CONTACT US
1-844-4ZPE-SYS
ZPE CLOUD

Providing Out-of-Band Connectivity to Mission-Critical IT Resources

Home » Improve Network Security » SD-WAN » Page 7

The Definitive SD-WAN Security Checklist for Enterprise Networks

by | Oct 4, 2022 | Modernize Legacy Environments, SD-WAN, Secure Access Service Edge (SASE), Security Service Edge (SSE), Simplify Branch Infrastructure, Uncategorized, Zero Trust Security

sd wan security checklist

Software-defined wide area networking, or SD-WAN, has made it possible to efficiently control highly distributed WAN architectures using software abstraction and automation. SD-WAN adoption is increasing, partially due to the rise in remote work during the pandemic, with experts predicting a compound annual growth rate (CAGR) of 26.2% between 2022 and 2028. However, while SD-WAN solves a lot of remote, edge, and branch networking problems, it also introduces security concerns that must be addressed. This definitive SD-WAN security checklist highlights the most important challenges and provides solutions for overcoming them. 

The definitive SD-WAN security checklist

Keeping an SD-WAN architecture secure requires several features to be successful. It’s vital to consider this comprehensive list. 

1. Frequent security patching

Outdated operating systems create a significant security risk. According to a 2016 Voke Media survey, about 80% of breaches or failed audits could have been prevented by patching outdated software or updating device configurations. An SD-WAN router with an outdated OS is more likely to have vulnerabilities, and the longer it goes unpatched, the more likely a hacker is to find and exploit those vulnerabilities.

However, SD-WAN architectures are often multi-vendor and highly distributed, making it challenging for administrators to monitor for vulnerabilities and stay on top of patch schedules. There are two primary ways to overcome this difficulty:

  • Centralized SD-WAN management platforms provide a single pane of glass from which to monitor and update device software. The right platform is vendor-agnostic, so administrators can easily patch any and all vendor devices from one common interface.
  • Automated patch management software helps keep OSes up to date by automatically applying new updates based on a predetermined schedule. Some solutions even perform automatic vulnerability scans or can monitor environments for missing patches and apply new updates that fall outside of the usual patch schedule.

Your ability to keep SD-WAN device software secure ultimately depends on the vendor’s patch schedule. Some providers are sluggish to patch known vulnerabilities in their software, either because they think they can keep said vulnerabilities a secret or because they don’t want to dedicate the time and resources needed to keep the OS up to date. That’s why you should look for SD-WAN hardware and software vendors who are transparent about vulnerabilities and who work diligently to release frequent patches and updates. 

2. Zero Trust Provisioning

SD-WAN platforms are software-based, but they still require underlying networking hardware at each remote site for connecting to the enterprise network. Deploying this hardware can be difficult, especially when SD-WAN sites are in hard-to-reach locations such as offshore oil rigs, remote weather stations, or nations experiencing disasters or active conflicts. Often, organizations opt to pre-stage devices in their home office and then ship them to remote sites so they can avoid costly or dangerous travel.

Pre-staging creates a security risk because a pre-configured device could be intercepted by hackers and used to access the enterprise network. Zero Touch Provisioning (ZTP) reduces the need for pre-staging by deploying new device configurations over the network. ZTP-enabled devices provision themselves by using DHCP or TFTP to find and download configuration files, which means administrators can ship factory-default hardware that doesn’t contain any exploitable information about the enterprise network.

However, ZTP also introduces some additional security challenges. Once they’ve created the configuration file, administrators generally don’t monitor the entire automatic provisioning process, so there’s a chance that a mistake in the configuration file could create a security vulnerability that goes unnoticed. And, since one ZTP configuration file is usually applied to multiple devices, a potential security vulnerability could affect several systems or locations without anyone knowing. In addition, hackers could intercept the transmission of the configuration file over the network if the connection isn’t strongly encrypted.

These challenges are overcome with a secure ZTP solution that follows zero trust security principles. This type of solution is often referred to as “Zero Trust Provisioning,” and it includes hardware-based security like TPM, BIOS protection, encryption modules, and an onboard firewall which protects the software layer (secure boot) and management layer (two-factor authentication). In addition, the ideal Zero Trust Provisioning solution supports integrations with automated configuration management tools like Chef and Ansible which can be set up to test and monitor ZTP configurations for mistakes and security vulnerabilities.

Zero Trust Provisioning is a key part of the SD-WAN security checklist because it prevents branch networking hardware from being intercepted and used in a cyberattack. It also ensures that automatic provisioning occurs over a secure, encrypted network connection, and allows integration with configuration management tools to prevent errors from introducing additional vulnerabilities. 

