We're evaluating a SASE platform, and a major part of the pitch is its application-acceleration feature. The vendor says that routing traffic through its points of presence can improve performance to Microsoft 365, other SaaS services, and our applications running in two AWS regions. My concern is that this adds an extra leg: users connect to the SASE PoP, which then connects to AWS or the SaaS provider, rather than going there directly. Where does the performance improvement actually come from?
We have a few hundred users, with significant traffic from Manila and Singapore to applications hosted in Europe. The vendor showed a 20x throughput improvement, but that sounds more like a best-case test on a poor circuit than something users would notice on normal connections.
For organizations that have deployed SASE in front of real cloud traffic, what measurable improvements did you see after accounting for the trip into the provider's network?
4 Answers
Some platforms also optimize the transport itself. The client may establish a short, stable connection to a nearby PoP while the provider manages the long-haul portion with TCP optimization or similar techniques. That can improve throughput on high-latency paths, especially for file transfers and applications that open many connections.
This tends to be more useful for globally distributed users reaching distant regions than for a company whose users, SaaS services, and workloads are all in the same area.
The biggest factor is usually geography and workload placement, not the SASE label. If users in Southeast Asia are accessing an application hosted only in Europe, latency will remain significant regardless of the security layer. A distributed deployment, regional application instances, replicated data, or an appropriate CDN may help more than adding another transit layer.
SASE can still help when it provides a better route from Manila or Singapore to the relevant cloud region, but it cannot overcome the physical distance to a badly placed workload.
Run a controlled pilot instead of accepting the vendor’s benchmark. Compare direct access with the SASE path for the same users and destinations, and measure median and worst-case latency, packet loss, throughput, login time, file-upload time, and complete application transactions. Include real Microsoft 365 and SaaS workflows, not just an Internet speed test.
Also test Teams calls separately, since call quality depends heavily on jitter, loss, and the selected media path. The right outcome may be better reliability and fewer bad outliers rather than a huge increase in average speed.
The improvement can be real when the normal Internet path is congested or poorly routed. A SASE provider may have better peering, fewer problematic transit networks, a private backbone, congestion control, and connection reuse. In effect, the user reaches a nearby PoP quickly, and the provider carries the traffic over a more predictable path to the destination.
That said, a dramatic 20x result should be treated as a lab result until it is proven with your users, locations, and applications. If the direct route is already good, adding a PoP may provide little or no benefit.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures