Providing Out-of-Band Connectivity to Mission-Critical IT Resources

How to Use a Cloud Managed Gateway Router to Optimize OT Automation

cloud managed gateway router

The right cloud managed gateway router simplifies edge network management and unlocks remote access to operational technology (OT). In this blog, we’ll explain what OT automation is, how to manage it with a gateway router, and what to look for in an ideal solution.

What is operational technology (OT)?

Operational technology, or OT, controls equipment interacting with the physical world. The term is used to differentiate these systems and devices from information technology (IT), focused on non-physical data computing.

OT manages the physical equipment used for industrial manufacturing, water and energy utilities, medical procedures, building management, and other physical processes.

Some examples of operational technology include:

  • Programmable logic controller (PLC) – Controls assembly lines, industrial machines, robotic devices, and other manufacturing processes.
  • Supervisory control and data acquisition (SCADA) – A control system for high-level supervision of industrial machines and processes, including PLCs.
  • Building management system (BMS) and Building automation system (BAS) – manage a building’s mechanical and electrical equipment such as lighting and HVAC.

OT facilitates industrial automation, by reducing manual intervention required to control and optimize physical technology. OT automation systems are traditionally isolated from IT networks, running on specialized industrial computers. However, modern OT systems are converging with IT to allow operators to manage them via network-connected PC or even from a cloud platform.

Using a cloud managed gateway router to optimize OT automation

Frequently, OT devices operate outside your main headquarters, in remote facilities such as factories, warehouses, data centers, and branch offices. In the past, that meant you needed operational technology installed at each location, with operators on-site to monitor OT automation computers. However, IT/OT convergence enables you to connect operational technology to edge network gateway routers, facilitating remote control via specialized software or a cloud-based application.

Gateway routers connect remote facilities to WAN or SD-WAN architectures, providing seamless and secure access to enterprise network resources. They also provide administrators with access to monitor and manage edge network routing and security. Some gateway routers also function as serial console routers, which means they can be used to directly manage the devices connected to them—including operational technology. A cloud managed gateway router with serial console capabilities gives administrators the ability to control remote networking and OT systems anywhere.

One of the issues with remote OT automation is that it may consist of several different systems and applications. For example, a managed service provider (MSP) may need to control HVAC, power distribution, security systems, and other infrastructure for many different clients using a variety of OT computers. They may even have some old analog gauges in place which they monitor with a cheap IoT camera.

Each of these disparate OT systems has its own application or cloud portal that operators must learn, configure, and manage, which is inefficient and creates risk of human error. A vendor-neutral cloud managed gateway router can solve this problem by bringing all your OT applications together under one unified platform.

What to look for in a cloud managed gateway router

Not all cloud managed gateway routers are optimized for OT automation. Let’s examine what an ideal solution looks like.

 Hardware

The gateway router itself should use high quality hardware, and it should integrate with high quality operational technology hardware as well. You should secure the router hardware with features like cryptographic modules and geofencing to prevent tampering if the devices are stolen or intercepted in transit. A vendor neutral gateway router also needs to support various hardware connections such as RS-232, RJ-45, USB, and IPMI so you can ensure compatibility with your various OT systems, including analog and IoT solutions.

 Operating System

The OS that runs on the cloud managed gateway router should be hardened and frequently patched to prevent hackers from exploiting vulnerabilities. The provider will update an ideal solution, so you don’t have to constantly stay abreast of all new security vulnerabilities or keep on top of the vendor’s patch schedule. A vendor neutral gateway router should run on an open, Linux-based OS to allow easy integrations with OT software.

 Zero touch provisioning

Zero touch provisioning (ZTP) allows you to automatically deploy device configurations over a network connection. A cloud managed gateway router should have ZTP capabilities both for itself and for other connected devices. This eliminates the need for pre-staging so that you won’t risk a configured device falling into the wrong hands during shipping. It also reduces the need for engineers to travel on-site to install and configure new devices, saving time and money.

 Connectivity

The gateway router’s primary job is to provide remote systems and users with a reliable connection to the enterprise network, ideally using SD-WAN technology. It should also provide a dedicated out-of-band (OOB) management connection, so administrators have reliable access to control and troubleshoot the remote network. An ideal solution includes high-speed failover via 4G/5G to ensure seamless connectivity for both administrators and end-users.