3. Secure out-of-band access

Many organizations use out-of-band (OOB) management to configure, control, and troubleshoot remote network infrastructure. OOB management uses a separate management plane, so resource-intensive network management and orchestration workflows don’t affect the performance or reliability of the production network. This may involve using a jump box to access an OOB network, which is an entirely separate management network architecture that runs parallel to the production network. However, a simpler solution is to use an OOB console server to achieve the same goal without the hassle of deploying a separate architecture.

OOB management improves the performance and reliability of production networks, and provides an alternative path to remote infrastructure (typically via cellular modem) in the event of an ISP outage or a network device failure. The issue with OOB management is that jump boxes and console servers are attractive targets to hackers. If a malicious actor manages to compromise the OOB network, they’ll gain complete control over the remote infrastructure.

To keep SD-WAN devices and other remote infrastructure secure, it’s best to use an OOB console server with advanced encryption for both the hardware and the management connections. In addition, the OOB solution should include Zero Trust features like MFA (multi-factor authentication) and RBAC (role-based access control). Just like the SD-WAN hardware, the OOB device(s) should run a fully patched OS and support Zero Trust Provisioning. For even greater protection, choose an OOB solution that supports integrations with third-party security solutions like next-generation firewalls (NGFW).

A secure out-of-band management solution gives network administrators 24/7 access to remote infrastructure on a dedicated, encrypted network connection using hardened OOB console server devices. This ensures that hackers can’t use the OOB network to hijack production infrastructure while also giving administrators the ability to quickly recover from outages, hardware failures, and cyberattacks.

4. Cloud-based security technology

As we’ve discussed above, it’s possible to run SD-WAN solutions on hardware with onboard firewall features. However, these basic firewalls often lack the advanced functionality needed to protect enterprise networks from sophisticated cyberattacks, which is why most organizations also use some form of stateful firewall or NGFW that resides in a central data center. This works well for a single, centralized enterprise network, but the addition of remote sites can create performance issues.

For the centralized firewall to inspect and protect SD-WAN traffic, that traffic must be backhauled through the central data center, even if the request is ultimately destined for the web. This inefficient routing causes bottlenecks, performance issues, and even dropped connections for on-premises and remote users alike. The obvious solution to this problem would be installing physical or virtual firewalls in each remote location, but this is expensive and disruptive and creates more management complexity for network administrators.

A better way to protect remote traffic while improving performance is through the use of cloud-based security solutions, such as Security Service Edge (SSE). SSE relies on SD-WAN’s intelligent routing capabilities to separate remote traffic that’s destined for web, cloud, and SaaS resources. This traffic bypasses the firewall and is instead routed through a cloud-based security stack, reducing the load on the enterprise network.

Ideally, the SD-WAN solution will tightly integrate with the SSE platform. This combination of SSE security with an SD-WAN on-ramp creates what’s known as SASE, or Secure Access Service Edge. This is most easily achieved using vendor-neutral branch networking platforms which can host or integrate with a wide variety of SD-WAN and SSE solutions. An integrated SASE architecture ensures comprehensive security while providing remote users and systems with fast, reliable access to cloud resources.

Nodegrid checks every box on your SD-WAN security checklist

Only one remote network management solution provides everything you need to keep your SD-WAN architecture secure: the Nodegrid platform from ZPE Systems. Nodegrid’s vendor-neutral routers, such as the 5-in-1 Hive SR branch gateway, can directly host or integrate with your chosen SD-WAN solution. Whether you enable SD-WAN with a Nodegrid device or by using ZPE Cloud’s SD-WAN application, you’ll get seamless access, centralized management, and state-of-the-art security.

1. Secure, up-to-date SD-WAN device OS

Nodegrid’s branch gateway routers run on the vendor-neutral, x86 Linux-based Nodegrid OS, which is constantly monitored for vulnerabilities and frequently patched to ensure security. Plus, with the ZPE Cloud orchestration platform, you can monitor and update all your SD-WAN devices from one convenient management portal—even if that hardware comes from another vendor.

2. Zero Trust Provisioning for branch networks

All Nodegrid devices support Zero Trust Provisioning, and they can extend this capability to any third-party devices managed by Nodegrid. That means administrators can securely configure all the multi-vendor devices in a remote branch network without the need for travel or pre-staging. Nodegrid ZTP is considered Zero Trust because it protects the hardware, software, and management layers with advanced security features like:

  • Password-protected BIOS
  • Current cryptographic modules
  • SSO with SAML (Duo, Okta, Ping, and ADFS), MFA, and remote authentication
  • Geofence perimeter crossing detection
  • Onboard firewall, IPSec, and Fail2Ban intrusion protection
  • Fine grain RBAC with strong password enforcement

Nodegrid also supports integrations with automated configuration management solutions like Ansible, Chef, and Puppet, so you can ensure every device is provisioned correctly.

