Architecture of the solution

Kaspersky SD-WAN includes the following components:

• The Orchestrator provides a graphical web interface for managing the infrastructure of the solution, including CPE devices. Note that the orchestrator can manage multiple SD-WAN instances.
• The SD-WAN Controller centrally manages CPE devices via the OpenFlow protocol, as well as the overlay network, on top of which you can create transport services.
• CPE devices form an SDN fabric in the form of an overlay network. CPE devices can be assigned the SD-WAN gateway role. In this case, links are automatically established from all other devices that are assigned the standard CPE role. If you plan to use SD-WAN gateways in the network topology, we recommend installing them in multiple instances for fault tolerance.
• Virtual Network Function Manager (hereinafter also referred to as VNFM) – Manages the configuration of Virtual Network Functions (VNF) and CPE devices.

All components of the solution are deployed in data centers, with the exception of CPE devices, which are installed on remote locations. If you are deploying an SD-WAN instance using VNF, the following additional components may be included in the solution architecture:

• The SDN controller provides management and configuration of hardware and software switches in the data center. This component is optional.
• The VIM provides management of computational, networking, and storage resources. All of these resources are required for VNF to run.

Kaspersky SD-WAN has a distributed microservice architecture that is deployed as Docker containers (see the figure below). An SD-WAN Controller can comprise a single node or a cluster of three/five nodes. Cluster nodes of the controller are separate virtual machines and can run on different physical servers for fault tolerance.

Architecture of Kaspersky SD-WAN