OOB provisioning and management

Provisioning and changing device configurations over the production network is risky. There’s always the chance that a configuration mistake could take the whole network offline. That’s another reason why a cloud managed gateway router should provide an OOB network connection, so you can deploy and modify device configurations without affecting the production network.

 Orchestration

A cloud managed gateway router should provide orchestration so you can coordinate automated tasks and workflows across all your OT systems. This brings all OT applications together behind one pane of glass, facilitating efficient management and powerful optimization. End-to-end OT automation at the edge is only possible with a truly vendor-neutral gateway router that supports integrations with your choice of OT solutions, automation tools, and scripting languages.

A cloud managed gateway router with these features will empower efficient OT automation at the edge.

Why choose the Nodegrid cloud managed gateway router solution?

The Nodegrid line of cloud managed gateway routers delivers powerful edge network management optimized for operational technology automation. Features like secure zero touch provisioning and gen 3 OOB management support efficient and low-risk operational technology deployments while ensuring constant availability. Nodegrid’s vendor-neutral hardware, operating system, and cloud-based management platform can integrate all your OT solutions for true end-to-end orchestration.

Learn more about edge network orchestration:

→  Simplifying Network Edge Orchestration with a Single Platform
→  Edge Computing Trends to Expect in the Post-Covid World
→  Out-of-Band Is a Lifesaver for Critical Edge Networking. Here’s Why…

Learn more about the Nodegrid cloud managed gateway router.

Call 1-844-4ZPE-SYS or  Contact us online!

Contact Us

The Benefits of Vendor Agnostic Platforms in Network Management

vendor agnostic platform

There are two basic approaches to choosing a network management platform: you can stick with a single vendor’s ecosystem of supported products, or go with a vendor agnostic platform. In this post, we’ll explain what a vendor agnostic platform is and how this approach can benefit your organization.

What is a vendor agnostic platform?

A vendor agnostic platform supports integrations with all (or most) viable and established networking solutions. That means both the technology needs to work well with other systems, and the vendor needs to provide adequate documentation and support for those third-party integrations.

Vendor agnostic vs. vendor neutral

These terms are synonymous, and any perceived differences are generally just marketing. Some companies may use the term vendor neutral to imply that a platform is typically open to integrations, without specific support from particular vendor solutions. By comparison, they would say vendor agnostic platforms provide specific integrations and the support infrastructure needed to work with leading third-party solutions.

In fact, these terms are used interchangeably, and these distinctions aren’t applied consistently across the industry. A platform described as vendor neutral almost always provides the same level of integration support as a vendor agnostic platform, so you shouldn’t let marketing fluff influence your purchasing decision.

The benefits of vendor agnostic platforms in network management

Taking a vendor agnostic approach to network management provides numerous benefits, such as:

 Lower costs

Without a vendor agnostic platform, you’re stuck with a single vendor’s ecosystem of products. That means you’re limited to choosing among the hardware and software offered by that vendor, regardless of the price. Often, this approach results in spending too much money on solutions that offer more functionality than you really need. On the other hand, you could find yourself choosing a product that doesn’t quite fit your needs just because it’s all that’s available within your budget.

A vendor agnostic platform gives you a wider variety of options for building out your network infrastructure. You can shop around for solutions that provide all the functionality you need at a price you can afford, knowing that they will all still integrate with your network management platform. With a vendor agnostic platform, you’re much less likely to pay for features you don’t need, helping you reduce operational costs.

 Specificity of features

On a related note, another issue with a single-ecosystem approach is that you’re limited to the functionality offered by that vendor’s network management platform. You may have multiple tiers of features that you can unlock for an additional cost. Still, there’s often no way to customize your solution with the exact functionality you want or need. That means you either pay extra for a whole suite of additional features—some of which you don’t need or want—or save money by compromising on functionality. Plus, if your requirements change later on, you’ll have fewer options to alter, scale, or manage.

The vendor agnostic approach, by comparison, leaves you with many more options for customization. You can shop around for a platform with all the needed functionality built-in, or look for third-party integrations to add that functionality to your existing solution. That also means you can scale and modify the platform at will or as your business grows and requirements change. A vendor agnostic platform allows you to build a completely customized solution with the specific features needed to manage your network optimally.