3. Gen 3 secure out-of-band management

Nodegrid services routers provide reliable, Gen 3 OOB management access to any connected devices, including those from other vendors. This access is protected by a patched OS, onboard hardware security features, and current encryption modules. Plus, Nodegrid’s hardware and software can host or integrate with third-party security solutions like NGFWs for comprehensive OOB security. 

4. An SD-WAN onramp to SSE

The Nodegrid branch networking solution provides the ideal SD-WAN on-ramp to leading Security Service Edge providers. That’s because Nodegrid is a completely open platform that can host or integrate with any SSE and SD-WAN offering to provide a single, unified SASE solution. This gives administrators complete control over every aspect of branch network management and SD-WAN security from one convenient portal, reducing complexity and improving your security posture at the same time.

Wondering how ZPE’s Nodegrid solution checks all the boxes on your SD-WAN security checklist?

Contact ZPE Systems today to learn more

Learn More

How To Keep Colocation Data Center Pricing in Check

by | Sep 30, 2022 | Data Center Resilience, DevOps, Improve Network Security, NetDevOps Transformation, Network Automation, Scripting, SD-WAN, Secure Access Service Edge (SASE), Security Service Edge (SSE), Simplify Branch Infrastructure

Rows of data center racks in a colocation facility take up a lot of space, which contributes to colocation data center pricing.

With inflation and supply chain issues causing hardware prices to surge, and a winter recession looming on the horizon, every organization is looking for ways to cut technology costs. Though colocation hosting is often much less expensive than building and maintaining an on-premises data center, factors like physical space usage, power and bandwidth consumption, and remote support can cause your monthly colo bill to spiral out of control. This blog examines some of the most common reasons for colocation data center pricing increases and offers advice on how to keep these costs in check.

Colocation data center pricing considerations

First, here are four common factors that could cause your colocation data center pricing to increase.

1. Physical space

One of the major elements determining colocation pricing is the amount of physical space being rented. Some facilities charge by the rack unit and others by square footage (i.e., how much floor space is taken up by your racks). Costs for colocation space are typically calculated based on your portion of the facility’s operating expenses, which include things like physical security, building maintenance, and energy for cooling.

2. Power consumption

Power usage also heavily affects colocation data center pricing. While some facilities offer flat-rate power pricing, it’s more common to see pricing based on kilowatt usage. The price of data center power usage depends on many factors, such as electricity costs in the region, how energy-efficient the facility is, and how much energy it takes to cool your equipment.

3. Bandwidth consumption

Bandwidth is another usage-based expense that affects data center pricing. Organizations usually purchase bandwidth from the ISP, not directly from the facility, although some data centers do offer colo packages that also include internet access and bandwidth. That means that bandwidth pricing varies significantly from organization to organization.

4. Remote hands

Though colocation data centers handle many aspects of building and facility maintenance, customers are typically responsible for deploying and maintaining their own equipment. Most organizations do so via remote DCIM (data center infrastructure management) solutions, so they do not need to maintain a physical presence in the colocation facility. However, sometimes hardware failures or other issues make remote troubleshooting impossible, so they need to use on-site managed services, sometimes referred to as “remote hands.” Some colocation facilities include an allotted time for remote hands services in their pricing, but more often this is an added fee that’s paid for as needed.

There are many other factors contributing to the cost of colocation data center hosting—such as the location of the facility, the cost of your hardware, and the uptime promised by the provider. However, these four factors are relatively easy for you to change and control without needing to completely overhaul your infrastructure or move to a different facility.

Four ways to keep colocation data center pricing in check

Now, let’s discuss how to decrease your physical footprint, lower your power and bandwidth consumption, and minimize your reliance on managed support services.

Consolidated devices

Replacing bulky, outdated, single-purpose hardware with consolidated, high-density devices is a great way to reduce your colocation data center footprint without sacrificing functionality or performance. For example, the Nodegrid Serial Console Plus (NSCP) provides out-of-band management, routing, and switching for up to 96 devices in a single, 1U rackmount appliance. The NSCP helps reduce the number of serial consoles, KVM switches, or jump boxes in your colocation data center, allowing you to save money or use the extra space for new equipment.

Another option is the Nodegrid Net Services Router (NSR), a modular appliance that can replace up to six other devices in your rack. The NSR provides routing and switching with network failover and out-of-band management, with expansion modules for Docker & Kubernetes container hosting, Guest OS & VNF hosting, and more. The NSR is an ideal solution for small colocation deployments because it can reduce the number of computing and storage devices in your rack. For example, the NSR can reduce your footprint from 4U to 1U, allowing you to cut costs and reduce the complexity of your remote infrastructure.

