Client story Dun & Bradstreet builds a global network powerhouse on Google Cloud

Business challenge

Untangling a legacy network

Dun & Bradstreet was operating with a Google Cloud environment that, while functional for its time, was built on an earlier network design philosophy. The core of the challenge lay not in the Google Cloud components themselves, but in their arrangement: a large, centralized interconnect Virtual Private Cloud (VPC) with numerous subnets and regional VPCs. This original setup, implemented several years prior by a previous network owner, was a flat and non-hierarchical design.

This architecture, while basic and operational, led to several accumulating issues as Dun & Bradstreet’s global needs evolved. These included IP address overlap, increasing networking complexities, and ultimately, limited opportunities for scalable growth.

“If you have a large VPC, you’re going to run into multiple quota issues,” says Josh Barry, VP of Network Engineering at Dun & Bradstreet. “That was the impetus to design and install a new network that would be globally scalable, reduce the fault domain and risk domain across the enterprise, and provide for quota limitation reduction.”

The presence of overlapping IP subnets, deployed across multiple regions within different regional VPCs, further compounded these complexities and limited the company’s ability to expand and innovate within their existing network footprint.

Existing multicloud model with limited oversight

Dun & Bradstreet’s existing multicloud operating model, particularly their AWS implementation, was characterized by limited shared services and oversight. While the network team handled direct connect gateways and VPC creation, the vast majority of networking, both internal and external, was managed by individual DevOps teams. This resulted in a multitude of approaches, non-standardization of networking components, and inconsistent security practices.

“We realized the need to move to a center of excellence with shared services oversight in the organizational structure and automation, specifically for networking,” says Barry. “That way we could provide homogenous connectivity and security and enable the DevOps teams to be DevOps teams.”

Additionally, Dun & Bradstreet encountered operational challenges. The monolithic VPC design frequently resulted in quota limitations for forwarding rules on load balancers and the number of allowed subnets. This struggle with quotas often necessitated scaling to new VPCs, cleaning up old ones, or continuously monitoring and adapting processes.

Solution

Dun & Bradstreet’s decision to deepen their commitment to Google Cloud was driven by a multiyear deal. SADA was brought in by Google Cloud to assess Dun & Bradstreet’s major applications and organizational structure. During this engagement, a critical collaboration began to take shape between SADA and Dun & Bradstreet, specifically around the future network architecture. This collaborative approach enabled them to seamlessly blend Dun & Bradstreet’s pragmatic designs with SADA’s expansive architectural vision, forming the foundation for the new network.

“SADA and our team started talking about the network in general,” says Barry. “Then we started collaborating more closely and melded our two network architectures together and got the best of both worlds.”

The meshing of these two concepts enabled Dun & Bradstreet to achieve scalability, redundancy, and cost-effectiveness.

Key components of the network ‘pyramid’

The new Dun & Bradstreet network can best be described as a “pyramid” comprising three distinct layers, each with specific components and functionalities:

• Global WAN VPC (top level): This serves as a global, transitive VPC providing access to any region. For routing and summarization, Dun & Bradstreet transitioned to Juniper Networking appliances. The selection of these known routing appliances was based on guaranteed throughput, commonality of feature sets, and the engineering team’s familiarity and comfort, ensuring long-term support.
• LAN aggregation VPC (middle layer): This layer aggregates traffic from different regions and facilitates minimal scaling. A fundamental aspect of the design at this layer was the inclusion of inherent Layer 7 security. Dun & Bradstreet opted for Palo Alto Networks firewalls to provide scalability and robust North-South and East-West Layer 7 firewalling, leveraging their existing familiarity with Palo Alto products.
• Application VPCs (base layer): This forms the base of the pyramid, housing individual application VPCs.

