Kaspersky SD-WAN

Hardware and software requirements

The solution includes the following software modules:

• Orchestrator

  Controls the solution infrastructure, functions as an NFV orchestrator (NFVO), and manages network services and distributed VNFMs. Can be managed via the web interface or REST API when using external northbound systems.

  , which is part of the backend of the solution.
• Orchestrator web interface, which is part of the frontend of the solution.
• Orchestrator database (MongoDB version 5.0.7).
• VNFM

  Manages the lifecycle of virtual network functions using SSH, Ansible playbooks, scripts, and Cloud-init attributes.

  .
• NGINX web server for balancing HTTP and HTTPS requests to VNFMs and providing web proxies to CPE devices and VNFs.
• Redis 6.2.7 resident database.
• SD-WAN Controller

  Centrally manages the overlay network and network devices in accordance with the service chain topology via the OpenFlow protocol. Deployed as a virtual or physical network function.

  .

Modules are deployed as Docker containers for stand-alone installation and scaling. If necessary, you can provision additional resources (CPU cores, RAM) to each module and distribute them among multiple servers to increase the overall performance of the solution.

Kaspersky SD-WAN components can be deployed on multiple physical servers or virtual machines (VMs). KVM and VMware virtualization platforms are supported. You must ensure the availability of servers or virtual machines for installing Kaspersky SD-WAN, an external Zabbix 5.0.26 monitoring system, and an SD-WAN Controller.

The controller can be deployed in two ways:

• As a VNF in the OpenStack cloud platform (Xena release). Controller nodes are hosted on compute nodes.
• As a
  PNF

  Pre-deployed ready-to-use network functions that are uploaded to the orchestrator web interface. The orchestrator can then handle additional configuration of the PNF.

  on separate virtual machines.

Before deploying Kaspersky SD-WAN, make sure that your network infrastructure meets the following hardware and software requirements.

Hardware requirements

Hardware requirements are listed in the following tables. Note that these requirements depend on the number of managed CPE devices used in the SD-WAN instance. The tables provide typical values, so if you need to calculate the exact requirements for your deployment scheme, please contact Kaspersky technical support.

Hardware requirements for servers or virtual machines for orchestrator deployment

Hardware requirements for servers or virtual machines for deployment of other components of the solution

If you need to connect more than 250 CPE devices, deploy additional SD-WAN Controller clusters.

For detailed information about the hardware requirements of the Zabbix monitoring system, see the official documentation of the Zabbix solution.

When deploying the solution, an offline map is configured. Consider the following disk space requirements:

• The offline map (central-fed-district-latest.osm.pbf) takes up approximately 100 GB.
• Geocoding data takes up approximately 10 GB.

We recommend considering the possibility of overcommitment at the resource planning stage for your SD-WAN instance deployment. The maximum overcommitment ratio available when deploying containers is 3. The ratio is determined by the following characteristics of the SD-WAN instance:

• Number of CPE devices in use
• Frequency of network state changes
• Traffic bandwidth
• Size of transmitted traffic packets

Channel requirements

The following channels are supported:

• MPLS transport networks
• Broadband links for connecting to the Internet
• Leased communication lines
• Wireless connections including 3G, 4G, LTE, and 5G
• Satellite communication channels

Software requirements

Docker 1.5 or later is required. The following 64-bit operating systems are supported:

• Ubuntu 20 LTS or later
• Astra Linux 1.7 or later (security level: "Orel").

Supported browsers

You can use the following browsers to manage the orchestrator web interface:

• Google Chrome 100 or later
• Firefox 100 or later
• Microsoft Edge 100 or later
• Opera 90 or later
• Safari 15 or later

CPE device requirements

Kaspersky SD-WAN supports the following devices:

• KESR-M1-R-5G-2L-W
• KESR-M2-K-5G-1L-W
• KESR-M2-K-5G-1S
• KESR-M3-K-4G-4S
• KESR-M4-K-2X-1CPU
• KESR-M4-K-8G-4X-1CPU
• KESR-M5-K-8G-4X-2CPU
• KESR-M5-K-8X-2CPU

Kaspersky experts carried out tests to confirm the functionality of CPE devices when providing the L3 VPN service (see the table below). DPI (Deep Packet Inspection) was not used on the tested devices, and traffic encryption was disabled.

Tested CPE device models (L3 VPN Service)

For more details about the specifications of CPE devices that you can use in Kaspersky SD-WAN, see the website of the solution.