ARCHITECT JOURNEY

FrieslandCampina
An International Dairy Conglomerate’s Networkand Security Transformation Journey

Company:
Sector:Driver:Role:

FrieslandCampina
Dairy
Erik Klein
Infrastructure Architect

Revenue:
Employees:
Countries:
Locations:$14 billion
20,00034120

Company IT Footprint: FrieslandCampina has 120 locations. It employs over
20,000 people worldwide, but, because those people work in shifts, the numberof endpoints are not related to the number of employees. Within the office andindustrial workspace, there are about 7,000 to 8,000 endpoints. It currently also
has over 80 factories worldwide.

“I’m looking towards making the network totally irrelevant in the next
five to seven years. The network will only be a transport mechanismthat makes sure the application goes from A to B, but the data security itself is completely embedded in the communication stream.”Erik Klein, Infrastructure Architect, FrieslandCampina

Excerpt from: Stiennon, Richard “Moving Applications to the Cloud,” Secure Cloud Transformation: The CIO’s Journey.
IT-Harvest Press, 2019, pp. 51-59.

1FrieslandCampina Journey Overview

Business Objectives

The SolutionImpact• Align IT with both operations
technology (OT) and IoT priorities,
processes• Introduce dynamic applicationrouting, local internet breakouts• Reduced costs: MPLS, hardware
security stack, “turning off apps
on weekends”• Improve security• Reduce MPLS costs, WAN
dependence• Resolve Office 365 deployment
challenges• O vercome cultural hurdles tocloud security• Move applications to AWS• Transition to Office 365• Deploy SD-WAN• Faster application access, better
user experience• Better security, delivered inline• “Making the network totallyirrelevant”

2

FrieslandCampina is a global
producer of milk products andhas created a sophisticatednetwork to provide consistentIn the words of Erik Klein:

Bringing milk products to the worldand secure global connectivity.

I joined FrieslandCampina in 2012. We are a global producer of milk

Erik Klein, lead infrastructure

products—we make cheese, infant and toddler nutrition, yogurts, skimmed andarchitect, tells its network andsemi-skimmed milk, condensed milk, and health foods for athletes. We are based

security transformation story.

in the Netherlands, and over time we have expanded into other countries, such asIndonesia, Vietnam, Nigeria, Ghana, the U.S., and many others.
IT has an important role in manufacturing goods. From a production perspective,
the availability of the operations technology (OT) environment (which is IT within
the production environment with specific requirements) has a huge impact. For
example, the raw milk can’t be stored for more than seventy-two hours. Any longer
and it gets discarded, but it can’t be thrown away into a sewer, so it is a costly process to dispose of the spoiled product. Therefore, OT is used within the production
environment to make sure that the production processes aren’t disrupted and workwithin the strict timeframes.
Within the OT environment, with the introduction of next generation PLCs (programmable logic controls), smart sensors, and other IoT developments, the number ofIP-based endpoints will grow considerably over time.
Currently, we have about 80 factories worldwide. Some are more traditional, butsome are really sophisticated and the Smart Factory is emerging. Therefore, thenumber of endpoints will grow in the OT environment.

Our cloud transformationBy the end of 2013, the cloud hype cycle started and there were more and more
people looking at software as a service, localized content, and moving stuff to thecloud—in our case, Amazon Web Services.
Eventually, we realized, when going in that direction, the wide area network we
had was no longer valid. We needed to go into a transformation from a private
MPLS-centered network to a public internet-centric network.

3

“We needed to go into

At that time, the designs we made consisted of several boxes on location, and werealized that this would be too complicated and expensive to execute. So in 2014,a transformation from awe embarked on the transformation journey by moving the centralized proxy server

private MPLS-centered

to the cloud with the Zscaler cloud service, but still relying on the capabilities ofnetwork to a public

Cisco routers for all other functions.

internet-centric network.”

As cybersecurity became more of an issue, the Zscaler Cloud Firewall came intoplay. Moving security to the cloud was harder, because I had some internal pushback, and there were some reorganization issues. But in 2016, we started a projectto extend the boundaries of our network from a stateful firewall on a Cisco router at
the FrieslandCampina location to cloud security, the Zscaler Cloud Firewall.
From every location, we then built IPsec tunnels to the Zscaler security service andused the proxy functionality as well as firewall functionality of Zscaler.
To overcome the limitations using PAC (proxy auto-configuration) files in the browser to get to the internet, we also transferred the routing within the whole LAN environment, so that the default route from every location would end up at the security
layer of Zscaler. And that’s where we are today.
And then it was time for testing dynamic application routing.

Why secure internet local breakouts?
There are two reasons why we switched from a centralized proxy environment tothe cloud-based proxy environment with local breakouts. Firstly, from a marketing
perspective, the driver to break out locally was to get localized content. The web
servers that you’re connecting to from each country should automatically give thecontent of the website in the local language, for example.
Secondly, FrieslandCampina had been using a number of different SaaS applications
worldwide, so having it all centrally break out was, from a performance perspective,
not a way forward. Also, the web content became richer and files were getting
bigger, so there was more data to transport. From a localized content perspective,
and the fact that users are using more and more SaaS applications, we realized that
we would need to bring the end user to the internet (cloud) quicker.

4“The 2016 phase of theExcept for our private cloud, direct-connected VPC (virtual private cloud) on AWS—
and we have connected that to our MPLS backbone so that’s still going over annetwork transformation

MPLS link—everything else is being offloaded at the local site level and then travels

went very quickly andto the closest Zscaler data center based on lowest latency, with a second closest

was completely non-Zscaler data center as backup. We do a measurement every six months to see if

disruptive.”

indeed those Zscaler nodes are still the quickest to reach.

