About SaaS Accelerator
Riverbed client-side appliances such as SteelHeads, SteelFusion Edges, and SteelHead Mobile clients can accelerate SaaS traffic by working with SaaS Accelerator. Through SaaS Accelerator Manager, you can configure SaaS applications for acceleration, and then register Riverbed client-side appliances with SaaS Accelerator Manager to accelerate their SaaS traffic.
For Microsoft Teams and Microsoft Stream, SaaS Accelerator requires no additional agent or appliance.
SaaS Accelerator is a service that consists of these components:
• SaaS Application - The application delivered as Software as a Service.
• SaaS Accelerator Manager (SAM) - SAM provides the management interface for SaaS acceleration and manages the acceleration for registered Riverbed client-side appliances. SaaS Accelerator Manager also configures and manages the SaaS service cluster.
• Organization - SAM allows logical separation and segmentation of resources into organizations to support multi-tenant deployments. You can have different organizations to support deployments in different regions. You deploy SaaS Accelerator within an organization.
• Client-side appliances - The client-side appliances located in the customer branch office that intercept any connections destined for the SaaS platform to be accelerated. We strongly recommend that you configure and push SaaS acceleration policies from a SteelCentral Controller for SteelHead (SCC) to managed appliances, particularly in large-scale deployments and production networks with multiple client-side appliances.
• SaaS service cluster - A cluster of service instances behind a service endpoint that peers with client-side appliances. Application acceleration occurs between the client-side appliance and the SaaS service cluster. SAM configures and manages the SaaS service cluster.
• Service instance - The application optimization service node deployed in a SaaS service cluster.
• SteelHead Mobile clients - SteelHead Mobile clients can accelerate SaaS traffic by connecting directly to the SaaS service cluster. SteelHead Mobile clients get their SaaS acceleration configuration through the policy defined in the SteelCentral Controller for SteelHead Mobile.
When you configure a SaaS application for acceleration, SAM deploys a SaaS service cluster in a public cloud to accelerate SaaS traffic. (You do not need a cloud account, and Riverbed configures and manages the SaaS service cluster.) Each SaaS application is accelerated by a dedicated service cluster. For best performance, you need to deploy the SaaS service cluster in the same region as the SaaS application servers.
The service endpoint is the IP address and port range where client-side appliances connect to the SaaS service cluster. You must open multiple ports from 7810 through 7830 on the firewall to allow for this communication.
With SaaS acceleration configured in SAM, the end-user traffic meant for the SaaS server goes to the client-side appliance. The client-side appliance has in-path rules configured that direct the traffic to the SaaS service cluster, and the SaaS service cluster forwards the traffic to the SaaS server. The traffic between the client-side appliances and the SaaS service cluster is accelerated.
Figure 1‑1. SaaS acceleration overview
As an example of the flow, let’s consider a deployment with Microsoft Office 365 traffic. This traffic is sent to the Microsoft Office 365 SaaS server. When you configure SaaS acceleration through SAM, SAM deploys a SaaS service cluster in a cloud and traffic from the user network to the SaaS service cluster is accelerated.
In its default configuration, the SaaS Accelerator automatically manages SSL certificates for proxy and peering. You can, however, use your organization’s certificate authority (CA). In this configuration, you use SAM to generate and download a certificate signing request (CSR) and use it to obtain an intermediate certificate authority (ICA) certificate from your organization’s CA that is already trusted by your clients. After you obtain the ICA certificate, you upload it to SAM to complete the process.