Case Study

Salesforce supercharges its bandwidth with Prisma SD-WAN

In brief

Customer

Salesforce, Inc.

Industry

High Tech

Country

Headquartered in San Francisco, with more than 70 branch offices globally

Products and Services

Prisma SD-WAN

Organization Size

60,000 employees

Challenge

Salesforce’s global enterprise could not scale or meet employee needs with its legacy MPLS-based WAN architecture, which was difficult to manage and couldn’t support direct internet connectivity in the branch.

Requirements

  • Application awareness and insights into application traffic
  • Centralized management for simplified network operations
  • Zone-based firewall for branch segmentation and security
  • Improve uptime and availability of branch locations
  • Scalability up to 2 Gbps of WAN throughput at large office locations

Solution

Salesforce selected Palo Alto Networks Prisma SD-WAN, the industry’s first next-generation SD-WAN solution that makes the secure cloud-delivered branch possible, delivering an ROI of up to 243%.
Introduction
Like any large organization today, Salesforce wanted to leverage more cloud applications to support the needs of its business. While the company’s legacy multiprotocol label switching wide area network (MPLS WAN) was reliable, it failed to scale and support the company’s cloud adoption, especially at large branches with up to 5,000 people each. The legacy architecture Salesforce had in place forced all traffic to backhaul to centralized data centers and didn’t provide direct-to-internet connectivity at branch locations. This older approach to networking hit its limits and simply could not scale any further. For the cloud pioneer and world-leading cloud-based customer relationship management (CRM) company to fully embrace the cloud for its own enterprise, Salesforce needed to leave the legacy WAN architecture behind.


CHALLENGE

Seeking scalability and application awareness for a globallydispersed workforce

When Georgi Stoev joined Salesforce as a senior network architect, he quickly recognized that Salesforce’s MPLS-based network needed more bandwidth and application awareness to support the use of cloud applications that employees were increasingly accessing.


“We needed more intelligence on our network to route some application traffic to public clouds, route other traffic directly to the internet, and route some back to our data center locations,” Stoev explains. “If you became a mad scientist and worked really hard, you could do this to a certain extent with some very complex policies and configuration, but it wasn’t scalable.”

Growing bandwidth demands from the increased adoption of cloud applications at Salesforce also significantly raised costs for the already expensive MPLS-based architecture. “We would increase bandwidth only in small chunks because it was very expensive,” Stoev explains. “A lot of the bandwidth use was coming from developers. Their standing joke was that they had more bandwidth at home than in the office.”

"Many of the SaaS services we wanted to use were regionallyavailable much closer to our users, but we still had to hairpinthe traffic around the country, or in some APAC regions wehad to route that application traffic from one country toanother because of the limitations of our legacy WAN."

Georgi Stoev

Senior Network Architect, Salesforce

REQUIREMENTS

Elevate control, application awareness, and bandwidth

Salesforce’s digital transformation initiatives required a next-generation SD-WAN solution that could scale across its distributed infrastructure of more than 70 locations across the globe. Salesforce has both small and large remote offices, including locations with as many as 5,000 employees requiring bandwidth of up to 2 Gbps each. The company needed a solution that could handle this as well as cost-effectively scale down WAN throughput for smaller offices with fewer than a dozen employees.

Stoev wanted to improve performance while reducing WAN bandwidth costs. Above all, he and his team wanted the ability to create application-aware policies with control granular enough to accurately steer application traffic to the correct WAN links to optimize performance.

“We wanted to be able to distinguish application traffic even from the same vendor, such as Google, which alternates different Google services on the same IP and other IPs. In other words, we wanted to route some specific Google apps on one path and other Google apps on another,” he says.

Salesforce needed an API-driven solution that could centralize management and simplify operations with granular visibility at the user and application levels. This would allow the company to maintain and update WANs remotely without logging in to separate boxes to manage them.

The next-generation SD-WAN solution also needed to easily and securely integrate networks acquired through Salesforce’s M&A activities, such as its acquisition of Slack. In addition to performance and management improvements, the company also required flexibility in carriers, traffic, and redundancy.

"Cost was an important factor, but bandwidth, security,support, automation, application-focus, availability,and proper redundancy were our top requirements. After theRFP and extensive testing, our top requirements came back toapplication awareness and flexibility."