Remote DCIM power management

As mentioned above, most organizations use remote DCIM solutions to manage colocation infrastructure. Power management is an important aspect of remote DCIM for keeping colocation data center costs in check. Remote DCIM power management allows you to visualize power consumption, both at the individual device level and at a big-picture level. If you can see where you’re using power inefficiently, you can correct the problem (for instance, by replacing a faulty UPS or simply redistributing the load) before costs spiral out of control.

For power cost savings, you should use remote management DCIM that supports automation, such as Nodegrid Manager. This vendor-neutral platform allows seamless integrations with third-party or self-developed automation tools and scripts. That means you can use Nodegrid to automatically monitor for and correct inefficient power load distribution to ensure consistent usage and prevent overage fees. Plus, Nodegrid supports end-to-end automation for all your network and infrastructure management workflows, helping to reduce the overall manual workload for your administrators.

Software-defined networking

Traditionally, administrators set and monitor bandwidth usage by accessing the CLI (command line interface) or GUI (graphical user interface) on individual, hardware-based network devices like switches and routers. For complex and distributed network architectures using many switches in many locations (including remote colocation facilities), manual bandwidth control is so time-consuming and inefficient that organizations end up with a “set it and forget it” approach. That means bandwidth usage is free to fluctuate as much as it wants within certain thresholds, and organizations just eat the overage costs.

Software-defined networking, or SDN, decouples network routing and management workflows from the underlying hardware. This allows organizations to centrally control and automate their entire network architecture, which includes bandwidth management for remote colocation infrastructure. Centralized SDN management gives administrators a single interface from which to control all the networking devices and workflows, so they don’t need to jump from device to device to monitor and manage bandwidth usage.

The application of SDN technology to WAN management is known as SD-WAN, and when that extends into the remote LAN it’s known as SD-Branch. SDN, SD-WAN, and SD-Branch technology use intelligent routing to ensure efficient bandwidth usage and network load balancing. That means you can keep your colocation data center bandwidth costs in check while significantly reducing the amount of work involved for your network administrators.

Out-of-band management

Out-of-band management, or OOBM, separates your management network from your production network, allowing you to remotely manage, troubleshoot, and orchestrate your colocation data center infrastructure on a dedicated connection. This has numerous benefits, including:

  • Resource-intensive network orchestration workflows won’t affect the bandwidth or performance of the production network.
  • Administrators can still access remote infrastructure even if the primary ISP link goes down.
  • Administrators gain the ability to remotely troubleshoot even when a hardware failure or configuration mistake causes a production network outage.

OOBM can help reduce your reliance on colocation data center managed services because your administrators have an alternative path to critical infrastructure even during an outage. A Gen 3 OOB solution like Nodegrid can further reduce your colocation data center pricing in several ways:

  1. OOB management is built into all Nodegrid devices, so you don’t need to purchase any additional hardware (or rent additional rack space) to enable out-of-band management.
  2. Nodegrid OOB integrates with the vendor-agnostic Nodegrid Manager platform, which means you’ll have reliable 24/7 remote access to monitor and orchestrate power load distribution to ensure cost-efficiency.
  3. Nodegrid OOB devices can directly host your software-defined networking, SD-WAN, and SD-Branch solutions so you don’t need to purchase additional hardware. You can also integrate SDN, SD-WAN, and SD-Branch software with the Nodegrid Manager platform for unified control.

The Nodegrid solution from ZPE Systems can help you keep colocation data center pricing in check through consolidated devices, remote DCIM orchestration, software-defined networking support, and Gen 3 out-of-band management.

Want to find out more about reducing colocation data center pricing with Nodegrid?

Contact ZPE Systems today!

Why Cybersecurity-as-a-Platform (CaaP) is the Future of Holistic Security | ZPE Systems

by | Sep 27, 2022 | Improve Network Security, Micro-segmentation, SD-WAN, Secure Access Service Edge (SASE), Security Service Edge (SSE), Zero Trust Security

cybersecurity platform zpe

A cybersecurity platform provides a unified interface from which to manage multiple security tools and controls. Traditionally, these platforms only work within a single vendor’s ecosystem of products. However, a new type of solution, called Cybersecurity-as-a-Platform (or CaaP), allows you to integrate your choice of third-party, multi-vendor solutions. In this blog, we’ll discuss the challenge of managing a complex cybersecurity environment and explain how CaaP can help.

Why Cybersecurity-a-a-Platform (CaaP) is the future of holistic security

Modern network security is rapidly evolving and expanding to deal with the increasing sophistication and frequency of cyberattacks. According to the Oracle and KPMG Cloud Threat Report from 2020, the average organization uses over 100 discrete cybersecurity controls. Often these tools come from many different vendors and perform many different functions, requiring specialized training to use each one effectively. This creates a highly complex cybersecurity environment that’s prone to human error.

In addition, there’s a lack of interoperability between products, meaning tools are often disjointed and working independently of each other rather than as a cohesive system. There’s also no centralized control or visibility over these independent solutions, which means administrators need to log in to each one to configure, monitor, and manage their functionality.

This leaves teams without a big-picture overview of their cybersecurity environment, making it impossible to achieve a complete security posture. This need for centralized management and monitoring of discrete security products led to the development of unified cybersecurity platforms.

What is a cybersecurity platform?

A cybersecurity platform is a software solution—typically, but not always, cloud-based—which unifies an ecosystem of security tools and controls behind one management interface. In the past, this has usually been vendor-specific (e.g., Trend Micro providing a single platform from which to manage their own security products). However, this type of platform leaves you locked in to whatever features and functionality are included by the cybersecurity vendor, or their chosen integration partners.

That leaves organizations with one of two choices:

1. Stay within that ecosystem and accept that they may have gaps in their coverage due to a lack of needed functionality. In this case, this means sacrificing the security of their network and systems for the convenience of using a single management system.

2. Add on additional products that must be managed outside of that platform, creating more management complexity for security administrators. In this case, this means sacrificing efficiency and interoperability in the hopes of improving overall security.

In either scenario, the organization is hurting its security posture by making compromises. A better solution is to choose a platform that gives you the freedom to combine the best security products and tools for your unique environment under one convenient management umbrella.

What is Cybersecurity-as-a-Platform (CaaP)?

Cybersecurity-as-a-Platform (CaaP) provides a vendor-agnostic interface from which to control a vast and complicated cybersecurity ecosystem. CaaP doesn’t care who you bought your security tools from or how you plan to use them—it provides the platform from which to integrate, manage, and monitor every component of your cybersecurity toolkit. This includes creating unified dashboards and visualizations that combine data from all your different security monitoring and analytics solutions, so you can get a complete picture of your cybersecurity environment.

How CaaP enables holistic cybersecurity

A unified Cybersecurity-as-a-Platform solution benefits businesses by:

→  Reducing data overload – Security analysts must monitor and act on data from a wide variety of sources, including intrusion detection systems (IDS), firewalls, and security information and event management (SIEM) solutions. With so much data to sort through to filter out the false positives from the real threats, analysts can easily become overwhelmed and allow issues to fall through the cracks.

CaaP unifies the data from these individual sources and gives teams a single dashboard from which to view and analyze events. Plus, CaaP supports integrations with tools that can automatically analyze, filter, and remediate security incidents, reducing the risk of human error and freeing up security teams to work on high-priority issues.

→  Simplifying security management – It’s very difficult (if not impossible) for a single security analyst to become an expert in 100+ different products, each of which has its own interface, nomenclature, compatibility issues, etc. Plus, simply logging into every one of these tools on a regular basis takes a significant amount of time, making it far too easy for analysts to neglect or forget critical security systems.

With the right Cybersecurity-as-a-Platform, analysts can integrate all their security tools into one common platform, reducing the number of discrete solutions they need to learn, maintain, and support. This both reduces the risk of human error and reduces the workload on overwhelmed security teams.

→  Improving security posture – The more complex a system is, the more prone it is to failure. A cybersecurity strategy that relies on the continued operation and effectiveness of over 100 individual moving parts is more likely to fail because an issue with even one of those tools could lead to a breach. Plus, without a centralized view of how these parts work together, there’s no way to get a complete picture of an organization’s security posture.

CaaP gives analysts the ability to monitor and maintain all their security tools in one place, so they can see alerts about new vulnerabilities, apply patches, and more. They can also ensure all these tools are working together as expected so there are no gaps in coverage, and see data and visualizations about the security of the organization as a whole.

Adopt the CaaP approach to security with ZPE Systems

Cybersecurity-as-a-Platform is a unified, tightly integrated solution that rolls up a vast ecosystem of security tools behind one pane of glass. CaaP is the future of holistic security because it empowers efficient security monitoring and management while providing a complete overview of an organization’s security posture. True CaaP, like the Nodegrid solution from ZPE Systems, is completely vendor-neutral. This gives you the freedom to bring in your choice of cybersecurity solutions and automation tools, so you get the best features, functionality, and performance for your unique environment.

Want to learn more about cybersecurity platforms with Nodegrid?

Contact ZPE Systems today!

