An Introduction To Session

Smart Routing:

128 Technology
by Tommy McNicholas

A Packet Pushers Whitepaper

May 2020
Table of Contents
Key Takeaways: 3
Introduction 4
Session Smart Routing Overview 4
Use Case: SD-WAN 6
Challenge: Tunnel Exhaustion 6
Challenge: Bandwidth / Performance 7
Challenge: Security 7

Session-Centric SD-WAN Solutions 8

Use Case: Internet-of-Things (IoT) 10
IoT Challenges 11
IoT Solution 12
Availability And Performance 13
Security 14

Conclusion 15
About The Author 16
An Introduction To Session Smart Routing Page 3 of 16

Key Takeaways:
• 128 Technology takes a unique approach to routing that centers on session-
based application delivery

• Native security features include payload encryption and zero-trust access

• Session-centric technologies are the key to scaling SD-WAN solutions when

combined with a distributed system capable of acting on every layer of the
conversation

• 128 Technology overcomes fundamental design and scaling limitations of

traditional VPN-based overlays

• 128 Technology does away with tunnels, reducing transport overhead while
improving latency and eliminating complexity, making it ideal for use cases
including SD-WAN and IoT

• Public and private cloud networking solutions have a least-common-

denominator issue when it comes to policy and routing. A software-based
solution allows for uniformity and observability across different networking
implementations

©2020 Packet Pushers Interactive, LLC. All rights reserved

An Introduction To Session Smart Routing Page 4 of 16

Introduction
Software-defined networking (SDN) lets networking professionals build solutions
that are both powerful and scalable. Centralized management abstracts away
configuration, allowing networkers to make changes to multiple devices
simultaneously while avoiding the lack of consistency that plagues hand-curated
networks.

Session Smart™ Routing from 128 Technology brings these SDN principles to a new
approach to networking. Session Smart Routing is a transformational routing
architecture that enables networkers to deliver applications and services simply,
securely, and at scale.

It replaces tunnel-based network overlays and inefficient provisioning systems with

distributed control, intelligent service-based routing, and in-band (data plane)
session-based signaling. Session Smart Routing is fully compatible and
interoperable with existing network protocols and architectures, allowing it to be
gradually introduced into an existing IP network without affecting network
endpoints or hosts.

Session Smart Routing Overview

Session Smart Routing is comprised of two primary components: the 128T Session
Smart Router and the 128T Conductor. The 128T Session Smart Router is a software
router, deployable on bare metal, VMs, containers, and in the public cloud. It
combines a service-centric control plane and a session-aware data plane to offer IP
routing, feature-rich policy management, improved visibility, and proactive
analytics.

The 128T Conductor is a centralized management and policy engine for all the 128T
Session Smart Routers in the network. It provides orchestration, administration,
zero-touch provisioning, monitoring, and analytics for 128T Session Smart Routers –
while maintaining a network-wide, multi-tenant service and policy data model.

©2020 Packet Pushers Interactive, LLC. All rights reserved

An Introduction To Session Smart Routing Page 5 of 16

Together, these components implement what 128 Technology calls Secure Vector
Routing (SVR). SVR attaches metadata to the first ingressed packet in a conversation
to build a session between two 128T Routers. That metadata includes many details,
including the applicable tenant and policies, and is issued to establish the session
on the next router. This allows for path symmetry and efficient distribution of
necessary session tables.

The ingress 128T Router reads this metadata and selects a path for a session based
on SLAs. The metadata is sent only once to each participating hop. Note that
sessions can traverse non-128T routers. These routers will forward packets in a
session to the IP address of the next 128T router. On egress at each hop, the source
and destination addresses are rewritten to allow for complete mobility of the
original packet, regardless of the number of intermediate routers required to reach
the destination.

When the packet reaches the final hop, the original addresses are restored, and the
first return packet in the conversation begins the process of sending metadata in
reverse. Effectively, this allows for full distribution of metadata once per session,
unless path selection intervenes.

With this in mind let’s take a look at couple of proposed models and how those
translate directly to use cases.

©2020 Packet Pushers Interactive, LLC. All rights reserved

An Introduction To Session Smart Routing Page 6 of 16

Use Case: SD-WAN

A traditional SD-WAN unifies multiple transports by building an overlay topology
backed by IPSec tunnels. Simpler solutions have less dynamic path selection, while
more mature offerings use algorithms to spread the load and latency across
different links. While IPSec tunnels provide a degree of privacy in SD-WAN, they also
introduces challenges that session-centric solutions can address.

Challenge: Tunnel Exhaustion

A critical weak point to a tunnel-based solution is tunnel exhaustion, which can be
influenced by whether the SD-WAN model is using hub-and-spoke or mesh
topologies. It is common for SD-WAN networks to begin as a full mesh, and
eventually be forced into a hub and spoke model as a solution grows.

As the number of endpoints begins to climb, so does the number of tunnels that
concentrate at critical hub sites. One or more hubs with redundant Internet
connections, or remote sites implementing multiple tenants, can drastically multiply
the number of required tunnels, as illustrated below:

©2020 Packet Pushers Interactive, LLC. All rights reserved

An Introduction To Session Smart Routing Page 7 of 16

When scaled up to a large number of sites, large tenants will quickly dominate
encryption resources system wide. This can leave little room for smaller tenants
that may be participating in the same physical topology, especially if the model
implements a tunnel per tenant instead of per endpoint, further magnifying the
tunnel count at the hub.

Challenge: Bandwidth / Performance

While tunnel encryption in a typical SD-WAN solution competes for processing
resources on every packet, it also competes for bandwidth on the same physical
links. Some SD-WAN solutions let architects disable encryption over private links,
but the base tunnel overhead remains. Each participating link experiences tunnel
overhead, and scales differently depending on if there are many small flows like
voice traffic, or large flows that come up against fragmentation.

All of these factors bleed bandwidth, resulting in increased latency. While cheap
broadband can overcome the overhead issue, there are still many parts of the
world that rely on slower broadband connections while also being far from cellular
service. As the rate of packets increases on these connections, the tunnel overhead
almost becomes noise that cannot be dropped since the tunnels are carrying critical
or latency-sensitive traffic.

Challenge: Security
Traditional SD-WAN models offer little in the realm of security, which is mostly
hinged on tunnel encryption. As previously mentioned, forcing encryption on every
conversation creates a penalty for applications implementing it at the application
layer, where it belongs.

In most networks, firewalls provide untrusted and trusted zones, but offer little to
no protection within those zones. To compensate for this security gap, architects
are forced to implement hub-and-spoke topologies with WAN aggregation firewalls.
The hub-and-spoke routing creates hairpins between tenants even within a site,
and bandwidth can also be wasted to backhaul traffic that should egress locally.

©2020 Packet Pushers Interactive, LLC. All rights reserved

An Introduction To Session Smart Routing Page 8 of 16

Session-Centric SD-WAN Solutions

Here’s how Session Smart routers address these challenges. Let’s start with tunnel
exhaustion. The figure below is a subset of the previous tunnel exhaustion topology
now enabled with Session Smart routers.

©2020 Packet Pushers Interactive, LLC. All rights reserved

An Introduction To Session Smart Routing Page 9 of 16

The forwarding table looks similar, with source and destination IP addresses being
replaced when traversing other 128T Routers. Fine-grained policies are now used to
encrypt an otherwise insecure data center application, while providing path
resiliency along the path with the best SLA.

Customers can also steer sessions to cloud-based security services such as zScaler.
In the example above, the zScaler plugin steers administrator-defined SaaS
applications to the cloud security service. Meanwhile, non-critical traffic such as
YouTube, which doesn’t require additional security scanning, goes directly to its
destination. This design also pins scalability decisions at the hub against fewer
factors, allowing architects to scale those sites almost purely on throughput sizing.

Regarding performance, SD-WAN models often hinge on implementing broadband

circuits with local Internet breakout. While this does increase overall bandwidth to
an edge site for both Internet access and tunneled application traffic, the
proliferation of SaaS solutions has placed a greater dependency on the availability
and use of Internet circuits in general.

As previously mentioned, in a typical IPSec tunnel, every packet in a session has to

carry the extra header information, no matter the size of the payload. By contrast,
in a Session Smart enabled network, the overhead penalty is paid just once in each
direction with 150-250 bytes of metadata. This preserves compute and bandwidth
resources, which is always welcome, and may be critical for particular applications
and services, or in locations that are bandwidth-constrained.

Security is perhaps the greatest advantage of a Session Smart-enabled network.

Unlike traditional WAN routers, the default policy of a 128T router is to deny all
traffic unless a policy exists for it, and the concept of trusted zones is dropped in
favor of global policies.

This approach, which 128 Technology calls hyper-segmentation, allows for fine-
grained policies to match traffic and to flexibly apply security posture. Hyper-
segmentation is demonstrated in the figure above, where two different user roles

©2020 Packet Pushers Interactive, LLC. All rights reserved

An Introduction To Session Smart Routing Page 10 of 16

both received encryption when their sessions were directed toward a hosted
enterprise application.

The figure also demonstrates dynamic tunneling, in which SaaS-based business

applications are steered through a zScaler tunnel, while avoiding the unnecessary
encryption expense on general Internet traffic such as YouTube.

The 128T Router also enables service chaining. Traffic can be directed to third-party
devices or services, whether physical, virtual, or cloud-hosted. For instance, in the
example below, customers can direct a 128T router to send traffic to virtual
instance of a Palo Alto firewall running on the same physical server as the router, to
a physical appliance, or to a Palo Alto instance running in the cloud.

Use Case: Internet-of-Things (IoT)

IoT is still a relatively new use case for network engineering professionals to
support. IoT connectivity typically comes from modern, cloud-centric applications
deployed onto micro-sized SoC (system-on-a-chip) systems running x86 or ARM
processors. These computing platforms are embedded into any number of

©2020 Packet Pushers Interactive, LLC. All rights reserved

An Introduction To Session Smart Routing Page 11 of 16

machines, appliances, or underlying infrastructure. First-generation hardware had

limited by processor capabilities, power, and connectivity options. Current-
generation SoCs have processing power to spare, embedded encryption
acceleration, and more avenues for reachability in the form of 4G LTE and future
connectivity through 5G LTE and low-orbit satellites.

IoT Challenges
IoT presents interesting challenges to existing networks. For instance, the sheer
volume of new devices attaching to branch and campus networks will typically blow
out existing IPv4 address space. In turn, this causes well-meaning network
engineers to compensate with address translation when the application hasn’t
matured to take advantage of IPv6, assuming the existing infrastructure strategy
has done the same.

IoT applications also create security problems. Not only is the host itself susceptible
to being compromised, but encryption to protect data streams puts pressure on the
low-power processors. While this has improved over time, encryption is still often
left to an upstream device.

Finally, bandwidth management can be difficult when IoT devices are placed at the
extreme range of wireless solutions. Some applications will allow the embedded
devices to create a mesh network with one another to improve reachability to the
local gateway, which can improve reliability at the cost of latency. Regulations that
require encryption add overhead; packets hitting the local gateway and onward into
tunnels can seriously bloat continuous data streams from the embedded device. All
of this means that we often fall back to TCP to compensate for problems with
packet delivery, which is a problem for many latency-sensitive IoT solutions.

©2020 Packet Pushers Interactive, LLC. All rights reserved

An Introduction To Session Smart Routing Page 12 of 16

As illustrated above, existing solutions have typically been bolted onto both campus
and branch solutions, despite the fact that the flows from IoT devices are often
headed directly to the cloud, and modern devices will have onboard LTE and
(potentially) low-orbit satellite connections.

IoT Solution
For modern applications, including IoT solutions, containers have become an ideal
delivery mechanism. This means that IoT hardware effectively becomes a container
host; as a consequence, embedded devices can more easily service-chain additional
solutions in-line with the application.

With this in mind, 128 Technology has embraced containerization and moved the
128T Router into a container within the embedded system. This lets the 128T
Router act as a multi-tenant networking front-end for one or more IoT applications
running on the hardware.

©2020 Packet Pushers Interactive, LLC. All rights reserved

An Introduction To Session Smart Routing Page 13 of 16

The containerized 128T Router grabs hold of IoT packets at the source, and from
that point forward applies all the routing, policy, and security benefits of a Session
Smart network directly to IoT application sessions.

Availability And Performance

With 128 Technology, IoT devices can now deploy SD-WAN path redundancy directly,
without being dependent on that service from an upstream router. The Session
Smart Router combines fine-grained QoS controls for shaping and prioritization
with lossless application delivery across multiple links. This is critical for
applications where any loss of data is intolerable.

©2020 Packet Pushers Interactive, LLC. All rights reserved

An Introduction To Session Smart Routing Page 14 of 16

Security
As stated in the SD-WAN solution earlier, the Session Smart routing platform uses a
zero-trust model, which starts with a deny-all default policy. IoT sensors and edge
platforms can be a ripe target for malicious actors, especially those with direct
Internet access and an additional leg into a local network.

While a more traditional SD-WAN appliance is capable of creating an isolated zone

for such devices, they are not close enough to the source to protect one from
another within the segment. With the 128T router deployed directly onto the IoT
edge host, the same hyper-segmentation and distributed control is now available to
protect those devices. 128T routers are centrally managed. This centralization
provides considerable visibility into the traffic patterns.

©2020 Packet Pushers Interactive, LLC. All rights reserved

An Introduction To Session Smart Routing Page 15 of 16

Conclusion
Network professionals have been using SDN technologies for a relatively short
amount of time. The team at 128 Technology has developed an innovative SDN
solution by shifting the focus to applications, which will long outlive enterprise data
centers.

Session Smart routing gives network engineers control, assurance, and visibility into
application sessions, regardless of where or how the applications run. 128
Technology has achieved this goal by delivering its solution purely in software while
embracing modern application delivery constructs. It does not matter if the
conversation begins or ends in the cloud, between clouds, in the private data
center, or at the edge.

Network architects grappling with the limitations of existing solutions or coming up

short of options for technologies like IoT would do well to give Session Smart
routing a deeper look.

©2020 Packet Pushers Interactive, LLC. All rights reserved

An Introduction To Session Smart Routing Page 16 of 16

About The Author

Tommy McNicholas is an IT infrastructure architect with 16 years of experience
working on data center infrastructure, including networking, storage, compute, and
virtualization. He is currently the principal architect for key customers at
Technologent, a solutions integrator. He spends a fair portion of his time in the field
with customers, with a keen focus on reliability, monitoring, and supportability.
When not in the field, he’s testing new technologies and approaches to
infrastructure automation in the lab.

Tommy began his career in IT at a call center supporting consumer DSL lines and
technicians in the field, building a solid foundation in layered troubleshooting.
These skills carried over into a service desk position and continued through
systems administration, engineering, and architecture positions. Most importantly,
he strives to ensure that both his customers and colleagues build systems they are
proud of while working toward continuous improvement.

When not working he loves to spend time with his wife and daughter or playing
arcade games and pinball.

©2020 Packet Pushers Interactive, LLC. All rights reserved