Moving applications to AWS
FrieslandCampina is currently migrating applications to AWS based on various criteria, such as those applications that only need to be accessed at certain times. This
service can’t be provided by our existing hosting provider, and keeping those servers at their location will be too expensive. On the other hand, T-Systems couldn’t
always meet the requirements of the applications, resulting in an instance that was
too big (too expensive) or too small (poor performance). And thirdly, AWS gives
us the flexibility to temporarily upscale and downscale when required. With thecapabilities of AWS, we could tailor to the actual requirements of the applications.
Last but not least, since not all applications are 24/7, we could use AWS elasticity toturn them off on the weekends, saving money in the process.

Improving SaaS accessIn the early days, when we moved to the cloud proxy, we had our share of difficulties
with the performance of Office 365. We really struggled to get that done correctly
and have good performance now.
The 2016 phase of the network transformation went very quickly and was completely non-disruptive—people didn’t even know we moved security to Zscaler. Nobody
really noticed that we went from centralized to decentralized, except that some ofthe applications became quicker.
Also, Zscaler was very quick in communicating what they were doing about cybersecurity threats like, but not limited to, WannaCry and NotPetya. They were quicker
to communicate the impact within their environment than other partners. They really did a good job on that one.

5

Deploying SD-WAN
Right now, we are going towards a full SD-WAN (software-defined wide area network). Our strategy involves connecting five FrieslandCampina locations to the SDWAN environment, and that the SD-WAN environment has an NNI (network-to-network interface) with our existing Verizon network. With a full-blown SD-WAN
deployment our redundancy plan includes redundant internet lines and universal
customer premises equipment.
For locations that use applications that require MPLS services, a fit for purpose
MPLS line that is smaller than our legacy MPLS circuit is supplied.
Historically for every location, except locations with call center functionality, theMPLS line was approximately 5 megabits per second, while the internet lines are alot bigger. We also have a failover from MPLS to the internet and the two internet
lines back each other up. Our goal is to guarantee an experience level agreement(XLA) at the application level, rather than a service level agreement (SLA) based on
availability and time to repair. We are aiming for predictable behavior and end-user
experience on an application-based context (device, location, connectivity).
The SD-WAN has what they call universal CPEs at each location. And those universal CPEs will have network function virtualization on them. Actually it’s a device
for compute and storage with a hypervisor, which runs virtual services which arerequired by either the SD-WAN service itself or the application acceleration. Othervirtual network functions can be added if and when required. There will be a growing number of network function virtualizations that we can deploy on those devices.

Picking an SD-WAN partner
In 2017, we initiated an RFI for, amongst other services, a new WAN service.
The vendors invited to the RFI were only given business requirements and we asked
them to really innovate with a disruptive approach. We selected eight vendors toenter the RFP phase, and we started eliminating vendors based on their offeringand presentation of the solution. In the end, three vendors were selected to giveus their best and final offer, namely NTT, Interoute (both proposing the Silver Peak
SD-WAN solution), and Verizon (proposing a combination of Viptela and Riverbed).

6“Do not invest in a

As part of the RFP process, we asked each vendor to present a reference customer
where they had already deployed the proposed solution. And based on discussions

traditional network.

with those customers, we made the final selection. The vendor testimonials wereDon’t do any investments

very important to us in the final phase of the RFP process.

in your existing MPLSwith an internet
backup network.
That’s old school.”Things to consider• 	 Do not invest in a traditional network. Don’t do any investments in your existing
MPLS with an internet backup network. That’s old school. Just make sure thatyou know how your traffic is routing—so where your end users are and where
your applications are—and make sure that you create a network where, basedon the applications, the quickest, most efficient route will be taken. In the end,
users are not interested in technology, they are only concerned that the applications they are working with on a day-to-day basis perform well and perform
constantly. If you have an application that has a 2.5 millisecond response timethroughout all of Asia, nobody is complaining. But if you have one country thathas a response time of one and another of four, then they start talking to eachother and start complaining.
• 	 People are traveling more and working outside of the office, and those people are diverse. Currently, we are bringing people that are roaming back into
our network via two central remote access (VPN concentrated) locations. Withthe use of tools like the Zscaler App, we are looking at alternatives to connect
roaming users to internal applications.
• 	 In the end, if you have your software-defined wide area network, local area network, and software-defined data centers, you need an orchestrator of orchestrators above that to make sure the policies you set on an application, or at ahigher level, flows down to the LAN, the WAN, and the data center. And the next
step is to invest in security in the session between consumer and application.
• 	 I’m looking towards making the network totally irrelevant in the next five toseven years. The network will only be a transport mechanism that makes surethe application goes from A to B, but the data security itself is completely embedded in the communication stream. For example, based on the identity of theclient and on the identity of the application, a secure communication will be set

7

up between them. That will be my next focus, and will be around the 2025-28
timeframe. It could happen sooner, but developments within our company needa business case for change; there needs to be funding for it, and so on. Not onlyis the development of the technology driving this, but also theadaptation and the willingness to spend money in new areas.

Ready to transform your company?
Create business value with Zscaler today.
CONTACT US

REQUEST DEMO

https://www.zscaler.com/company/contact
https://www.zscaler.com/custom-product-demo

About Zscaler Zscaler was founded in 2008 on a simple but powerful concept: asapplications move to the cloud, security needs to move there as well. Today, we are helping
thousands of global organizations transform into cloud-enabled operations.
© 2019 Zscaler, Inc. All rights reserved. Zscaler™ is either (i) a registered trademark or service mark or (ii) a trademark
or service mark of Zscaler, Inc. in the United States and/or other countries. Any other trademarks are the properties of
their respective owners.

8