Contact Us

How SASE Technology Defends Your Network Edge

by | Sep 23, 2022 | Data Center Resilience, DevOps, Improve Network Security, NetDevOps Transformation, Network Automation, Scripting, SD-WAN, Secure Access Service Edge (SASE), Security Service Edge (SSE), Simplify Branch Infrastructure

SASE technology can offer you defense for your network edge

Secure Access Service Edge, or SASE, is a cloud-based service that combines software-defined wide area networking (SD-WAN) with critical network security technologies like CASB, ZTNA, SWG, and FWaaS. SASE technology connects remote, branch office, and edge computing resources directly to web and cloud services, reducing the load on the main firewall while extending enterprise security policies and controls to protect this traffic. In this article, we’ll dive into the specific technology that SASE uses to defend your network edge.

How SASE technology defends your network edge

SASE protects network edge traffic by rolling up an entire network security technology stack into a single, cloud-delivered service. The key security components of a SASE solution include CASB, ZTNA, SWG, and FWaaS.

CASB

A cloud access security broker, or CASB, is a software service that sits between your main enterprise network and your cloud-based infrastructure. A CASB allows you to extend your enterprise security policies to the traffic flowing between your WAN and the cloud so you can ensure consistent protection. A CASB is actually a collection of multiple security technologies, such as:

  • User and Entity Behavior Analytics (UEBA) – Monitors the behavior of users and devices on the network to detect suspicious activity and enforce security policies.
  • Cloud application discovery – Identifies all cloud applications and services in use by the organization and analyzes relative risk levels.
  • Data Loss Prevention (DLP) – Applies data governance policies to prevent the exfiltration of sensitive and proprietary information.
  • Adaptive access control – Uses session context (e.g., originating location, time, behavior) to determine whether to grant access.
  • Malware detection – Scans traffic between the enterprise and the cloud to detect and block viruses and other malware.

ZTNA

Zero trust network access, or ZTNA, connects remote users and devices to enterprise network resources, similar to a VPN. Unlike a VPN, however, ZTNA creates a direct connection to the specific resources requested by the user, rather than granting full access to the network. This prevents remote users from seeing or interacting with any network resources outside of the specific service they’ve explicitly authenticated to.

ZTNA follows the zero trust motto of “never trust, always verify.” It uses technologies like context and role-based identity verification and two-factor authentication (2FA) to prevent unauthorized access. And, since users need to re-authenticate to every enterprise resource, ZTNA is able to prevent malicious actors from discovering valuable systems and data or moving laterally on the enterprise network.

SWG

A secure web gateway, or SWG, is a service that sits between your enterprise network and the public internet. All web-destined traffic passes through the SWG, where enterprise web filtering and application control policies are applied. Traditionally, an SWG is a hardware device that sits in the data center, which means all remote, branch, and edge traffic needs to be backhauled through a single appliance. As part of a SASE solution, an SWG sits in the cloud instead, so remote traffic doesn’t need to pass through the data center. This improves overall network performance, reduces or eliminates bottlenecks, and ensures consistent application of acceptable use policies and application security controls.

FWaaS

Firewall-as-a-Service, or FWaaS, delivers next-generation firewall technology as a cloud-based service. That means remote and cloud-destined traffic can bypass the firewall in your data center, reducing bottlenecks and performance issues. At the same time, FWaaS provides the same level of security and protection as an NGFW, including features like URL filtering, intrusion detection and prevention, and deep packet inspection (DPI). FWaaS gives SASE solutions the ability to protect remote, edge, and cloud-destined traffic with the same policies and controls as the main enterprise network to ensure consistent security and optimal performance.

SASE technology uses CASB, ZTNA, SWG, and FWaaS to defend your network edge. However, you still need a way to direct remote, branch office, and edge traffic to your SASE security stack. That’s where SD-WAN technology comes in.

Accessing SASE technology with SD-WAN

While it’s possible to use standard WAN architectures to connect to SASE technology, the most reliable and efficient way to access SASE is with SD-WAN. SD-WAN uses software abstraction to create a virtual overlay management network on top of your WAN hardware. This virtual management network enables the use of automation and orchestration to manage the remote network traffic.

In a SASE deployment, SD-WAN uses intelligent routing to separate all remote traffic that’s destined for the cloud. Instead of backhauling this traffic through the enterprise firewall, SD-WAN routes it through the SASE technology stack, significantly reducing the load on your data center infrastructure. This improves network and application performance for your entire enterprise without sacrificing security.

SD-WAN solutions may sit on top of traditional WAN infrastructure, or they may replace that hardware entirely, using SD-WAN routers provided by the vendor. However, rather than investing in specialized vendor hardware, an even better approach is to use vendor-neutral network management devices that can host or integrate with every piece of your SASE and SD-WAN technology stack.

For example, the Nodegrid line of vendor-neutral serial consoles and network edge routers are the perfect on-ramp for your SASE solution. Nodegrid can directly host or integrate with third-party SD-WAN solutions like Palo Alto Networks’ Prisma SD-WAN, or you can use ZPE Cloud’s SD-WAN app. Nodegrid also supports seamless integrations with your choice of SASE provider, giving you a unified, centralized SD-WAN and SASE orchestration platform.

