Enhanced security – Understanding Network and Security for Near-Edge Computing

SD-WAN provides built-in security features, such as end-to-end encryption and segmentation, to protect sensitive data as it traverses the network.

Optimizing ingress with global server load balancing (GSLB)

Consider the situation shown in Figure 2.8:

Figure 2.8 – A geographically distributed application

This application has a server on the west coast of the US, and another one on the east coast. How do we make sure Source 1 in Seattle goes to Server 1 in Los Angeles while Source 2 in NYC goes to Server 2 in Atlanta? The simplest answer would be to tell Customer 1 to go to server1.myapp.io and tell Customer 2 to go to server2.myapp.io. That might work for a handful of customers:

Figure 2.9 – GSLB

Realistically, though, we probably want a single address of myapp.io. How do we make it so both customers automatically get routed to the server that is geographically closest to them? Historically, there have been two main approaches: GSLB and IP Anycast.

GSLB is just DNS with some extra intelligence added. Figure 2.9 shows how it works. The GSLB servers are set as the Name Server (NS) for myapp.io with your DNS registrar. When DNS requests come in, it will use one or more techniques to figure out which IP address to respond with.

Internet Control Message Protocol (ICMP) triangulation

ICMP, informally known as “pinging,” is an error-reporting protocol that’s used by network devices and operating systems to figure out whether a given IP address is reachable, whether it is experiencing packet loss, or how far away it is in terms of latency.

With ICMP triangulation, the IP that issued the DNS request is simultaneously pinged from the data centers where each server is located. Whichever ping response shows the lowest RTT is deemed the closest. This method results in the best performance, but it doesn’t care about where the client truly is physically located, just that it has the least latency.