Georgi Stoev

Senior Network Architect, Salesforce

SOLUTION

Securely supports Salesforce’s flexible traffic requirements

Since 2018, Stoev and his team have migrated more than 70 offices to Palo Alto Networks Prisma SD-WAN, often using two Prisma SD-WAN ION appliances configured with Palo Alto Networks unique fail-to-wire technology for redundancy at the larger sites. “The plan is to ultimately move all our sites to SD-WAN, which will significantly simplify our overall network management,” he explains.


The journey, he adds, did require a change in mindset for his team, as well as a new way of thinking about networking. “The SD-WAN is a departure from the traditional routing mindset. We were moving from a model where our applications ran on a private MPLS network to a model with direct connections to the internet. But it brought us to the next level. Inbound, outbound, east and west—all our traffic controls are now API-driven, with automated centralized management through our Palo Alto Networks portal.”

Stoev also credits these SD-WAN successes to his partnership with the Palo Alto Networks services team.

"I was happy with the journey we started several years agowith the Palo Alto Networks team. They were truly interestedin helping navigate the solution with a lot of brainstormingand investigating how to best solve our problems. We felt thatmeeting our needs and shaping their product to help us wastheir primary goal."

Georgi Stoev

Senior Network Architect, Salesforce

BENEFITS

Ensures simple deployment and management

With more than 70 distributed offices around the world, it was crucial for Salesforce to acquire a solution that ensured simple deployment and ongoing management.

“Once we tested, certified, and procured the SD-WAN gear and obsoleted our old routers, installation of the new Prisma SD-WAN moved quickly,” Stoev explains. “All the pieces are templatized, so deployment is simple. Once the WAN circuits come up and the SD-WAN appliances are reachable from the Palo Alto Networks central management portal, everything else is a snap.”

He also cites other benefits with Prisma SD-WAN centralized management. His team no longer needs to log in to separate devices for maintenance, he says, adding, “The process of maintaining our SD-WAN instances is more straightforward than before, with much lower operational costs.”

Improves network resilience with diverse connectivity andappliance redundancy

Salesforce added encryption to secure application traffic over public broadband internet connections using Prisma SD-WAN’s automated overlays. The overlay tunnels operated over multiple WAN links at scale to significantly improve the overall reliability of the network and increase application resilience.

Salesforce also achieved consistent network uptime by implementing high availability using dual devices at branch and data center locations to provide redundancy and failover. In addition, the Prisma SD-WAN ION devices’ fail-to-wire capability allowed Salesforce to maintain branch connectivity even in the event of hardware failure.

“While hardware failures are rare, we wanted to ensure that a box failure will not impact the WAN bandwidth available to our users,” Stoev notes. “This is something our previous network simply couldn’t do, and it’s important for us, especially at our larger sites where an outage means thousands of people become unproductive.”

"Managing our whole environmentfrom a central management systemlends itself well to automation andour future plans to collect morerich data telemetry and bring thatinformation up to the applicationlayer for proactive analytics andtroubleshooting. That is nowbecoming an important part ofour network strategy."

Georgi Stoev

Senior Network Architect, Salesforce



Dramatically increases bandwidth without increasing costs

Prisma SD-WAN enabled his team to move away from legacy WAN optimization technology, which no longer provided a benefit with the amount of encrypted traffic running over the network. Instead, Stoev took the approach of using more cost-effective WAN links to increase the bandwidth of the network by 500% on average, with no increase in WAN costs.

“WAN optimization was becoming ineffective with all the encryption requirements we have,” Stoev notes. “We wanted to improve and enhance our user experience the right way with a long-term investment in the right architecture and technology and not through hacks like WAN optimization.”

Reduces risk with a significantly stronger security posture

Salesforce utilized Prisma SD-WAN zone-based firewalls to segment two zones in each branch to support guest wireless and corporate employees, with plans to add more zones to further segment branches to improve security in the future.

“I’ve never worked in another company that is as focused on security as Salesforce is,” Stoev explains. “Zone-based firewalls and segmentation support the variety of cloud applications our users are accessing. If we need to add another zone, it is easy and straightforward.”


See Prisma SD-WAN in action

Find out more about how Palo Alto Networks Prisma SD-WAN next-generation can help power opportunities for your organization.