SASE learning center:

★   Understanding Key SASE Components & Benefits
★   SASE Implementation: A Step-by-Step Guide for Businesses
★   The SASE Model: Key Use Cases & Benefits

Want to find out more about accessing SASE technology with Nodegrid SD-WAN?

Contact ZPE Systems today!

Solving Remote IT Infrastructure Management Challenges With Gen 3 Out-of-Band

by | Sep 1, 2022 | DevOps, Monitoring & Reporting, NetDevOps, Network Automation, Out of Band Management, Power Management, Remote Network Management, SD-WAN, Secure Access Service Edge (SASE)

Remote it infrastructure management

Enterprise IT management used to be much simpler. The entire network infrastructure would reside in the same location as the administrators who managed it, typically in closets and basement rooms in the HQ office building. Those days are long gone, however, and now most infrastructure is housed in off-site data centers, colocations, the cloud, or a combination of these. For most organizations, it isn’t feasible to maintain tech teams in each of these locations, which means administrators need to remotely manage their IT infrastructure.

Remote IT infrastructure management presents some interesting challenges. First, you need a way to remotely troubleshoot and recover from outages when the main WAN connection is unavailable. Second, you need to maintain optimal environmental conditions and monitor for issues that could damage data center equipment.

Solving remote IT infrastructure management challenges with Gen 3 out-of-band

Out-of-band (OOB) management uses a dedicated network to handle the orchestration and troubleshooting of remote infrastructure. This provides an alternative network path to this infrastructure in case the primary WAN link is down, and allows administrators to perform complex orchestration workflows without slowing down the production network.

Gen 3 OOB uses serial consoles to give administrators management access to many devices in the rack from one centralized portal. What makes an OOB serial console “Gen 3” is a combination of high-speed out-of-band access, complete vendor neutrality, and end-to-end automation and orchestration support. Let’s discuss how Gen 3 out-of-band can solve the three major remote IT infrastructure management challenges.

Remote troubleshooting and outage recovery

Downtime is expensive, which is why it’s important to recover from network outages as quickly as possible. However, many of the tools used to remotely manage IT infrastructure require a network connection. If a piece of networking hardware fails and takes down the LAN, or the ISP suffers a regional outage, administrators are left without access to troubleshoot and fix the problem. That leaves only two options: dispatching a truck roll or hiring on-site managed services. Option one is time-consuming and expensive, and option two is a security risk (and also expensive).

A Gen 3 OOB solution provides one or more alternative network paths to remote infrastructure. Often, it uses a cellular modem or secondary broadband network interface, which may also provide network failover capabilities. All network and infrastructure management occurs on this dedicated network, which provides two benefits:

  1. Deployment, maintenance, and orchestration activities won’t take up bandwidth on the production network; and
  2. Administrators can still access critical remote infrastructure during a production network outage.

Gen 3 OOB improves upon earlier technology which used slow dial-up interfaces, insecure hardware, and closed OS architectures. Gen 3 out-of-band includes security features like UEFI secure boot, geofencing, and an onboard firewall. The operating system is Linux-based to allow for easy integrations with any vendor solution, and vulnerabilities are patched quickly. This ensures that administrators have constant, high-speed, secure access to remote multi-vendor IT infrastructure.

Remote monitoring of environmental conditions

The environmental conditions in the data center have a major impact on the performance and functionality of critical infrastructure. Environmental threats like heat, moisture, power surges, smoke, and even physical tampering are major causes of data center downtime. When you don’t have actual eyes on the conditions in your rack, it can be difficult to detect environmental issues early on, when there’s still a chance to correct the issue and prevent downtime.

A Gen 3 OOB serial console includes GPIO interfaces for environmental monitoring sensors. These sensors are used to measure the temperature, relative humidity, air quality, and airflow in a rack, and in some cases can also detect smoke, proximity, and tampering. The monitoring sensors feed data back into a centralized environmental monitoring system which provides visualizations of present and historical conditions. It also sends automatic alerts to administrators when conditions require immediate attention. Plus, since this monitoring system is integrated with an OOB serial console, administrators can stay abreast of environmental conditions even when the production network goes down.

Remote IT infrastructure automation and orchestration

Automation allows IT teams to manage network infrastructures faster and more efficiently while reducing the risk of human error. However, one of the major hurdles to automation is vendor lock-in. Many infrastructure solutions don’t integrate with third-party automation tools and instead require you to use their own proprietary scripting languages and playbooks. Since many IT infrastructures are made up of a variety of vendor hardware and software solutions, administrators are forced to learn and manage multiple different automation platforms.

