What Is Cloud On-Ramp?
A cloud on-ramp allows remote branches and users to connect directly to corporate cloud services. Historically, many organizations backhauled cloud traffic through the headquarters network for security inspection and policy enforcement. By permitting direct access to cloud-based resources, a cloud on-ramp reduces latency and improves the user experience.
SaaS applications and other cloud-based resources are an increasingly central component of most organizations’ IT environments. Cloud on-ramps are essential to ensure efficiency and a positive user experience for an organization’s hybrid workforces and mobile devices.
Why Traditional WANs Fail for Cloud Access
Traditionally, corporate WANs were often implemented using the hub-and-spoke model. Multi-protocol label switching (MPLS) links tied each remote site to the headquarters network, which hosted security infrastructure and provided access to the Internet and cloud.
By routing all traffic through the headquarters network – a practice called backhauling or hairpinning – organizations increased the latency of cloud traffic. This is especially problematic for cloud videoconferencing and other latency-sensitive cloud applications, where slight latency could cause jitter in a video call or significant friction within the user experience.
Some organizations addressed these issues through Direct Internet Access (DIA) for remote sites, allowing them direct connectivity to cloud-based resources. However, this comes at the cost of security, since this model bypasses the organization’s security resources deployed at the headquarters network.
Core Components of Cloud On-Ramp
Cloud on-ramp offers direct connectivity to cloud assets without compromising on security or backhauling traffic through a remote headquarters network. Edge devices send traffic to a geographically near PoP, which performs security inspection and routes it to a PoP near the cloud resource. This PoP forwards the traffic to its destination, and responses follow the same route back to the user.
Cloud on-ramp differs from backhauling because security is implemented on a network of distributed PoPs rather than the headquarters network. If a PoP is geographically near the source and destination, and routes traffic over the optimal route (a key feature of SD-WAN), then traffic may reach its destination faster than over a direct, non-optimal route. This is especially true if the WAN provider has a private backbone that offers greater speed and reliability than the public Internet.
Edge Connectivity Options
Cloud on-ramps require the ability to route all cloud traffic to the nearest PoP for security inspection and routing to its destination. This can be accomplished via a variety of different mechanisms, such as a physical socket, vSocket, IPSec tunnels, or direct connect for cloud datacenter integration.
Edge Connectivity Options
Benefits of a Cloud On-Ramp Approach
Cloud on-ramps implemented with SD-WAN can provide various benefits for the business and its users. These include:
- Lower Latency: Cloud on-ramps implement security via a network of distributed PoPs rather than at a centralized headquarters site. This reduces latency by decreasing the distance to the nearest PoP and eliminating the potential bottlenecks of routing all corporate cloud traffic through a single site.
- Consistent Performance: Cloud on-ramp is implemented via SD-WAN, which intelligently selects the optimal route to direct traffic to its destination. This offers improved performance and reliability when compared to traditional “best effort” routing over the public Internet.
- Integrated Security: Cloud on-ramp implements efficient routing of traffic to the cloud without sacrificing security, like DIA. Traffic is routed through PoPs, which perform security inspection and enforcement before sending traffic on to its destination.
- Improved Agility: Cloud on-ramp is implemented using a network of distributed PoPs, where edge devices send traffic to the nearest PoP, and the PoPs optimally route it from there. This makes it easy to add or remove remote sites and users since they only need to be able to find a convenient PoP to use the corporate WAN.
Common Use Cases & Deployment Scenarios
Cloud on-ramp is designed to offer high-performance and secure access to cloud resources. Some common use cases include:
- Branch-to-SaaS: Allows users at remote branches to efficiently access SaaS apps, such as M365 and Zoom.
- Branch-to-IaaS: Provides secure, high-performance access to AWS, Azure, GCP, and other IaaS cloud workloads.
- Multi-Cloud: Offers connectivity to multiple cloud environments, such as SaaS tools or IaaS resources hosted on Azure and AWS.
- Remote Work: Allows remote workers to access corporate cloud assets without sacrificing visibility, security, or performance.
- Disaster Recovery: Cloud on-ramp can be configured to route traffic to backup systems in the event of an outage.
How Cato Implements Cloud On-Ramp
The Cato SASE Cloud Platform implements cloud on-ramp as an integrated feature of its SASE architecture. Cato’s global network of PoPs includes the security features needed to secure cloud traffic, FWaaS, ZTNA, IPS, CASB, and DLP, and integrates SD-WAN capabilities to optimally route traffic to its destination.
The Cato SASE Cloud Platform is designed to optimize the user experience and performance of SaaS apps. Its PoPs are connected via a private backbone, offering reliable, high-performance networking. Additionally, the convergence of security functions into an integrated solution, rather than relying on a network of stitched-together point solutions, reduces the impact of security inspection on performance and latency. This combination allows Cato to dramatically reduce the latency of cloud traffic, especially when compared to hub-and-spoke MPLS deployments that implement security via backhauling.
Cloud On Ramp: Secure, Optimized Branch-to-Cloud Connectivity
Cloud on-ramp enables remote sites and users to access cloud resources without sacrificing performance or security. By implementing security and routing in a network of geographically-distributed PoPs, cloud on-ramp reduces the distance to the nearest PoP (decreasing latency and jitter) while still providing critical visibility and security policy enforcement.
The Cato SASE Cloud Platform offers cloud on-ramp as an element of its integrated cloud platform. Cato’s global network of SASE PoPs converges security into a single platform connected by Cato’s global private backbone. The growth of the cloud and hybrid work has made cloud on-ramp the baseline for digital transformation. Schedule a demo to see how Cato’s Cloud On-Ramp unifies performance and security across all your cloud applications, with one SLA and one platform.
FAQ
Is cloud on-ramp the same as SD-WAN?
SD-WAN is the technology used to implement cloud on-ramps. With cloud on-ramp, remote users connect to the nearest PoP, which performs security inspection and optimally routes traffic to its destination via SD-WAN.
How does a cloud on-ramp improve SaaS performance?
Traditionally, SaaS traffic would be backhauled through the headquarters network for security inspection, which introduced significant latency. By implementing security at a geographically near PoP instead, cloud on-ramp eliminates this detour, improving SaaS performance.
What cloud providers are supported?
Cloud on-ramp is a vendor-neutral technology, providing an efficient, low-latency path to a cloud provider without compromising security. As a result, AWS, Azure, GCP, and other cloud platforms and SaaS apps are all supported.
Do I need new hardware to use a cloud on-ramp?
Cloud on-ramp can be implemented in a variety of ways. While a physical socket requires hardware, other options, such as vSocket and IPsec tunnels, do not. This enables organizations to manage the cost and complexity of adoption and increases flexibility.
Is security handled in the cloud on-ramp or separately?
Cloud on-ramp integrates security into distributed PoPs, eliminating the need for point security products. For example, the Cato SASE Cloud Platform converges FWaaS, IPS, ZTNA, and DLP into its SASE PoPs.