Understanding Software-defined Networking | 2024 SDN Guide

Written by Andrew Magnusson

Customer Engineering Expert

StrongDM

Reviewed by Justin McCarthy

Co-founder / CTO

strongDM

7 min read

Last updated on: January 5, 2023

Get the Zero Trust eBook PDF

Found in: Security Access Zero Trust

StrongDM manages and audits access to infrastructure.

Role-based, attribute-based, & just-in-time access to infrastructure
Connect any person or service to any infrastructure, anywhere
Logging like you've never seen

Get a demo

Summary: In this article, we will take a comprehensive look at software-defined networking (SDN). You’ll learn what it is, how it works, and what its benefits and disadvantages are. You’ll also learn how SDN compares to and works with other types of networks and get answers to common questions. With a clearer understanding of SDN, you’ll be able to determine if and how it meets your networking needs in a business landscape in which adaptability is increasingly important.

What Is a Software-Defined Network (SDN)?

A software-defined network makes networking easier by separating the control plane of the network from the data plane. To review, the control plane decides where to send network traffic, and the data plane sends the traffic onward according to what the control plane tells it. In software-defined networking (SDN), the control plane is operated by the software (a.k.a. “software-defined”) while the data plane remains under the operation of the hardware.

With SDN, networking devices directly connect to applications through application programming interfaces (APIs), making SDN programmable and independent from the hardware infrastructure. Because the software manages the hardware in an SDN, businesses have greater flexibility and can adapt to new requirements by quickly making network changes or provisioning new services. This makes SDN especially attractive in this era of agility, cloud computing, and digital transformation.

How Software-Defined Networking Works

With SDN, network admins can control the whole network from one place, programming and managing it from a centralized server instead of by each individual device.

SDN consists of three components:

Applications that communicate resource requests, actions, or information about the entire network.
Controllers that take application and hardware information and route it appropriately.
Networking devices that receive the data from the controller and process and move it as directed.

Each of these three components — or layers — are integrated through the SDN controller. The integration between the controller and the application is typically called the northbound interface while the integration between the controller and the networking devices is called the southbound interface.

Benefits of Using a Software-Defined Network

There are a number of benefits to SDN that not only improve the role and day-to-day responsibilities of IT, but also speed up and simplify network management to help businesses operate with more agility. Here are some of the top benefits of SDN:

Greater network visibility. Any time there is a centralized source from which to access and manage information, visibility drastically improves. Such is the case with SDN’s centralization, in which an overview of the network can be easily accessed in one place, eliminating many of the blind spots that have typically plagued traditional networks.
Scalability. SDN’s flexibility makes scaling business operations much easier since additional devices that support business expansion can be added to the network as needed without risking a disruption in service.
Big-data friendly. As organizations deal with ever-growing data sets, they require significant bandwidth to process the data. SDN offers an effective way to respond to today’s mammoth data processing needs by processing data sets in parallel, managing the volume of data transferred to various destinations, and ensuring reliable connectivity.
Improved security. SDN’s centralization is another major plus when it comes to security. Network admins can develop and propagate critical security policies and protocols throughout the network, reaching all devices and any other important components.
Open source and vendor-neutral. SDN follows open standards and can be used with any vendor’s network hardware, preventing organizations from having to commit to any one vendor’s network products. This increases the agility of the organization’s IT since the SDN can connect to various clouds, devices, and applications.
More effective IT. Because SDN streamlines and simplifies network management, the role of IT teams is transformed, enabling them to focus less on the network and more on improving service delivery. With improved service, the end user’s experience is also greatly enhanced.
Cost-effective. SDN is less expensive to operate and has a lower total cost of ownership (TCO) because it requires fewer administrative expenses and improves server utilization. Traditional switches can also be replaced with commodity devices to further save costs.

