Confectionary leader transforms WAN and security to underpin global cloud and secure SaaS strategy

Cloetta is one of Europe’s leading confectionary companies. It wants also to be known as a leader in sustainability and smart manufacturing. The Swedish business is building a new production site in the Netherlands that it hopes will become a template for modern production techniques and it has pledged to cut carbon emissions by 30%.

“A modern production facility would provide a setting for high-quality and competitive confectionery manufacturing as well as opportunities for future expansion,” says Cloetta CEO, Henri de Sauvage-Nolting. “Such an investment would enable significant progress towards our long-term profitability target and our commitment to the Science Based Targets initiative.”

Creating New Standards in Manufacturing Efficiency

The new facility is expected to be operational by 2025. It will feature a range of smart manufacturing features, from robotics to scanners to autonomous vehicles. This will create new standards in terms of output and efficiency. Cloetta wants these new standards to filter through to its other production sites.

“Our new facility will not just represent a leap forward in productivity,” says GertJan Minkels, Infrastructure Solution Architect, Cloetta. “It will be our most cyber-secure factory, where every element of the production process is tracked and monitored.”

The new site is not intended to be an island of innovation. The business is looking to digitally transform all aspects of its international operations, from logistics to remote working. It has outsourced a number of critical applications, operated as-a-service. A consistent network across seven factories, both in terms of application performance and management, is essential.

“The network team needs to be able to see everything, ensure performance, guarantee security and plan patching,” Minkels explains.

Prioritising Network Traffic

Cloetta’s connected, consistent international operations are built on a standardised Aruba network architecture and connected globally by an Aruba EdgeConnect SD-WAN fabric. This establishes an end-to-end approach, enabling Cloetta to accelerate its digital transformation initiatives on a network covering LAN, WLAN and SD-WAN while also increasing focus on overall security, automation and efficiencies.

“With the explosion of remote working, we have effectively gone from 26 sites to more than 500,” reflects Minkels. “It is more than ever critical for us to accelerate our cloud and SaaS initiatives. This will require enhanced levels of visibility, automation and control which we believe we now have a solid basis for.

This approach hands Cloetta full control of how it routes and prioritises traffic across its network. Network traffic is separated into three dynamic paths. MPLS has traditionally been used for critical workloads such as ERP systems, video and voice traffic. Initially, non-business critical traffic was optimised and accelerated using Internet breakout over secure tunnels to deliver low-latency access to cloud-based applications, ensuring a better user experience. Finally, low-priority public Internet activity is also passed through the SD-WAN gateways to ensure security.

Today, the majority of the critical workloads’ traffic passes over the secure IP circuits, with existing MPLS circuits mainly used as a mere backup. These steps allow Cloetta to eliminate the need for costly routers and save on costs and potential risks associated with its complex and manual configurations. The result gives operational stability combined with cloud-based agility.

“None of this would be possible without a solid, dependable network,” says Minkels. “That is the overall Aruba architecture. We’re now free to focus on application delivery.”

Optimising Application Performance to Improve the User Experience

The clearest impact has been on application performance. “We can optimise application delivery, fine-tune performance and automate it for each specific application. It gives us tremendous flexibility,” says Minkels. “Aruba Orchestrator and EdgeConnect SD-WAN work away in the background, prioritising performance for our most critical workloads.”

For Cloetta, with remote workers, mobile workers, 24/7 operations and international supply chains, this is business critical. Digital workflows now enjoy low latency and are uninterrupted. Users have confidence that applications will perform.

There is also a cost implication. “We want to optimise the user experience but my financial managers also want us to save money,” says Minkels. “With Aruba’s Edge-to-Cloud architecture we’re now able to greatly reduce our MPLS costs by running more applications through lower-cost Internet connections. We’re able to continuously monitor the quality of the circuits, bind them together for more bandwidth and load-balance in case of issues.”

MPLS usage has fallen from 40% to close to 1%, says Minkels. The future, he adds, may involve 5G as a backup.

Strengthening Security to Ensure Business Continuity

The business is also more secure. “Cloud is not the answer to everything but being selective in our use of cloud-based applications reduces our internal footprint. We have scalability when we need it but a better security posture,” Minkels explains.

Visibility, he adds, is essential in helping fight cybercrime. Cloetta is looking at secure access service edge (SASE) to keep the business one step ahead of hackers. As a leading brand and international manufacturer, Cloetta faces the standard ransomware threats but also the risk of hackers stealing IP or tampering with production processes. The new Cloetta factory will be more like a sterile lab than an industrial factory.

“We want to get to a zero-trust model where everything is verified,” says Minkels. “We know we can achieve this at the LAN and WLAN access control level from our Aruba network. On the SD-WAN side, Aruba EdgeConnect gives us the flexibility to integrate their native solution with a host of leading cloud security services.”

Multi-cloud environments may require the use of different cloud security platforms based on cloud service provider preferences, performance and other factors. The Aruba EdgeConnect SD-WAN architecture will enable Cloetta to effectively adopt an open SASE model, with the ability to seamlessly integrate different platforms. This will lead to a flexible network edge security as-a-service model – NESaaS.

Greater Visibility and Simplified Integration

Fundamentally, the standardised Aruba architecture simplifies the way Cloetta manages its enterprise connectivity. As the business tests and deploys a range of new applications, a combination of discovery, profiling, policy-based automations help reduce the strain on the IT team and allow resources focus on exploring innovation.

In addition, the open Aruba architecture ensures a consistent network with the means to integrate new third-party platforms such as IoT through open-APIs. This seamlessly extends the zero-trust approach to those platforms, allowing Cloetta to treat its entire environment as a unified network.

“It changes our role,” says Minkels. “We’re less hands-on with the network and more of an orchestrator. We have a lot more intelligence in the platform.”

Standard components across multiple sites mean swap-outs or replacements are easier to manage and simpler to support. “We have some pretty testing environments – high temperatures, busy machinery and lots of dust. We can carefully monitor when a switch needs replacing so as to minimise disruption.

“Where possible, we want to reduce complexity. Aruba provides visibility and easier integration. We’re a small team. The less you’re running, the easier it is to manage.”