 Automation and orchestration

As enterprise networks grow more extensive, complex, and highly distributed, managing these networks with entirely manual processes is less viable. Many closed vendor ecosystems provide some built-in automation functionality, but they typically don’t allow integrations with third-party automation scripting languages and solutions. Plus, the more automation you employ, the more you need centralized orchestration to manage and deploy that automation. A single-vendor orchestration platform may work for solutions within its ecosystem but will struggle to get its hooks into any legacy devices or third-party systems.

A vendor agnostic platform doesn’t suffer from these limitations. By their very nature, they support integrations with leading automation tools, so you can use the scripting languages you’re most comfortable with and the third-party solutions that work best for your use case. And with vendor agnostic orchestration, you can ensure that you have total coverage even across legacy and hybrid infrastructure. A vendor agnostic platform empowers you to automate and orchestrate your network with the best tools for the job.

  NetDevOps

NetDevOps is a methodology that combines Networking, Development, and IT Operations into a unified and collaborative team working towards common goals. Successful NetDevOps transformation requires abstracting your network and infrastructure management as software code decoupled from the underlying hardware.

This software abstraction makes it easier to use automation to deploy, update, and manage configurations, which means developers get the resources they need to deliver code faster. You can also use automation to manage, optimize, and troubleshoot the network through software-defined networking (SDN) and software-defined wide area networking (SD-WAN). This ensures optimal performance and high availability for applications and end-users.

A vendor agnostic platform is crucial to full NetDevOps transformation because the goal is to merge networking, development, and operations under one umbrella. That means you need a management platform that can extend its reach across all your networking appliances, virtual or physical servers, and development tools and resources. This gives organizations a complete picture of their entire NetDevOps environment and facilitates the creation of a fully integrated software development pipeline.

Vendor agnostic network management and orchestration with Nodegrid

Vendor agnostic platforms can help you lower costs, get the specific features you need, automate and orchestrate your network, and achieve NetDevOps transformation. For example, the Nodegrid platform from ZPE Systems can “say yes” to every vendor device and solution on your enterprise network. Nodegrid works with your choice of third-party systems, automation tools, scripting languages, and NetDevOps solutions so you can manage and orchestrate your complex infrastructure from behind one pane of glass.

Learn more about the benefits of vendor agnostic network orchestration:

→   Orchestrating Hybrid Network Environments: Challenges, Solutions, and Best Practices
→   Why Choose Nodegrid as Your Data Center Orchestration Tool
→   Hyperautomation vs Automation: How Are They Different?

See a demo of the Nodegrid vendor agnostic platform at work.

Call 1-844-4ZPE-SYS. Contact us!

Contact Us

Part 2: Immutable Infrastructure: Best Practices for Network Professionals

immutable infrastructure best practices
Immutable infrastructure involves servers, network appliances, and other devices which are never updated or changed. In part 1 of our blog series, we discussed the most inherent challenges with the immutable infrastructure paradigm. This post will cover immutable infrastructure best practices that you should follow to overcome these challenges and fully embrace immutable principles in your enterprise.

Immutable infrastructure best practices for network professionals

Infrastructure as Code (IaC)

Infrastructure as code, or IaC, uses software abstraction to separate infrastructure configurations from the underlying hardware, allowing you to write configurations as repeatable scripts that you can deploy to many different devices. It also facilitates automation and orchestration through tools like RedHat Ansible, which stores and automatically executes configuration scripts according to predefined playbooks.

IaC is used traditionally for physical and virtual server configurations, but you can also use it to create and maintain virtualized network device configurations. This is sometimes called network infrastructure as code or software-defined networking (SDN). SDN goes beyond just abstracting configurations from the underlying networking hardware. It virtualizes your entire network, creating an overlay for managing and optimizing network routing, load balancing, segmentation, and more.

IaC is an immutable infrastructure best practice because it allows you to create and deploy configurations quickly and at scale. It enables truly immutable infrastructure that you can copy, delete, and replace at will. Without IaC, you must provision each new and updated instance manually. Even with a large team of engineers, updates could take a long time, and intermediate periods during which different versions of the same server or network configuration were active simultaneously will appear. Plus, manual configurations are error-prone, and mistakes could create vulnerabilities in your network.

