Difference between Cato socket and IPSec connection in SASE, SSE360

Introduction

When introducing Cato Networks, it is necessary to consider whether to use sockets or IPsec.

A socket is an SD-WAN connection appliance provided by Cato Networks, which can be connected to the nearest Cato PoP from the customer environment via the last mile connection (one or more).

On the other hand, when connecting using IPsec, the existing FW or router is used to connect to a specific Cato PoP.

When customers introduce Cato Networks, we will explain while comparing the advantages and disadvantages of each so that you can decide whether to connect via sockets or use IPsec.

Advantages of Cato sockets VS IPSec connections

First, let's list the pros and cons of sockets.

Advantages of Cato socket

• Automatic PoP Selection
• Last Mile Packet Monitoring
• Bandwidth control function (QoS)
• Application-based routing
• Off-cloud communication (communications not via Cato between bases where sockets are installed)
• Remote management of sockets

Disadvantages of sockets

• Socket installation work is required (change of routing on the LAN side, etc.)
• Dynamic routing other than BGP is not available

Sockets have many advantages, but the main point is the PoP automatic selection function, so PoP redundancy can be achieved.

Therefore, when a failure occurs on the PoP side, the PoP will be automatically switched on the Cato side.

In addition, it is possible to monitor the packet loss status of last mile communication (communication not via Cato Cloud), so compared to IPsec, sockets have a very strong part in handling and analyzing failures. becomes a feature.

In addition, you can connect to the console screen of the socket from the web management screen, and it is also possible to change settings remotely.

On the other hand, the disadvantage compared to IPsec is that it requires the work of installing an appliance, so some changes must be made to the existing network environment.

However, it is very easy to set up the connection between the socket and Cato, and if you assign an IP address to the socket with DHCP, you can connect to Cato PoP with zero touch.

Although it is listed as a disadvantage, if the change in the existing network environment is acceptable, we believe that the burden on the customer side due to the socket installation work will not be that large.

Next, we will list the advantages/disadvantages of IPsec connections.

Advantages of IPsec

• Existing FW or router can be used
• Connectable with many cloud services (GCP, Oracle, etc.)

*Virtual Socket can be used for AWS, Azure, etc.

Disadvantages of IPsec

• Low PoP redundancy (up to two PoP IP addresses can be specified)
• It is necessary to verify in advance whether the FW and router in the customer's environment can be connected normally.
• Limited manufacturer support

The advantage of IPsec is that you can use existing FW and routers.

Since there is no need to change the existing network environment, it can be used once a connection with Cato PoP is established.

However, the disadvantage is that it is not always confirmed that the FW and router used in the customer environment can be connected with IPsec, so it is necessary to verify in advance.

In addition, even if a defect or failure occurs, the FW and router used by the customer are outside the scope of Cato Netowrks' support, and there is a possibility that we will not be able to support the entire scope.

When using IPsec connection, it is necessary to understand these disadvantages in advance before installing.

Quick setup, PoC-enabled SASE

So far, we've compared sockets and IPsec, but it's up to you to decide which features appeal to you.

Sockets can be used for post-installation fault countermeasures, redundancy, and operational perspectives, while IPsec can be used for those who do not want to change the network configuration at the time of installation as much as possible.

Cato SASE can actually verify the socket by POC, so if you are interested, please contact us.

• CATO Socket Easy SASE connection edge SD-WAN device