VMware’s secure access service edge (SASE) is more than a means of connecting remote workers with applications and workloads. Increasingly, it’s becoming a platform for connecting applications with applications and clouds with clouds.

According to Karl Brown, senior director of product marketing for VMware’s SASE business unit, SASE is an integral part of the its broader multicloud strategy.

The vendor’s SASE platform is built around a network of more than 150 points of presence (PoPs) acquired from SD-WAN vendor VeloCloud in 2017. These PoPs form the service edge from which its SD-WAN and security functionality — in collaboration with Menlo Security — are delivered.

But while rival vendors are focused on expanding their remote access, networking, and security capabilities, VMware is expanding the scope of what a SASE PoP can do.

These PoPs aren’t limited to functionality defined in Gartner’s SASE definition, Brown said.

Is SASE the Multicloud Networking Cure?

One use case VMware is exploring is multicloud networking. Over the past few years, the company has announced a series of integrations with the major hyperscaler and cloud providers to deliver networking not just to their data centers, but into them.

This not only enables the SD-WAN vendor to provide access to workloads running in the cloud, but also opens the door to secure multicloud networking.

“When you start to connect between clouds, there is a security element to this,” Brown said.

One of the ways VMware addressed this was by building its NSX network virtualization and security platform into its PoPs. “We have the ability to be this security processing point within our points of presence to ensure the integrity of data that goes out of and into the various cloud locations,” he said.

Networking is just one of the litany of multicloud challenges newly appointed VMware CEO Raghu Raghuram aims to address in the company’s next chapter.

While most SASE implementations aren’t well suited to handling applications that are distributed across multiple clouds, Neil MacDonald, one of the Gartner analysts who penned the original SASE definition, expects this to change over the next few years.

“We believe SASE has a role to play there, but it’s one of the least evolved areas,” he told SDxCentral in an earlier interview.

In fact, MacDonald expects SASE and multicloud to converge as distributed applications become more prominent. “I don’t think they can evolve separately, although they might initially, just like SD-WAN did years ago,” he said. “But ultimately they should converge.”

Is AI the Differentiating Factor?

VMware’s SASE aspirations don’t stop at secure access or multicloud connectivity. The vendor’s platform is one of a handful on the market with integrated artificial intelligence operations (AIOps) capabilities.

VMware acquired these capabilities with the purchase of Nyansa in early 2020. The AIOps platform was later rebranded as VMware Edge Network Intelligence and has since become an integral part of VMware’s SASE strategy.

“The acquisition of Nyansa was made in large part to bring AIOps and this intelligence into SD-WAN to facilitate a move from point-to-point error correction methodologies that we have applied historically in SDN to a broader end-to-end, network-based approach,” Craig Connors, CTO of VMware’s SD-WAN and SASE business, told SDxCentral in an interview earlier this year.

The service works by gathering telemetry, including traffic profiles and appliance logs, using a crawler function running on the SD-WAN CPE. “All that gets summarized and sent to a data lake, where we baseline what is the normal network behavior,” Brown said.

This information is then used to detect anomalies and will eventually support what VMware calls a “self-healing” network. And because the crawler is running not just on the LAN but in the PoPs, the platform can quickly identify where the root of the problem lies, Brown explained.

VMware this week announced new capabilities coming to its AIOps platform designed to mitigate network disruptions across the WAN.

“What we're beginning to do now at the higher level is to look at trends,” Brown said. “Not just what’s going on on the last mile, but what’s going on from the actual device, and the next device, and the last device sitting in front of the application.”

It’s kind of like using Google Maps to find the best route to a destination, which may be different at certain time of the day, he explained. Based on trends analyzed by the AIOps platform, the service can identify potential problems before they cause a disruption and provide alternative routing recommendations.

This is possible because VMware’s SD-WAN was distributed across a network of PoPs from the get-go. “We can actually change the points of presence that our SD-WAN devices are connecting to so that they can have better performance in reaching a destination application,” Brown said.

Like most early AIOps platforms, VMware hasn’t quite closed the loop. While the platform can provide recommendations, users still have to approve them.

However, Brown claims AI automation isn’t far off, at least for some application use cases. “Self healing comes at the end of this year, when we’ll start to put it into beta code for our customers to try out.”

‘VMware has its work cut out’

However, VMware is far from the only vendor taking on these challenges, Paul Nashawaty, senior analyst at ESG, wrote in a recent blog post.

“VMware has its work cut out,” he wrote. “The future direction VMware laid out is where the industry is going … In fact, they are one of many vendors in the market looking to solve, address, and crack the multicloud code.”

Alkira is one such vendor. The company’s Cloud Services Exchange platform is distributed across all the major cloud providers and automates and abstracts the complexity of deploying, managing, and networking workloads across multiple clouds.

Several other vendors, including Aviatrix and Prosimo, are also tackling this issue from different angles.

Similarly, VMware’s long-time rival, Cisco, has taken similar steps on both the cloud networking and AIOps front.

This spring, Cisco announced an integration between its Viptela SD-WAN, ThousandEyes network performance monitoring, and AppDynamics application monitoring platforms to improve visibility and speed up root cause analysis.

“ThousandEyes became a very critical asset to completing the picture, because we were blind to the internet,” said Raj Gulani, senior director of product management for enterprise cloud and SD-WAN at Cisco, in an earlier interview. “Everything outside of the enterprise WAN — which actually impacts the entire enterprise today because the internet is one of the primary WAN links — we have no visibility into that.”

Cisco’s integration with ThousandEyes enables users to make more informed decisions about how they route their traffic. And much like VMware has done with its Edge Network Intelligence platform, Cisco is looking to close the loop and enable ThousandEyes to reroute traffic over different WAN links to avoid disruptions.

However, whether VMware, Cisco, or someone else will close the loop first remains to be seen.