Infrastructure as code and network infrastructure as code allow you to deploy virtual configurations programmatically and automatically. For immutable infrastructure, IaC is frequently used to deploy and configure images for containers and other virtualized environments.

Golden images

A golden image is a standardized template for physical or virtualized infrastructure. You start with a base image with only the software and settings required universally across all instances of that device. Then, you install any agents or services needed for monitoring, threat detection, analysis, etc. Finally, you harden the image with security policies and tools, and patch any known security vulnerabilities. Once the golden image is complete, you freeze it so no further changes can be made.

Best practices for creating, securing, and updating golden images for immutable infrastructure include:

  • Incorporate as many dependencies and settings as possible in your golden image to reduce the amount of configuration that needs to happen at deployment. This will ensure that the golden image you’ve tested and validated is as close as possible to the final production configuration. It will also make it faster and easier to scale.
  • Continuously scan and analyze golden images for new security vulnerabilities. That way, you can create and deploy patched versions as soon as possible, hopefully before a malicious actor has time to exploit those vulnerabilities.
  • Fully decommission old images once they’ve been replaced with newer, more secure versions. This will ensure a consistent and secure environment, and decrease the risk of accidentally spinning up new instances with old images.
  • Store golden images in multiple locations on a micro-segmented network. Use zero trust security to create granular policies and build  customized micro-perimeters around your golden images. This will protect your images from exfiltration or unauthorized modifications. It will also ensure access to golden images for recovery purposes even if you must isolate particular micro-segments during a breach.

Golden images for virtualized servers and network devices can be deployed, modified, and updated through IaC orchestration platforms—Like AWS, Azure, etc. This further streamlines the provisioning of immutable infrastructure, ensures consistent configurations across instances, and facilitates fast and easy scaling.

Stateful and persistent data

You should strive to make infrastructure and data as ephemeral as possible. Still, there are cases where you’ll need data to persist as you’re creating, deleting, and copying immutable resources. For stateful and persistent data, you should use mountable storage attachable to new instances when old ones are terminated.

Make sure you separate the ephemeral data from stateful/persistent data, so you only keep what you absolutely need to. This will help you reduce storage costs and simplify your overall operations. In addition, you should ship log files off immutable instances and send them to a centralized monitoring server as frequently as possible to ensure they persist.

Implementing immutable infrastructure best practices in your enterprise

Many of these immutable infrastructure best practices rely on modern, software-defined technology stacks, making it challenging to apply them to legacy infrastructure. You also need clear, centralized orchestration to see and control every piece of your immutable infrastructure, even across highly distributed networks with remote branch and edge locations. Finally, all of your immutable infrastructure solutions must work together seamlessly regardless of vendor or ecosystem.

ZPE Systems can solve all these challenges with the Nodegrid network orchestration solution. Nodegrid supports network functions virtualization (NFV), which turns your physical networking appliances into virtualized solutions you can configure and manage through IaC and SDN. Nodegrid’s vendor-neutral serial console servers also support legacy pinouts, so you can bring your legacy physical infrastructure under your immutable orchestration umbrella.

The ZPE Cloud network orchestration platform can also control remote data center, branch, and edge infrastructure. You can host your choice of SD-WAN (software-defined wide area networking) solution on your Nodegrid devices or use ZPE Cloud’s SD-WAN app. This technology allows you to extend the reach of your virtualized network orchestration to your WAN architecture. To dig even deeper, you can use the SD-Branch app to control branch and edge LANs as well.

The ZPE Cloud platform and all Nodegrid devices are truly vendor-neutral, allowing integrations with leading third-party IaC, SDN, and security providers. Nodegrid empowers you to create a tightly-integrated, seamless immutable infrastructure solution for total network control.

See how Nodegrid can help you implement immutable infrastructure best practices in your enterprise.

Call 1-844-4ZPE-SYS to view a free demo.

Contact Us

Cisco Live tips to help you make the most of the show

Whether you’re a newbie or a veteran, these Cisco Live tips can help you get the most out of the show. It’s been a couple years since the last event, and our team wanted to give you some expert advice based on their own experiences. Let’s dive into these valuable tips to help you make your Cisco Live experience a success.

