwidth, DMPO will perform per-packet load balancing, using available links to deliver all packets of a single flow to a destination. 
• Forward Error Correction (FEC): Corrects errors on real-time applications, such as voice and video flows.  
• Negative Acknowledgment (NACK): Used for transmission control protocol (TCP) applications such as file transfer, DMPO can monitor packet detection and retransmit any missing packets. NACK protects end applications from detecting packet loss.
•  Application-Aware Overlay Quality of Service (QoS): Out of the box, it can create policies based on hundreds of known applications and apply QoS.

How does VeloCloud support remote users?

VeloCloud supports remote users through its VMware Secure Access service, uniting secure access with Workspace ONE. Secure Access uses a zero-trust network access service model, mapping users to individual application policies.

VeloCloud’s cloud-hosted solution is accessed through globally distributed service nodes, significantly reducing latency and hair-pinning. A high level of support is provided for remote users as the solution is part of the SD WAN fabric for consistency and high performance. The Workspace ONE solution uses a unified access gateway-as-a-Service to reduce overheads compared to legacy VPNs and improve scalability. The cloud-hosted service provides congruous policy enforcement across all users.

What Reporting and Management is available via the VeloCloud Portal?

The VMware SD WAN Orchestrator encompasses the VeloCloud portal (see, What is the VeloCloud SD WAN Solution?). The VMware SD WAN Orchestrator provides access to a self-service web portal to configure policies and monitoring. The VMware SD WAN orchestrator is built on API-driven architecture for ease of integration, and the enterprise and service provider portals provided both use granular, role-based access. The VeloCloud portal uses a scalable control pane and provides Network, Application, Host metrics, Quality of Experience score and Diagnostic Application reports. The management and reporting available via the VeloCloud portal allow for more efficient troubleshooting and resolving network issues faster through analyzing network and application performance.

What is the VeloCloud SLA?

Below is a table displaying the main focus points of the VeloCloud Service Level Agreement (SLA).

VMware Secure Access Unavailability and SLA Events (Determined by VMware Monitoring Tools):

VMware Cloud Web Security Unavailability and SLA events (Determined by VMware Monitoring Tools):