Secure Cloud Internet
For organizations requiring additional Internet security services, SD-WAN can integrate with a cloud-hosted Secure Internet Gateway (SIG).
A Secure Internet Gateway is a third-party cloud service that inspects and controls Internet-bound traffic before it reaches the Internet. Typical providers include Zscaler, Palo Alto Networks, and Cato Networks.
In this topology, Internet traffic is not sent directly to the Internet. Instead, traffic is forwarded through a secure tunnel established between the site and the Secure Internet Gateway. The gateway then applies centralized security policies before allowing access to Internet resources.
Typical security services include:
URL filtering
Cloud application control
Threat prevention
SSL/TLS inspection
Access control and policy enforcement
Because security policies are enforced centrally in the cloud, consistent protection can be applied across multiple sites regardless of their location.
To enable this deployment model, an internet overlay (Cloud Access) must be created and associated with the sites requiring a cloud Internet breakout.
The Internet Cloud Overlay is included in the standard SD-WAN solution (Secure Connect license). However, the Secure Internet Gateway service itself is provided by a third-party vendor and requires a separate subscription selected and managed by the customer.
The following design illustrates a Secure Cloud Internet topology.
 |