Abstract blurred event exhibition with people background, business convention show concept

 

Attire and gear for Cisco Live

Cisco Live is a huge show where you’ll be surrounded by attendees and vendors. These may include potential (or existing) customers, partners, and competitors. There’s also so much to do and learn at the show. It’s important that you consider these factors when choosing your attire and what you’ll be carrying with you throughout the week.

Dress for your purpose, but stay comfy

  • If you plan to meet with customers, partners, or executives, make sure that you represent your business appropriately. This doesn’t mean going formal from head to toe, but it does mean dressing business casual.
  • Otherwise, it’s ok to wear shorts, a t-shirt, your favorite baseball cap, etc.
  • Remember to bring a light jacket or something to keep you warm, since the venue will be air conditioned and can get pretty chilly.
  • Wear good shoes! No matter why you’re going to Cisco Live, remember that you’ll be on your feet a lot. Invest in a quality pair of shoes that will give you plenty of support and keep your feet from getting too sore by the end of the day.

Bring only essential gear

  • When you’re packing for your trip, pack your suitcase lightly. That’s because you’re going to end up with plenty of free swag and prizes, like shirts, hats, trinkets, and other souvenirs.
  • Remember that you’ll be on your feet a lot, so stay as lightweight as possible and leave anything extra back at your hotel. But aside from your badge, do remember to bring these three essential items:
    • Water – You’ll be walking, talking, and listening throughout the event, which means you won’t always be near a vendor who has drinks handy. Make sure to bring your own water to stay hydrated. And if you’re the type who’s prone to headaches from all the stimulation, bring your headache meds of choice.
    • Phone, laptop, notepad – If you scheduled a lot of sessions or only a few, there will be a ton of good information you’ll want to bring home with you. Make sure to bring something you can use for note taking, like your phone, tablet, laptop, or old-fashioned pen and paper.
    • Lightweight bag – Bring your own pack so you can store the rest of your essentials as well as any freebies you’ll accumulate throughout each day. But remember to stay lightweight and wear a bag you can comfortably carry all day, even as it starts to fill up.

At the show

Due to Cisco Live being canceled for the last two years, you might need a refresher. Don’t worry — here are some great Cisco Live tips on what to do once you walk through the expo doors.

  • NetVet – If this is at least your fourth event in the last five years, you’re officially what’s called a “NetVet”. Be sure to get your special badge that indicates your status. This gives you access to the exclusive NetVet lounge, which features better drinks and snack foods. This small amenity really goes a long way in helping you stay hydrated and energized throughout the days. Plus, if you plan to go next year, your NetVet status gives you access to the session scheduler one week in advance of it being available to other attendees.
  • Twitter – @CiscoLive is like the eye in the sky while you’re at the show. Follow to stay up to date on any scheduling changes, see what’s trending or making waves, and ask questions to get quick responses. If you need to know the location of a session or vendor, or want to know what time your next event starts, ask @CiscoLive and you’ll get a response within minutes.
  • Cisco Events app – Go to Google Play or the App Store to download the Cisco Events app. This will help you stay on track and make it in time to your scheduled sessions and events.
  • Session IDs – Speaking of sessions, write down the session IDs. The presentation slides will be available for download (sometimes a couple days after the session). Having each session ID handy will help you find and download them.
  • World of Solutions – The World of Solutions is filled with vendors, many of which you’ve probably never heard of. Take your time to talk to these vendors. Chances are, you’ll at least make some new business friends, or better yet, a new partner or customer.
  • Breaks – With so much going on during Cisco Live, remember to take breaks throughout the day. It can be easy to get caught up in back-to-back discussions before realizing you’ve been on your feet for hours at a time. The constant stimulation can also take its toll, especially if you’re prone to headaches. Be sure to visit the NetVet lounge or find a place where you can at least give your feet (and your brain) a rest.

After the show

  • Reflect – What went well? Was there anything that really surprised you? What sessions bored you, and why? Was there anything you could have done better? Ask yourself many different questions and reflect on Cisco Live while it’s still fresh in your mind. This not only helps you remember important details you might have forgot to write down, but also gets you thinking about how to get more out of the next event.
  • Plan for the next show – If you’re a vendor, you know it can be really competitive to secure booth space for Cisco Live. This is why it’s important to start planning, so you can get the booth you want as soon as registration is available.
  • Keep your badge – If you’re going to Cisco Live next year, be sure to keep your badge. It’s not just a souvenir; it can also help you maintain or prove your NetVet status. Cisco Live attendance hovers in the 20,000 – 25,000 range, and sometimes your information can get mixed up or fall through the cracks. Having your badge handy for next time will help you and the event staff get you in even if there’s a mixup in your NetVet status.

