SASE transformation: lessons learned

OP-ED · 28 JANUARY 2023

By Jérôme Beaufils · Lire en français

After two years supporting its clients through their SASE transformation, SASETY shares a first look back with its clients and its partner Cato Networks.

1. Background

Digital transformation translates into two major phenomena: on the one hand, the massive adoption of infrastructure and applications delivered from the Cloud, and on the other, the explosion of mobility, remote work and remote collaboration needs.

Applications, data and users are now scattered across the globe, on networks and infrastructure that IT teams do not fully control.

Worse still, new ways of working increase the attack surface, as more and more resources are directly exposed to the Internet.

Guaranteeing performance and keeping control of information system security have become a real headache for IT teams.

To try to meet business needs, organisations first multiplied technology products (VPN gateways, SD-WAN, firewalls, acceleration appliances, etc.), generating significant acquisition and maintenance costs, high complexity and little overall visibility.

The result speaks for itself: every day in France, three intrusions into information systems succeed, 35% of them in SMEs and mid-sized companies and 20% in local authorities.

2. The SASE model

To address these performance and security challenges, Gartner introduced the SASE model (Secure Access Service Edge) in 2019.

It relies on a next-generation network and security architecture that allows organisations to securely connect any user to any application, anywhere in the world.

SASE combines, within a single platform running in the Cloud:

Private data transport capabilities
All the necessary security functions: firewall, web gateway, Cloud gateway and control of the data exchanged

Fully unifying these functions in a single platform makes it possible to enforce the company's security policy according to the Zero Trust approach.

Bringing different security functions together in a single integrated service considerably simplifies IT infrastructure, eases its management and removes the costs of buying disparate products separately.

Ultimately, this model improves threat detection and data protection, since security functions are managed by a unified platform.

For all these reasons, the SASE approach is a single building block increasingly valued by IT decision-makers looking for trusted infrastructure to carry out their move to the Cloud.
By 2024, it is estimated that more than 40% of organisations will use the Cloud to transport and secure their data.

3. Cato Networks

From its launch, SASETY chose Cato Networks to deliver SASE services to its clients. A pioneer in implementing the SASE model since its founding in 2015, Cato Networks is today the only player able to deliver transport and security services in a unified way across the entire planet. With a global private network interconnecting nearly a hundred points of presence (PoPs), the Cato Cloud platform offers unique reach to optimise performance and secure organisations' traffic.

Olivier PERICAT, CTO of SASETY

"Whether they are interconnecting their sites or their mobile users with company applications, our clients no longer need to deploy equipment, build complex and costly setups or subscribe to circuits to their Cloud providers. One or two Internet connections per site, for bandwidth aggregation and redundancy, are enough to access all transport and security functions. Cato Networks PoPs are co-located in the carrier-class data centres of the major Cloud providers, offering excellent transit times and throughput."

4. Main use cases

4.1 Cloud access

One of the main use cases is the need for high-performance access to Cloud infrastructure and applications.

Two scenarios are encountered.
The first concerns clients with an MPLS or IP VPN virtual private network whose Internet breakout is concentrated at a single point, in the operator's core network or in one of its data centres.

This type of architecture limits Internet and Cloud access performance because access bandwidth is shared by all traffic. Application classification rules are limited, and priority is generally given to critical internal traffic and telephony. Finally, centralising Internet traffic at a single point leads to significant transit times and requires substantial sizing and availability. Circuits set up to Azure or AWS, for example, optimise access to their services, but they are expensive and do not address every Cloud use case.

The second scenario concerns organisations that have introduced SD-WAN technology on their sites using one or more Internet connections. Local breakout for Cloud applications makes use of the available Internet bandwidth. However, clients cannot control the diversity of Internet operators between the user and Cloud services, and no end-to-end prioritisation or optimisation mechanism can be implemented.

For mobile users and remote workers, Cloud traffic is routed to centralised concentrators, as with IP or MPLS VPN sites, or sent directly over the user's Internet connection, with the same end-to-end performance limitations.

Jérôme BEAUFILS, CEO of SASETY

"By connecting sites and mobile users to the Cato Cloud, our clients' traffic is carried inside the Cato Networks private network with guaranteed performance all the way to the data centres hosting Cloud providers' infrastructure or applications. Traffic can be prioritised by application and by business use case, and security is managed end to end through traffic analysis and identity management."

Anthony GACHET, IT Manager at BAKER TILLY

"Thanks to this technology, we can now benefit from fast and secure Cloud traffic. All employees can work securely on site or on the move with the VPN client. We no longer have to manage data centre infrastructure, as site connections are collected directly in the Cato Networks ring. Last but not least, we now have complete application metrics that let us control the performance of our environments, analyse traffic and even detect problems or attacks."

4.2 International traffic

International companies increasingly need high performance between their sites to meet the production and collaboration needs of their teams.

Until now equipped mainly with MPLS or IP VPN networks, they often face performance problems between sites.

The many French companies operating in China are also constrained by the regulations governing Internet use, which often make corporate applications unusable, especially collaboration tools.