Addressing redundancy, scalability, and quotas

The new network directly addresses the limitations of the legacy system:

• Redundancy: The global WAN VPC is truly global and transitive, providing redundant access to any region with large routing appliances. This contrasts with the previous setup, where interconnects or high availability VPNs might not always go to different regions, leading to outages during maintenance. 
• Scalability: The pyramid design allows for scalable growth. Additional workloads and quota limitations can be addressed by adding more routers. At the aggregation level, if more capacity is needed, additional Palo Alto firewalls can be implemented, creating new branches. The entire infrastructure is designed for scaling with code, enabling rapid deployment of new regions or increased capacity.
• Quota limitations: The new architecture significantly reduces quota issues by distributing resources across multiple, singular VPCs, allowing each to scale within its own limits. This eliminates the constant monitoring and adaptation previously required for forwarding rules and sub-network quotas.

Planning for three-year growth

SADA played a crucial role in planning for Dun & Bradstreet’s three-year growth trajectory. They conducted multiple sessions with application teams, learning about existing deployments in Google Cloud and AWS, verifying scale, and understanding regional presence and disaster recovery plans. 

This detailed analysis enabled SADA to extrapolate overall growth and plan for scaling over a three- to five-year period, accounting for a large ramp-up in the initial years and a slower one later. SADA even provided financial outlooks, including compute, licensing, and data transfer costs, which were instrumental in securing internal buy-in.

Impact

Transforming the cloud landscape 

As a result of the collaboration between SADA and Dun & Bradstreet, the new network architecture has yielded significant improvements across Dun & Bradstreet’s operations, leading to enhanced scalability, performance, and a more streamlined approach to cloud management.

Improving scalability, performance, and agility

With approximately 30 applications already migrated in the first three months and the network now generally available, Dun & Bradstreet is onboarding new applications on a continuing basis. The immediate impact has been a shift from constant, low-level monitoring of quota limits to higher-level oversight. The new process enables continuous operation without encountering IP space limitations.

“There’s logic within the process, so when an application spins up, it load shares across the regions,” says Barry. “We’re able to keep running, and we’re monitoring at the top level instead of the bottom level. Monitoring clarity is a big win because we’re not looking at each individual thing; we’re looking at specific components.”

Dun & Bradstreet has also achieved a dramatic improvement in agility, enabling the ability to stand up a new VPC region in a single day. Previously, this process would take approximately two weeks, involving setting up a new VPC, configuring code, establishing connections via VPNs, and obtaining interconnects. This newfound capability allows Dun & Bradstreet to scale globally with ease, with licensing in place, and reduce setup time by 93%.

Operational management

The new network, with its VPCs and Juniper and Palo Alto network appliances, has introduced an enterprise-grade network to Dun & Bradstreet. The operational cadence has shifted to a traditional networking model, focusing on firewall changes, Palo Alto configurations, and optimizing specific services. This structured approach, which requires more active management, provides the benefits of a robust and scalable infrastructure.

Empowering network engineers

One of the most significant benefits of Dun & Bradstreet’s new network has been the improved ability of new team members to understand and manage the network. The new network, with its pyramid structure and the integration of familiar Palo Alto and Juniper appliances, offers a more intuitive learning path.

Engineers can start at the top of the pyramid, focusing on mainstream routing protocols and familiar routing devices, then gradually work their way down to the middle layer with Palo Alto firewalls and traditional firewall rules, and finally to the application-specific base layer where Google Cloud’s unique services are more prevalent. This tiered approach allows engineers to learn Google Cloud functions progressively, building their understanding from familiar concepts to more cloud-native services.

Focusing on strategic initiatives

The new network has profoundly impacted Dun & Bradstreet’s ability to focus on strategic initiatives. A key initiative is the transition to a cloud-first network, moving away from reliance on legacy network on-ramp providers with physical limitations. The global VPC enables Dun & Bradstreet to migrate services like remote users, B2B VPNs, and intercloud connections directly into Google Cloud, thereby bypassing physical hardware and manual processes. This shift to direct cloud partner interconnects between clouds provides instant capacity and removes physical constraints, representing a significant win for the organization.

Operationally, the most substantial improvement is the reduction of the risk domain. In the legacy network, a single misconfiguration in the shared VPC could impact an entire region and take down multiple applications. The new model isolates these domains, ensuring that only Barry’s team can access core, resilient components. This means that if someone makes a mistake, it can only impact their own hosting VPC, leaving the rest of the network untouched. “Operationally, that is a massive win,” says Barry.