Disadvantages of Using a Software-Defined Network

While SDN provides several important benefits, there are also a few concerns to be aware of so data centers and IT teams alike can plan around them:

Security. In the same way that security policies can easily propagate throughout the network with SDN, the same is true for threats, which is one-way SDN’s centralization can create a vulnerability, specifically at the controller level. Being aware of this aspect of SDN, however, can help network admins recognize the vulnerability and help ensure the controller remains secure.
Upfront costs. Though the lower TCO of SDN is appealing, there can be significant upfront costs when switching to and deploying SDN, such as the time and resources needed for planning and production trials, equipment purchases, new or upgraded software licenses, and IT training.
Latency and reliability. Since each device takes up space in the network, the bigger and more complex the network, the more delay the SDN controller could experience. If the controller is overloaded or out of sync with the other components of the SDN when transferring data, latency could increase, and reliability could drop.
Network visibility. To achieve true end-to-end network visibility, SDN has to be integrated with IT infrastructure management software that can track applications throughout the network, including servers and storage. Without this integration, some weaknesses in traffic and performance could go unnoticed and therefore unaddressed and could create or compound security and performance issues.
Lack of expertise. Though SDN has gained in popularity, there are still not enough people with the skills needed to properly configure, manage, and secure it. Organizations may either have to spend the money on training their current staff or engage in extensive recruitment efforts to compete for and hire skilled professionals.

Software-Defined Perimeter vs. VPN

When you want to prevent infrastructure connected to the internet from being seen by hackers and third parties, a software-defined perimeter (SDP) can provide a layer of invisibility, hiding it to outsiders while allowing authorized users to continue to access it. The layer of invisibility — or boundary — is created at the network level rather than the application level. The SDP is able to authenticate devices as well as user identities, and each user — regardless of their location — has their own separate connection, making it ideal for teams working remotely. And because SDPs are software-based, they can be deployed anywhere — whether on-premises, in the cloud, or as part of a hybrid model.

By contrast, a virtual private network (VPN) is an encrypted network that runs on top of an unencrypted network and creates encrypted connections between devices and servers. A VPN allows all connected users to access the entire network — unlike an SDP, which doesn’t allow shared connections. The management of VPNs is complex, largely because multiple VPNs have to be deployed to manage different levels of network access, such as the access needed by different departments within an organization.

SDN vs. Network Functions Virtualization (NFV)

While SDN and Network Functions Virtualization (NFV) both virtualize network services and “abstract” them from the hardware — i.e., allow them to communicate with the hardware while consolidating the IT footprint — that’s usually where the similarity ends.

NFV provides basic networking functions while SDN controls, directs, configures, defines, and modifies those functions for specific uses. SDN also abstracts physical networking devices, such as routers and switches, and positions any decision-making about where to send traffic in the virtual control plane. By contrast, NFV virtualizes the entire physical network with a hypervisor so that the network can grow without the need for more devices.

SDN vs. Traditional Networks

Traditional networks use dedicated hardware devices to control network traffic. Because the control and data planes in traditional networks are integrated, any network change — even the simplest — can take weeks to complete since the change has to be made one by one to each device.

SDN differs from traditional networks in that control is handled completely through the software, and the controller itself can communicate directly with applications via APIs. In this way, app developers can program the network directly, allowing any network changes to quickly and easily be made in lockstep with business changes.

Software-Defined Networking Example

An example of an SDN in action is the recent deployment at Tribune Media, which transferred more than 140 applications to the company’s new SDN infrastructure using VMware NSX. VMware’s virtual networking and security software use a network hypervisor to distribute network functions — including switches, routers, and firewalls — across the environment, enabling core business and data operations to run at peak efficiency without sacrificing security or reliability.

About the Author

Andrew Magnusson, Customer Engineering Expert, has worked in the information security industry for 20 years on tasks ranging from firewall administration to network security monitoring. His obsession with getting people access to answers led him to publish Practical Vulnerability Management with No Starch Press in 2020. He holds a B.A. in Philosophy from Clark University, an M.A. in Philosophy from the University of Connecticut, and an M.S. in Information Management from the University of Washington. To contact Andy, visit him on LinkedIn.