Want more great Cisco Live tips?

Follow us on LinkedIn and Twitter to stay up to date on Cisco Live and other events.

Cisco Live: ZPE Systems Unveils Automation Blueprint for ~100% Network Uptime

CLUS22

Las Vegas, NV  Jun 14, 2022 — ZPE Systems, the leading provider of out-of-band management to global tech giants and enterprise business, unveiled its platform for ~100% network uptime and cybersecurity at Cisco Live 2022. As enterprises now require a holistic approach to achieving reliable and secure networks, out-of-band is being recognized as a critical component in automation and security. ZPE’s proven Generation 3 out-of-band automation and Cybersecurity as a Platform (CaaP) are helping organizations achieve near 100% reliability and holistic security.

IT teams normally struggle to meet these demands, because current automation solutions have three major limitations:

  1. Limited scope of capability (i.e. can’t replace remote hands for tasks such as reloading switch firmware from USB-connected devices)
  2. Automation performed in-band, which leads to anxiety of making unrecoverable mistakes
  3. Lack openness and extensibility for performing Day 0 and ongoing maintenance

Achieving holistic cybersecurity is also a requirement of modern networks, but is stifled by similar interoperability issues; the market is saturated with too many security products from too many vendors. Enterprises need to deploy these multi-vendor solutions, but doing so creates security and operation gaps, vendor lock in, and a lack of flexibility.

ZPE’s out-of-band automation and Cybersecurity as a Platform solve these challenges. With the new release of Nodegrid OS version 5.6, available for upgrade to all Nodegrid serial consoles and services routers, enterprises can build a truly multi-vendor ecosystem of best-of-breed solutions with cloud management. These include automating the Day 0 installation, licensing, and ongoing operation of security solutions from prevalidated providers such as:

  • Ansible, Gluware, Stackstorm automation
  • On-ramp to Cisco SIG/Umbrella/CDFW
  • Fortinet firewall
  • Palo Alto Networks’ PANOS firewall
  • ThousandEyes agents
  • And many others

Working alongside 6 of the top 10 global tech companies, ZPE Systems has developed a proven automation blueprint. This blueprint includes the simple out-of-band and in-band infrastructure elements that can run directly on Nodegrid, and can be orchestrated to meet business requirements. This includes automating configuration change management, network monitoring, and attack responses, enabling enterprises to effectively prevent downtime and ensure cohesive, multi-vendor cyber protection. The blueprint also features an ‘undo’ button that allows teams to revert to their last safe configuration, which eliminates the anxiety associated with automation.

Koroush Saraf, VP of Product & Marketing at ZPE Systems (former VP of Products at Fortinet and Palo Alto Networks) states, “There are great products from Fortinet, Palo Alto, and thousands of other vendors, some of which we saw recently at RSA Conference. But enterprise cybersecurity is a team sport and can’t be solved by just one of them alone.”

With the delivery of services and products requiring many vendors — for SD-WAN, firewalls, network experience monitoring, event response — enterprises are at increased risk of error and attack.

“Putting so many different solutions together inevitably causes complex operations and leads to security gaps, especially in today’s hybrid infrastructures and emerging, hard-to-access edge compute locations,” Koroush continues. “Enterprises need a platform that just brings it all together into one ecosystem, with the ability to host SD-WAN, NGFWs, Pen tests, agents, and intelligent edge compute workloads. Nodegrid innovations solve this problem with out-of-band orchestration to achieve the Zero Pain Ecosystem of multi-vendor products.”

Nodegrid’s open automation and cybersecurity reduce the impact of configuration changes and decrease attack response times. Nodegrid also supports 5G for out-of-band and in-band networks. This provides redundancy and the flexibility to deploy at remote locations, but also serves as a path for improving operational performance and costs, increasing speeds, and applying intelligent, low-latency automation to routine tasks.

We showed this out-of-band automation blueprint at Cisco Live, and we’re optimizing it for release to the general public. To get your copy, click the button below and add your name to the list:

Read the source version on Business Wire.