Charles-Frédéric HONG, Head of Infrastructure and Operations at ACRELEC

"Collaboration between our French and Chinese teams on our CAD software was very limited with the MPLS VPN in place. In a few minutes, we set up a pilot with SASETY, which connected our Chinese site and our site in the Paris region to the nearest Cato Networks PoPs, and we were immediately able to exchange our drawings in real time at several tens of Mbps. After this test, we went straight into production."

Nicolas LAGARDERE, Head of Information Systems at MECADAQ

"The Cato Networks global private network allows us to rationalise our distributed infrastructure by centralising it in France while ensuring excellent quality of service for our teams across the Atlantic."

4.3 Mobile access

The explosion of mobility is leading organisations to rethink access to the information system.

Until now, users connected to a VPN concentrator or to a portal of published internal applications, usually centralised, crossing several Internet operators. This way of working, suited to occasional use, proves inadequate for intensive use such as remote work.

Olivier PERICAT

"By connecting dynamically to the nearest Cato Networks PoP through their ZTNA (Zero Trust Network Access) client installed on their computer or smartphone, users enter the Cato Networks global private network as early as possible, and their traffic travels through it to the internal or Cloud application they need. Performance is optimal both for high-bandwidth applications and for latency-sensitive transactional applications."

David ANCELOT, Chief Information Officer at SUPERGROUP

"By choosing this technology, we met the performance needs of our field users while keeping security under control through the granular Zero Trust Network Access approach. Each user only has access to their own applications, even when they are back at the office."

Anthony GACHET

"As the platform is interconnected with our Azure Active Directory (SSO & provisioning), we automatically manage the lifecycle of our user accounts, which saves the teams a lot of time."

In addition, mobile users benefit from the same level of security as on site. Traffic is analysed and logged, and users are protected against intrusion attempts and malware. Application access rights are tied to users (or groups), wherever they are, rather than to IP addresses.

4.4 Secure access to the information system

To deal with the risk of attack, many organisations instinctively multiplied security products. Attacks seen in organisations of every size demonstrate how ineffective this approach is: stacking products increases the complexity of integration and maintenance and multiplies management and analysis interfaces.

The SASE model unifies these cyber defence functions, with unified management and monitoring.

Olivier PERICAT

"Within the Cato Cloud, sites, users and infrastructure are permanently and uniformly protected against intrusions and malware. No deployment is needed, and updates are carried out automatically by Cato Networks on every component of the infrastructure."

David ANCELOT

"Security updates require no action from the teams. Every week we receive the list of new vulnerabilities for which Cato Networks has put protection in place. Even if some may concern our resources, there is no urgency to update them, since we are protected by the platform both from outside and from our other sites. In addition, we have real-time access to all security events, which lets us measure the effectiveness of this protection."

5. The importance of the last mile

The reach of the Points of Presence network is key to capturing traffic as close as possible to the organisation's users and sites and carrying it at high speed through the private network to applications.

With around a hundred points of presence and interconnections with the main national operators, Cato Networks leaves clients free to choose the Internet connections for their sites.

Depending on how critical they are, several connections can be deployed on sites.

Jérôme BEAUFILS

"Most of the time, our clients already have an Internet connection on their sites. When it needs to be made more resilient, we help them select a second connection relying on an infrastructure and Internet transit operator completely separate from the first. This is essential, because incidents do not only affect the local loop. An operator's Internet transit can also be affected by an incident or during maintenance, and in that case the site's overall connectivity can be cut."

Anthony GACHET

"As part of our project, we wanted to give the business more bandwidth by eliminating copper lines. In less than five months with SASETY, we deployed two load-balanced, highly available fibre connections on nearly 60 sites where FTTH was available, and otherwise a combination of fibre and 4G backup."

David ANCELOT

"On our logistics centres, which run around the clock, we combined up to three connections from different operators: a guaranteed fibre, a low-cost FTTH fibre without guarantees, and a 5G backup."

Olivier PERICAT

"Our clients' Internet connections are an integral part of our 24x7 monitoring. Whether they were subscribed through SASETY or locally, the Cato Networks platform identifies any incident or loss of quality, automatically carries out the necessary technical reconfigurations and alerts the operations teams. We manage incident resolution directly with the operators, especially for clients who delegate the operational management of their contracts to us."

6. Implementing the transformation

6.1 Project launch

When starting to study a SASE transformation, organisations seek to address one or more of the following challenges:

Solving network performance problems
Improving traffic visibility
Becoming more agile in implementing changes and opening new sites
Gaining better control of security
Reducing costs

To make this transformation possible, they take advantage of one of the following opportunities:

Renewal of an operator contract
Network or security refresh
A business project, for example deploying a Cloud application that requires rethinking transport and security infrastructure

The first step of the study is to establish a view of the technical, contractual and financial scope of the existing infrastructure.

6.2 Transformation path

Precise knowledge of the existing setup makes it possible to build a 1 to 3-year transformation path that meets the key functional and financial success factors.

