What Knorr-Bremse needed
Microsoft's own guidance says Microsoft 365 traffic should use local internet egress, so it reaches front-end servers as close to the user as possible. The Knorr-Bremse case study describes a company that had outgrown the older WAN design that this advice moves away from.
According to NTT DATA, Knorr-Bremse was pushing hard into Microsoft 365 and Teams and moving key applications to the cloud. The network had to avoid bottlenecks and outages that could disrupt global collaboration. Its stated requirements were:
- High availability and more bandwidth.
- Quick addition of capacity.
- Prioritization of business-critical applications and real-time services such as calls.
- Direct cloud access for employees over the WAN backbone.
- A link from on-premises data centers to Azure without the cost the company associated with ExpressRoute.
Sites differed a lot. Depending on whether a site did manufacturing, development or office work, the priority might be SAP availability, links to central data hubs or cloud access. The existing MPLS network lacked that flexibility. NTT DATA says speeding up the WAN would also have meant buying more systems.
What was deployed
After what NTT DATA calls an exhaustive evaluation, Knorr-Bremse chose NTT DATA's managed SD-WAN service. The case study describes it as separating control functions from the physical infrastructure. That lets the customer assign connections by bandwidth and latency needs. If a link is congested or fails, traffic moves to the best available connection.
The reported rollout figures:
- Scope: 114 global sites in six months.
- Pace: 85% of sites migrated within four months, and the rest in the following two.
- Hardware: 134 access lines and 224 SD-WAN devices in total.
- Method: Work ran in parallel across Asia, EMEA and the Americas while the legacy infrastructure was being decommissioned.
Sites ran different firewalls, switches and other gear, and some had individual routing requirements. NTT DATA credits a technical preparation plan and close teamwork. It says no line had to be touched twice, though it also admits there were technical and organizational hurdles. Those were handled by coordinating with authorities or arranging provider changes.
Reported results
NTT DATA reports these outcomes:
- Bandwidth and cost: Available bandwidth rose by 330%, and cost per megabit fell by 32%.
- Architecture: Direct cloud access reduced load on the core network. Replacing the old WAN acceleration infrastructure simplified the architecture.
- Support load: Fewer support requests were caused by poor or failed connections.
- Growth: New sites and extra or backup lines are easier to add because software and hardware are decoupled.
- Adoption: Wider Microsoft 365 and Teams use, continued cloud migration, and a stronger link between production and development environments.
Tino Gieslor, Knorr-Bremse's Global Network Manager, says in the case study that SD-WAN gives the company high-speed, robust and secure access to cloud services and data centers.
How to read the numbers
The 330% and 32% figures come without a baseline, a measurement period or a calculation method. The case study doesn't say whether they apply to every site. They can't be turned into absolute bandwidth or total savings. The support-ticket claim has no published before-and-after counts.
The case study also doesn't name the SD-WAN vendor or hardware, the encryption protocols, the service-level targets, or the exact cloud connectivity design. It says only that encryption is built in. It doesn't establish any security certification or compliance outcome.
The ExpressRoute point
Knorr-Bremse wanted Azure connectivity without ExpressRoute's expense. That is the customer's requirement, not evidence that SD-WAN and ExpressRoute are interchangeable. ExpressRoute is a private-connectivity service. The case study doesn't say how the Azure link was built, so readers shouldn't take it as a recommendation to drop ExpressRoute.
Microsoft's partner directory is useful context here. It lists managed SD-WAN, Virtual WAN and ExpressRoute as separate service categories. It shows NTT Ltd offering managed ExpressRoute and managed SD-WAN services. NTT Data appears in the same directory for managed services. That shows SD-WAN is part of Azure's partner ecosystem. It doesn't show that Knorr-Bremse used Azure Virtual WAN or any Microsoft-run SD-WAN product.
Separate Azure story
Microsoft published a customer story about Knorr-Bremse on April 12, 2024. It covers a different project, with Microsoft and MobiLab, moving servers and applications to Azure VMware Solution. It describes a plan to exit 17 datacenters. It also reports Microsoft 365 E5 for 20,000 employees and F3 and F5 licenses for 8,000 frontline workers.
That story shows how heavily Knorr-Bremse depends on Microsoft's cloud. It doesn't show that the SD-WAN caused any of the Azure migration's results. Its headcount (30,500) also differs from NTT DATA's (29,500), probably because of different dates or definitions.
Takeaways for IT admins
Microsoft's own guidance supports the general approach. It says SD-WAN devices at branch offices can send trusted Microsoft 365 traffic to the nearest front door. That skips the WAN backbone and avoids hairpins that add latency. Microsoft also says to check that the local ISP peers with Microsoft's network close to the site.
For teams considering something similar, the practical questions are:
- Which sites depend on real-time traffic such as Teams calls, and which depend on SAP or data-hub links?
- Can your SD-WAN identify Microsoft 365 traffic using Microsoft's published endpoint categories?
- Do your ISPs peer with Microsoft near each site?
- Does your security inspection need to run at every site, or can it be skipped for trusted Microsoft 365 traffic?
- What baseline will you use to measure "bandwidth" and "cost per megabit" before you claim a gain?
The Knorr-Bremse case is a credible example of a large, multi-region WAN move away from MPLS. Its headline numbers are marketing figures until the baselines are shown.