O-I Glass, Inc., is a $6.9 billion manufacturer of distinctive glass bottles and jars. Its customer roster includes producers of Scotch whiskey, French wine, German cola, Spanish olive oil, Caribbean rum, New Zealand pale ale, smoothie shots, juices, mineral water, milk, and yogurt.
Headquartered in Ohio, O-I had been running an MPLS network to connect its 25,000 employees spread across 70 plants in 19 countries. But change was needed to keep pace with the migration of applications to the cloud, the shift of workers to home offices, and the company’s efforts to reimagine the glass manufacturing process, says CIO Rodney Masney.
“The needs of the business changed materially in terms of speed, performance, connectivity and flexibility into our plants, and all of our locations around the world,” says Masney.
O-I decided to replace the MPLS network from AT&T with secure access service edge (SASE) from Cato Networks. Masney reports that the transition has been fast, smooth and cost effective—he estimates the savings at 20% to 30%.
The switch to SASE enabled O-I to increase WAN bandwidth by a factor of three, which has translated into “better interaction with cloud applications, a better user experience, and better collaboration across the organization.”
It also created the opportunity for O-I to deploy HoloLens, the Microsoft augmented reality/mixed reality system, for remote engineering on the factory floor.
Drivers for using SASE
Covid was a contributing factor, but not the main driver for the move away from MPLS. When the pandemic hit, the company quickly ramped up what it calls “connected work” for office employees, who now have the option to work from the office or from home. “We like to say that people have a choice. They can work from wherever they do their best every day,” says Masney.
Building a hybrid work environment on a global scale required a different way of thinking about the network, security, and performance for employees wherever they are located, says Masney.
But an even more significant driver was digital transformation. The goal was to deliver increased performance at reduced costs, while maintaining high standards for security. “Any IT professional who isn’t lying awake at night worrying about cybersecurity probably isn’t paying attention,” Masney adds.
He describes the O-I approach this way: “We’re not a cloud-first company. We’re a cloud-where-it-makes-sense company. That means financial sense and sense for our business. We use Azure services where it makes sense, and SaaS where it makes sense, and on-premises where it makes sense.”
The largest cloud workload is Office 365, says Masney, with 25,000 employees on Outlook, Teams, SharePoint, OneDrive, etc. The company is an SAP shop for its core ERP systems, and uses a variety of other SaaS applications, such as SAP Success Factors for HR-related functions.
He adds, “That leads even more to a SASE solution like Cato where we can leverage their capabilities whether things are on or off premise, or your people are on or off premise.”
While glass making is an ancient art, modern glass container manufacturing is a highly sophisticated, automated process. Glass is finding renewed popularity as a sustainable, recyclable alternative to plastic, and O-I’s strategy is to drive growth by transitioning to a modular glass production line that provides the flexibility and agility needed to quickly fill custom orders.
How O-I Glass chose a SASE vendor
Masney said his team conducted proof of concepts with several SASE providers. He was looking for one that could deliver the service quickly, that could assure security at the network edge, and that could bring about cost savings. He was also looking for a vendor whose strategy and vision matched O-I’s long-term goals.
SASE is a service that encompasses several technologies, such as SD-WAN, Zero Trust Network Access (ZTNA), firewall-as-a-service (FWaaS), cloud-access security broker (CASB), and secure web gateway (SWG). Masney says the Cato offering checks all of those boxes.
His initial estimate was that the global rollout would take 12 to 18 months, but O-I was able to deploy at most sites within six months. His team started transitioning from AT&T’s VPN service in July and completed that part of the project by September. “I’m a go-fast kind of guy. This technology really helps you accelerate deployment,” says Masney.
Masney hired a third-party service provider to install Cato SD-WAN hardware (which Cato refers to as sockets) at O-I locations around the world. Masney said he ordered two appliances per site for redundancy. That service provider worked with Masney’s internal team and Cato to make sure everything was properly set up and documented.
As part of the transition from MPLS to SASE, O-I needed to find an ISP to deliver last-mile connectivity between its plants and Cato’s cloud. Interestingly, Masney was able to continue to work with AT&T, which now provides that high-bandwidth internet transport in most locations, except where O-I had pre-existing contracts with local ISPs.
“We’ve maintained a good relationship with AT&T,” says Masney. “SASE solutions are the future of how companies are going to work, whether it’s Cato or their competitors. But we managed it very professionally with AT&T and they still have the opportunity to earn business because there are other things in their portfolio that we can leverage.” O-I uses AT&T for fixed line voice, mobile and other services.
Masney adds that his overall strategy is to have strong relationships with a limited number of strategic vendors. And he hasn’t unplugged all of his MPLS links. In some key locations, MPLS is being used to provide redundancy for mission-critical traffic.
The migration is now “90-plus percent” completed. And in the remaining cases, he is just waiting for the high-bandwidth internet link to be set up. “It’s not a Cato limitation, it’s bandwidth availability,” he explains.
SASE enables augmented-reality headsets
Masney explored augmented reality several years ago when Google Glass first came out but says O-I didn’t have the infrastructure to support it. “With the help of Cato, we’ve enabled ourselves to do things we couldn’t have done in the past.”
Currently, O-I is using HoloLens headsets to connect engineers who might be located at different plants or on different continents. “You might have an engineer in Toledo, Ohio, helping someone in Europe in a manufacturing facility,” he says.
Each engineer would be wearing a headset and the on-site engineer in Europe would deploy the HoloLens front-facing camera to send real-time video to the engineer in Ohio. The supporting engineer is then able see what the other engineer is seeing and provide real-time guidance.
“In the past there would have been phone calls or travel to the location, which is time consuming and expensive. This helps to avoid delays in time to resolution, says Masney.
Masney adds, “We’re using Wi-Fi in our plants, then allowing video streams to go across the WAN to use on the other end. It’s very important that they can see things in real time. Based on our previous technology it was difficult to do. [SASE] helps enable us in a way we wouldn’t have been able to do very readily or cost effectively through traditional telecom.”
The next step is to expand the use of HoloLens for applications like plant maintenance, simulations, and training. One important factor that comes in play in a manufacturing scenario is the safety of the worker wearing a headset. “We want to make sure we don’t obstruct the view of an employee in a manufacturing plant where lots of things are moving all at once,” explains Masney. But beyond that, “I see almost limitless potential of that technology,” he says.
SASE benefits
Masney cites several benefits associated with the move to SASE. By shifting his WAN expenditures from MPLS to internet bandwidth, he was able not only to boost overall bandwidth, but also create redundancy and flexibility. The Cato SD-WAN appliance can connect to the internet, to MPLS, and to cellular networks. Plus, he can more readily boost bandwidth, if needed.
Masney adds, “I see this as enabling other things we need to do on the cybersecurity front to drive detection, identification, response and remediation in the event of a cybersecurity event. It liberates you to think about things that you can do that were historically a barrier.”
In addition to basic SASE, O-I also bought a last-mile service from Cato in which the vendor assumes responsibility for monitoring and troubleshooting performance hiccups on the ISP’s end. For example, if there’s a problem, Cato will be the one opening trouble tickets with the carrier and following through to make sure the issue is resolved.
The SASE deployment is just finishing up, so Masney doesn’t have any metrics yet on how the service will free up his internal staffers to tackle other projects, but he says, “I believe we will see an opportunity to liberate capacity to do other important projects that need our attention.”
All in all, “It’s a pretty exceptional outcome at the end of the day,” says Masney.