Rerouting Redundancy: How OpenSFF Can Enhance SMB Networks

Introduction

These days, there are plenty of great options for small business routers and firewalls. Several trusted vendors offer network appliances for all budgets, and they’ve generally nailed down the essentials: security, speed, and power efficiency. While secondary aspects such as user interface, support, and value can vary from one vendor to another, the real rooms for improvement are with redundancy and serviceability. The impact of these shortcomings can grow with your business and as you have more and more locations that need to get online.

SMBs need a reliable network just as much as international companies. But existing hardware designs don’t often make for network appliances that are reliable, serviceable, and affordable. In this article, we’re going to talk about the overall strengths of SMB network appliances, what needs improvement, and how our open hardware standard can help.

What SMB network appliances get right

Let’s go over the good news first. SMB network appliances are generally in a mature and healthy state, with plenty of competition to keep vendors on their toes. It’s not that hard to find a router, firewall, or gateway that fits your budget and skill level. If you want something you can set up yourself, you’ll find Ubiquiti’s UniFi devices as one of the top recommendations. MikroTik’s devices offer great bang for your buck. They become even better options if you’ve got an experienced network admin who can make the most of the company’s RouterOS management software. If you want a service provider to take care of your networking needs, chances are they’ll be familiar with SonicWall and Fortinet products. Some may even recommend those brands as affordable alternatives to enterprise vendors such as Cisco and Check Point.

While you should still take the time to research, in general, you’re not going to worry about the security capabilities of today’s network appliances. Devices such as Fortinet’s FortiGate and SonicWall’s TZ models have dedicated security processing hardware. Those sophisticated configurations used to be exclusive to enterprise gear, but now you can have top-notch security and performance at a reasonable price. Meanwhile, products such as OPNsense, Netgate, and Protectli run on open-source software, which allows them to rely on community expertise and oversight.

Another benefit of the market’s maturity is that some vendors provide convenient and unique integration features should you choose to go all in on their ecosystem. For example, management tools such as UniFi Site Manager, Fortinet FortiGate, and SonicWall Secure SD-Branch let you set up and monitor their respective vendors’ devices on a single interface.

Where they fall short

You’ll find different opinions about the software, customer support, or feature set of SMB network appliances. There’s no clear winner there. But when it comes to redundancy and serviceability, the solution boils down to: get another device.

These days, most established vendors have license-free or single-license HA configurations. But you’ll need at least two network appliances per connection to have redundancy. It can be tough to buy additional hardware knowing that it might be idle for most of its life. We still recommend that you set it up as soon as you can, because hardware inevitably fails. When that happens, usually your only option is a complete replacement, even when the broken component is something as mundane as a power supply or a fan.

Now you might be thinking, how can you have redundancy without a second device? And aren’t most electronic devices sealed boxes?

How OpenSFF can lead to better SMB network appliances

Our standard enables an affordable, single-unit HA configuration

Our open standard defines a processing unit called the Compute Node, an active electronic housing called the Enclosure, and an optional management unit called the Management Module. These three components can be combined to create a wide range of systems, including network appliances. Instead of designing static products, vendors can use OpenSFF-compatible components to create a modular and serviceable gateway, firewall, or router.

Enclosures have no defined form factor or layout, and they can host one or more Compute Nodes. That means it’s possible to create a dual-node OpenSFF-compatible HA firewall. In addition, Enclosures can be designed to have an internal Ethernet switch for workloads and inter-node communication. Enclosures can also have multiple power supply bays as well as UPS bays. An OpenSFF-compatible HA firewall appliance can truly be an all-in-one unit.

Our concept for an OpenSFF-compatible dual-node HA firewall has four Ethernet ports that are rated for at least 2.5Gbps. The two nodes can be configured via software to have an Active/Passive or Active/Active HA configuration. They can synchronize over the dedicated Ethernet ports or through an internal connection, since our specification allows Enclosures to route Compute Node signals without exposing them externally.

Our standard prioritizes serviceability and vendor-neutrality

We’re aware that shifting the hardware configuration of a redundant setup from two distinct devices to one where two nodes share an Enclosure introduces a single point of failure. However, we’re developing our standard to be serviceable and vendor-agnostic. Any Compute Node will work with any Enclosure, regardless of their vendors. The same applies to the Management Module and compatible Enclosures.

Our standard also specifies numerous serviceability features. These allow both vendors and you to maximize our components’ modularity and vendor-neutrality. First off, Compute Nodes and Management Modules are secured in an Enclosure using only two captive thumbscrews. Paired with our cable-less connection interface, even general staff can figure out how to replace OpenSFF modules.

Equally important, we require manufacturers to use standard cooling fans in Enclosures. We also encourage them to make components hot-swappable wherever possible, including power supplies. Finally, we require manufacturers to minimize or eliminate the need for screwdrivers or specialty tools to service Enclosures, relying instead on thumbscrews, latches, or sliding trays.

These measures add up to enable network appliances that don’t have to be discarded when one component fails. You’ll be able to replace Compute Nodes and Management Modules, or migrate them to another Enclosure while retaining their data and network configuration. Vendors can design OpenSFF-compatible devices that allow you to replace smaller components such as fans, power supplies, or any internal cables.

Our standard provides sufficient connections for SMB networking

Compute Nodes have two variants: Core and Enterprise. Core nodes have one 4C+ connector that carries two 2.5GbE or faster signals, while Enterprise nodes have two 4C+ connectors for a total of four 2.5GbE or faster signals. In addition, each connector has a PCIe 4.0 x1 lane, which vendors can use to provide additional network interfaces that don’t eat up the bandwidth of the native Ethernet signals.

For instance, a single-node OpenSFF-compatible router could have four native 2.5Gbps or faster Ethernet ports plus a 10Gbps SFP+ port via PCIe. Stepping up from that, vendors can design a single-node gateway that has eight 2.5GbE ports alongside a 10Gbps SFP+ uplink. Manufacturers can achieve this by connecting the Compute Node’s four Ethernet signals to an internal switch, which the Enclosure will expose as eight ports. The SFP+ uplink can come from a PCIe adapter or via a dedicated internal network interface controller on the Enclosure backplane.

These designs provide port counts and speeds that are similar to today's network appliances while being significantly more serviceable, flexible, and scalable.

Build with OpenSFF

With all the doom and gloom in tech, it’s nice to see that there are still markets that are as strong and stable as they are cutting edge. With a bit of research, you’re bound to find network appliances that fit your business’ needs. That said, hardware that is modular, scalable, and serviceable by design can significantly cut down on capital and operational expenses. You can help us make those devices possible by spreading the word about our standard. We encourage vendors who share our principles to read our specifications, and to reach out to us at [email protected] for technical clarifications, partnerships, and other inquiries.