6.2.1 Defining the path

Olivier PERICAT

"Every project is unique. Some clients take advantage of the end of their WAN contract to deploy the first SD-WAN building block and the security of Internet and inter-site traffic. They then gradually switch over security functions in step with the lifecycle of their existing products.

For others, the project starts from mobility or SSE (Security Service Edge) services such as firewall, proxy, IPS, anti-malware, or CASB and DLP to manage Cloud applications and control the nature of the data exchanged. In this case, we deliver the services using their existing WAN infrastructure, which we connect to the Cato Cloud. Then, as WAN commitments come to an end, we switch each site over to the Cato Cloud and roll out SD-WAN features."

This fine-grained approach to transformation spares SASETY's clients from paying for two platforms at once, while guaranteeing a migration with no impact on production.

6.2.2 Hybrid operation and migration

Every project starts with setting up a pivot site, usually the data centre through which the organisation's main traffic flows. This hybrid setup allows the two worlds to coexist, to deliver SSE services or migrate each site to SASE SD-WAN step by step. A migrated site then benefits from all the services delivered by the Cato Cloud and reaches hosted infrastructure and the organisation's other sites through the pivot site. Once all sites have been switched over to the Cato Cloud, the original infrastructure can be fully decommissioned.

Nicolas LAGARDERE

"With SASETY, we organised the deployment of new Internet connections, the use of existing ones and the switchover of each site to the Cato Cloud, so as to keep migration costs to a minimum while securing the rollout to avoid any impact on our production."

7. Observed benefits

The SASE model is increasingly the target chosen by IT decision-makers to unify the transport and security of their traffic, gain agility as they evolve and simplify operations.

After a few months, our clients see the following main benefits.

7.1 User satisfaction

Better performance of business applications, combined with better handling of requests, contributes to user satisfaction.

Providing Internet access over high-speed, low-cost fibre (a few tens of euros for 1 Gbps FTTH), combined with connection aggregation and guaranteed transport within the Cato Networks private network, dramatically boosts the performance of user traffic on site and on the move.

Complete metrics on connections and traffic also make it possible to provide very effective support.

7.2 Resilience

Automatic connection redundancy, combined with the Cato Cloud's 99.999% monthly availability, ensures very high availability of access to the information system.

In addition, the defence mechanisms and their automatic updates reduce threat exposure by 95%.

7.3 Operational gains

The Cato Cloud platform provides the features that allow operations teams to reduce their workload by 60% on average:

Zero Touch Provisioning makes it possible to deploy a site with an Internet connection in under thirty minutes
Metrics and the logging of traffic metadata cut incident handling time by 70%

Combined with cost reductions on legacy infrastructure, clients improve their overall TCO by around 25%.

Jérôme BEAUFILS

"The managed services model delivered by SASETY lets our clients adjust, on demand, the level of support they need to deploy and operate their SASE services and Internet connections. We also carry out continuous monitoring of the market to bring in new features and identify telecom developments likely to add capacity or reduce costs."

Anthony GACHET

"We value our collaboration with SASETY, who carried out our project in the best possible conditions. Beyond the technical side, their proximity and commitment are at the root of this transformation's success.

We now have infrastructure suited to our growth strategy and a real decision-support tool to analyse, prioritise and manage our application traffic."

8. The Cato Networks – SASETY partnership

Started in 2021, the partnership between Cato Networks and SASETY is based on shared expertise and strong complementarity, making SASETY one of its very first French partners.

Combined with Cato Networks technology, SASETY brings its clients:

Recognised expertise in networks and security
Complete operator coverage to deliver the best bandwidth, SLAs and resilience at the best price
The ability to integrate existing Internet connections into the platform and operate them
A proven methodology ensuring a controlled migration and a commitment to results
Tailored, day-to-day support from a team of certified experts
Operations and managed services tailored to each organisation
Strong end-to-end SLAs: from access to SD-WAN/SASE performance

Christophe LOPEZ-CASTEL, South EMEA Channel Manager, Cato Networks

"SASETY is at the heart and the forefront of the channel strategy in France, with around ten Cato Networks clients managed by their teams.

SASETY is one of the very few MSP partners accredited CDSP (the highest level of certification at Cato Networks) able to act as Network, Cloud & Cybersecurity experts for mid-sized and large companies, in every sector, in France and internationally.

The alignment of our strategies and of our vision of how network and security architectures are evolving towards the SASE model makes our partnership a very valuable asset for growing our business in France."

Jérôme BEAUFILS, CEO of SASETY

"The Cato Networks offering has no equivalent on the market: it is the most advanced in terms of features and, above all, the only one to offer global reach and to commit contractually to its performance.

With this platform, we can cover all our clients' use cases. We also value the close relationship built with the French and product development teams, which lets us contribute to the platform's evolution based on our clients' feedback.

The flexibility of the platform and of the Cato Networks organisation helps us demonstrate its value during tenders by setting up POCs (Proofs of Concept) very quickly. They allow companies to validate performance and functional scope, as well as the power and simplicity of management."

💡 To see how effective Cato Networks really is, nothing beats a demo!

Book a demo →