SASE Framework Disaster Recovery Plan

SASE Disaster Recovery

SASE Framework Disaster Recovery Plan SD-WAN ZTNA CASB SWG FWaaS Failover RTO RPO Testing Production

Architecture Design

# === SASE DR Architecture ===

# Network topology with redundancy
# Branch Office:
#   ISP A (Primary) ─────→ SASE PoP 1 (Primary)
#   ISP B (Secondary) ──→ SASE PoP 2 (Secondary)
#   4G/5G (Emergency) ──→ Direct Internet (Split Tunnel)
#
# SASE PoP:
#   PoP Region 1 ─── SD-WAN ─── ZTNA ─── SWG ─── CASB ─── FWaaS
#   PoP Region 2 ─── SD-WAN ─── ZTNA ─── SWG ─── CASB ─── FWaaS
#   (Active-Active or Active-Passive)
#
# Identity:
#   Okta (Primary) ←→ Azure AD (Secondary)
#   SCIM sync between both
#
# Policy Management:
#   SASE Console → Export → Git Repository → Terraform

from dataclasses import dataclass

@dataclass
class DRComponent:
    component: str
    redundancy: str
    failover_type: str
    failover_time: str
    config_backup: str

components = [
    DRComponent("SD-WAN Edge",
        "Dual ISP + 4G/5G backup at every branch",
        "Automatic — health check every 5 sec",
        "< 30 seconds",
        "Central management, config pushed from cloud"),
    DRComponent("SASE PoP",
        "Multi-region PoP, anycast routing",
        "Automatic — DNS/BGP rerouting",
        "< 60 seconds",
        "PoP config replicated across regions"),
    DRComponent("ZTNA Gateway",
        "Multi-region deployment, load balanced",
        "Automatic — health check + DNS failover",
        "< 5 minutes",
        "Policy synced across all gateways"),
    DRComponent("SWG/CASB",
        "Cloud-native, multi-region by default",
        "Automatic — provider managed",
        "< 60 seconds",
        "Policy in SASE console, Git backup"),
    DRComponent("Identity Provider",
        "Primary + Secondary IdP with SCIM sync",
        "Manual switchover (DNS change)",
        "< 15 minutes",
        "User/Group sync via SCIM, MFA backup codes"),
]

print("=== DR Components ===")
for c in components:
    print(f"  [{c.component}]")
    print(f"    Redundancy: {c.redundancy}")
    print(f"    Failover: {c.failover_type} ({c.failover_time})")
    print(f"    Config: {c.config_backup}")

Runbook

# === DR Runbook ===

@dataclass
class RunbookStep:
    scenario: str
    detection: str
    response: str
    recovery: str
    post_incident: str

runbook = [
    RunbookStep("ISP Outage (Single Branch)",
        "SD-WAN health check fails, alert in dashboard",
        "Automatic failover to secondary ISP within 30 sec",
        "Monitor secondary ISP, contact primary ISP for ETA",
        "Review failover logs, update ISP SLA if frequent"),
    RunbookStep("SASE PoP Outage",
        "Latency spike, health check failures from multiple branches",
        "Automatic rerouting to nearest available PoP",
        "Monitor performance on backup PoP, contact SASE vendor",
        "Review PoP selection policy, add closer PoP if needed"),
    RunbookStep("Identity Provider Down",
        "Login failures, MFA errors, SAML/OIDC timeout",
        "Switch DNS to secondary IdP, enable backup MFA",
        "Verify all users can authenticate via secondary IdP",
        "Review IdP SLA, ensure SCIM sync is real-time"),
    RunbookStep("Full SASE Platform Outage",
        "All SASE services unreachable from all branches",
        "Enable Split Tunnel for critical apps, bypass SASE",
        "Direct Internet access for O365 Teams Slack via local breakout",
        "Major vendor review, consider multi-vendor SASE"),
    RunbookStep("Configuration Corruption",
        "Unexpected policy changes, users blocked incorrectly",
        "Rollback to last known good config from Git",
        "Terraform apply from Git, verify all policies restored",
        "Implement change approval workflow, config drift detection"),
]

print("=== DR Runbook ===")
for r in runbook:
    print(f"  [Scenario: {r.scenario}]")
    print(f"    Detect: {r.detection}")
    print(f"    Respond: {r.response}")
    print(f"    Recover: {r.recovery}")
    print(f"    Post: {r.post_incident}")

Testing Schedule

# === DR Testing ===

@dataclass
class DRTest:
    test_type: str
    frequency: str
    scope: str
    duration: str
    participants: str

tests = [
    DRTest("Tabletop Exercise",
        "ทุกเดือน", "จำลองสถานการณ์ อภิปรายขั้นตอน",
        "2 ชั่วโมง", "Network + Security + IT Management"),
    DRTest("ISP Failover Test",
        "ทุก Quarter", "ตัด Primary ISP ที่ 1 สาขา วัด Failover Time",
        "30 นาที", "Network Engineer"),
    DRTest("PoP Failover Test",
        "ทุก 6 เดือน", "Block Primary PoP วัด Rerouting Time",
        "1 ชั่วโมง", "Network + SASE Vendor"),
    DRTest("Full DR Simulation",
        "ทุกปี", "จำลอง Full Outage ทุก Component",
        "4-8 ชั่วโมง", "ทุกทีม IT + Business"),
    DRTest("Config Rollback Test",
        "ทุก Quarter", "ทำ Config Change ผิด แล้ว Rollback จาก Git",
        "1 ชั่วโมง", "Network + DevOps"),
]

print("=== DR Testing Schedule ===")
for t in tests:
    print(f"  [{t.test_type}] Every: {t.frequency}")
    print(f"    Scope: {t.scope}")
    print(f"    Duration: {t.duration}")
    print(f"    Team: {t.participants}")

เคล็ดลับ

• Dual ISP: ทุกสาขาต้องมี 2 ISP + 4G/5G Backup ขั้นต่ำ
• Git: เก็บ SASE Config ใน Git ทุกอย่าง Rollback ได้ทันที
• Test: ทดสอบ DR ทุก Quarter อย่างน้อย ไม่ใช่แค่มีแผน
• Split Tunnel: มีแผน Bypass SASE สำหรับ Critical App เมื่อ SASE ล่มทั้งหมด
• Runbook: เขียน Runbook ชัดเจน ทุกู้คืนทำตามได้ไม่ต้องพึ่งคนเดียว

การนำไปใช้งานจริงในองค์กร

สำหรับองค์กรขนาดกลางถึงใหญ่ แนะนำให้ใช้หลัก Three-Tier Architecture คือ Core Layer ที่เป็นแกนกลางของระบบ Distribution Layer ที่ทำหน้าที่กระจาย Traffic และ Access Layer ที่เชื่อมต่อกับผู้ใช้โดยตรง การแบ่ง Layer ชัดเจนช่วยให้การ Troubleshoot ง่ายขึ้นและสามารถ Scale ระบบได้ตามความต้องการ

เรื่อง Network Security ก็สำคัญไม่แพ้กัน ควรติดตั้ง Next-Generation Firewall ที่สามารถ Deep Packet Inspection ได้ ใช้ Network Segmentation แยก VLAN สำหรับแต่ละแผนก ติดตั้ง IDS/IPS เพื่อตรวจจับการโจมตี และทำ Regular Security Audit อย่างน้อยปีละ 2 ครั้ง

สรุป

SASE Framework Disaster Recovery SD-WAN ZTNA Failover RTO RPO Redundancy Dual ISP Multi-region Testing Runbook Production