Running office WAN via MPLS connected Datacenter's WAN connection. Thoughts?

Question

Some folks at my work are thinking about getting rid of our office (HQ) WAN line from ATT, increasing the speed of our Datacenter connection and then running the office WAN(Internet) through an MPLS connection that connects to the Datacenter. Hopefully that makes sense :)

I've done a ton of networks setups in my life, but not this. It feels off, for some reason. Do any of you guys have this setup or set one up? And, if so, does it actually work for you guys? Are there any notable downsides? I can make the setup make sense in my head -- especially if we go with a low latency MPLS line and then a 100Mb/w fiber connection in the office -- but I dont know anyone that has done this. Contracts these days are 3yrs so I want to try to get as much info before any decisions.

My main question is for people that have experience with using the Internet connection in the datacenter as their internet connection in the office. Do your users notice any more latency when connecting from the internet connection at the DC via MPLS to the office? Do you end users notice any difference between having the internet connection locally at the office or by sharing it through MPLS from the datacenter.

Thank you!

Answer 1

There really isn't a "right or wrong" answer on how to do it. You have to weigh the pros and cons and decide for yourself. Usually a centralized model would be used where all of your security hardware is in the DC, so you backhaul a remote location which doesn't have a firewall or web proxy back through the equipment in the DC. This requires bigger hardware at the DC to accomidate all the remote locations as well as higher bandwidth MPLS circuits.

Or the distributed model where you offload the internet locally would require firewalls at every location to secure this traffic, but then you may also be able to use some smaller hardware at the DC since it doesn't have to worry about that traffic. You could also use lower bandwidth MPLS circuits based on the traffic patterns.

Answer 2

This is pretty much what most corporate WANs used to look like, back when reaching the Internet was a gimmick and all the real work happened in the datacenter. My own corporate network is still pretty much set up this way in Europe and the US... but we have a couple thousand branch offices to manage, and moving that to a different architecture takes time and money. So far we have managed to make it work, but continuing to scale it is a challenge.

However if I was starting fresh, I definitely wouldn't bother with backhauling web traffic to the datacenter. If you look at the data it's fairly easy to understand why. Traffic from sites on my network increases by about 25 to 30% every year (driven by heavier web apps, video use, etc...), and 75 to 80% of the total traffic to the datacenter is just passing through on its way to the Internet. Given that we use a cloud proxy service, the datacenter doesn't even really provide any security filtering which would have justified going through it in the past.

As a result, we are putting Internet links back into more and more locations, because that's where the traffic is actually going (Google, Salesforce, etc...), and it's fairly trivial to source 50 to 100Mbps of local broadband, whereas getting and more importantly managing multi-gig Internet links into the datacenter gets complex fast, if only because it creates a single point where any hiccup will balloon into a major incident fast.