SC//Connect

SC//Connect™ Secure SD-WAN connects a site's Scale Computing edge security device (ESD) to the SC//Connect cloud network. The SC//Connect application builds encrypted tunnels from the ESD to an SC//Connect gateway and sends client traffic through them. This improves the reliability of the site's WAN connections and lets you apply the same connectivity policies across all of your sites.

This page describes SC//Connect as an SC//AcuVigil™ application. The site's SC//Connect network, policies, and link settings are managed in the SC//Connect Orchestrator. For details, refer to the SC//Connect documentation.

Where to find it

To see this application's reports and company-wide settings for all your sites, select SC//Connect from the Apps menu. The page is titled SC//Connect™ Secure SD-WAN.

How SC//Connect works on an ESD

• One tunnel per WAN interface. The ESD builds a tunnel to the SC//Connect gateway on each WAN interface you enable for SC//Connect, including Integrated Cellular on an XG. If a tunnel goes down, traffic automatically fails over to the remaining tunnels.
• Primary and backup interfaces. You set each WAN interface to Primary, Backup, or Disabled. New connections are load balanced across Primary interfaces. If latency increases on one Primary interface, new connections use another Primary interface. A Backup interface carries traffic only when no Primary interface is available. A Disabled interface isn't used by SC//Connect.
• Policy-based routing. Only traffic from client devices whose firewall policy has Use SC//Connect selected goes through the SC//Connect tunnels. Other client traffic uses the ESD's normal WAN routing.
• Site-to-site traffic. Client devices can reach other sites on your SC//Connect network. This traffic always goes through the SC//Connect gateway (a hub-and-spoke model). Direct tunnels between sites that bypass the gateway aren't supported.

System requirements

• Scale Computing ESD: SG1v1, SG2v1, XG1v1, or VG
• ESD system package version RAKNDS or later. To check the version, see the Installed Packages block on the Network tab.
• The site provisioned in the SC//Connect Orchestrator by Scale Computing

Set up SC//Connect on a site

1. Contact Scale Computing Support to set up SC//Connect for the site. Tell Support which WAN connections SC//Connect should use as Primary and Backup, and which it shouldn't use.
2. Scale Computing provisions the site in the SC//Connect Orchestrator and registers the ESD.
3. Scale Computing installs the SC//Connect application on the site's ESD and configures its Password and the Interface Type of each WAN interface on the Settings view of the SC//Connect Suite tab.

4. Scale Computing turns on Use SC//Connect in the firewall policy used by the client devices whose traffic should go through SC//Connect. Tell Support which devices or policies should use SC//Connect.

   For more information about policies, see Devices tab.

5. On the SC//Connect Suite tab, select Status and check that Tunnel shows Connected, Authenticated shows Yes, and each enabled interface shows Online with a status of OK.

Traffic prioritization

You can prioritize business-critical traffic over less important traffic by assigning priorities in the site's SC//Connect policies. You define these policies in the SC//Connect Orchestrator, and the ESD receives them when it connects.

• Download traffic to the site is prioritized by the SC//Connect gateway. When a link is congested, lower-priority traffic is dropped first so that higher-priority traffic keeps flowing.
• Upload traffic from the site is marked with its priority but isn't reliably prioritized in this release. The SC//Connect application on the ESD can't yet be configured with WAN interface rates, which it needs to detect congestion. Support for this is planned for a future release.

How traffic is matched

A policy can match traffic by:

• Destination address, port, and protocol
• Source subnet
• SaaS application or category, for public SaaS traffic

Each connection gets its priority from the first policy it matches. Place specific application and category policies ahead of a broad internet policy. Otherwise, the broad policy matches first and the specific priorities never apply.

Priority levels

There are five priority levels: Highest, High, Normal, Low, and Lowest. Traffic that doesn't match a policy with a priority uses Normal.

For example, you might give Collaboration Tools and Call Center & Help Desk traffic the highest priority, leave general internet traffic at normal, and set Streaming and Social Networks to low.

SaaS categories

You can prioritize by these SaaS categories:

CDN, CRM, Call Center & Help Desk, Collaboration Tools, ERP & Project Management, Educational Services, Finance/Accounting & Billing, Healthcare Applications, Human Resource, IT & Communication, Infrastructure, Marketing & Mailing, Social Networks, Specific Business, Storage, Streaming, and Video Gaming.

The list of SaaS applications and their addresses is built into the SC//Connect software on the ESD. Newly published SaaS address ranges are picked up when the software is updated.

Things to know

• Policy changes apply to new connections. Existing connections keep their previous priority for about a minute.
• Only traffic sent through the SC//Connect tunnels is prioritized. Policies meant for local internet breakout, or for direct site-to-site tunnels that bypass the gateway, aren't applied on an ESD. That traffic uses the ESD's normal WAN routing, without prioritization.

Related topics

• SC//Connect Suite tab
• Devices tab