This difficulty only increases when those solutions are managed remotely. Administrators need to remotely jump from box to box and interface to interface just to execute basic automation workflows. It gets even more complicated when there are multiple remote sites to manage, as is the case in many large and globalized enterprises.

By definition, a Gen 3 out-of-band platform is vendor-neutral. That means it can dig its orchestration hooks into every hardware and software solution in your data center. It also supports integrations and direct hosting of third-party automation tools, so you can use the scripting languages and automation solutions of your choice. Finally, a Gen 3 solution centralizes the orchestration of all remote IT infrastructure automation workflows, so administrators can monitor and manage everything from behind one pane of glass.

Solving remote IT infrastructure management challenges with the Nodegrid Gen 3 out-of-band platform

The Nodegrid remote IT infrastructure management solution from ZPE Systems is the first Gen 3 out-of-band platform. Nodegrid delivers secure OOB, a robust environmental monitoring system, and end-to-end automation and orchestration in a single Gen 3 OOB serial console.

The Nodegrid Serial Console Plus (NSCP) provides OOB access and network failover via built-in 5G/4G LTE cellular and Wi-Fi modules, ensuring administrators have a dedicated high-speed connection to critical network infrastructure. Nodegrid hardware is protected by onboard security features like TPM 2.0, encrypted SSD, UEFI BIOS protection, secure boot, and geofencing, so you don’t have to worry about malicious actors compromising your management network. The open architecture, Linux-based Nodegrid OS is secured by frequent patches and supports third-party integrations or the direct hosting of third-party applications.

The Nodegrid environmental monitoring system includes sensors for dry contact, temperature, humidity, smoke, airflow, dust, and particulates so you have 24/7 visibility into the conditions in your rack. These sensors integrate seamlessly with the Nodegrid OS as well as the ZPE Cloud remote IT infrastructure management platform.

ZPE Cloud provides a centralized control panel from which to monitor and orchestrate your Gen 3 OOB network. ZPE Cloud’s vendor-neutral platform can “say yes” to any hardware, software, or automation solution you choose, so you can achieve end-to-end infrastructure automation without compromises.

Ready to learn more?

To learn more about how Nodegrid solves remote IT infrastructure management challenges through Gen 3 OOB, contact ZPE Systems

Contact Us

ZPE Systems Featured in L’Informaticien Magazine

by | Sep 1, 2022 | Application Hosting, Data Center Management, Data Center Resilience, Edge Computing, EdgeOps, Minimize Impact of Disruptions, NetDevOps Transformation, Network Automation, Out of Band Management, Remote Network Management, SD-WAN

L’Informaticien and ZPE Systems

ZPE Systems is featured in L’Informaticien Magazine, a France-based publication with a wide audience. Read the English translation here, and check out the original source content with the links at the bottom. Be sure to follow us on LinkedIn and Twitter for more updates about our global presence.

ZPE, All-in-one Supervision

Founded in 2013, ZPE Systems is world famous but discreet despite its presence in France with large accounts. The company offers an all-in-one solution combining software, equipment and sensors to provide automation and orchestration on network operations and security.

Gartner covers the type of solution offered by ZPE under the term of Hyperautomation. ZPE is the Swiss army knife of network services by providing a solution to simplify and unify the vision of the network and the operations on this one. The solution can be deployed on site or from the Cloud. Locally, ZPE offers routers that supply the supervision console in the Cloud from different sensors or agents. It is possible from the console to configure, deploy, manage, and ensure access to implement the desired solution. The publisher’s operating system brings a layer of virtualization which makes it possible to accommodate third-party services such as for security, for example, in order to allow Out-of-Band supervision of all the IT components present in the company. On site, the solution comes in the form of an appliance which brings together all the functionalities and extensions allowed by a whole set of APIs to meet specific business needs. Thus, in September of last year, ZPE announced that it could ship Palo Alto Networks Prisma SD-WAN in its edge routers. In this case, the solution behaves like a mini Cloud at the edge.

Multiple advantages

ZPE brings the benefit of both all-in-one solutions but also the ability to easily deploy best-of-breed solutions with a supervision from a central and unique point, while avoiding the need to deploy, manage, and pay for licenses or subscriptions for disparate solutions. The solution consolidates the network stack and simplifies the operations of deployment, configuration, updating network scale and management. This makes life easier for the teams in charge of the network. Who has not experienced the ordeal of deploying remote networks or to try to find the cause of an incident on this type of site and to restore the faulty services? ZPE is particularly suitable for companies with many sites or highly distributed infrastructures

Nodegrid 5.6

During the last Cisco Live, held in Las Vegas during June, ZPE announced a new version of its Nodegrid OS available for its consoles and routers. Like its predecessor, the solution makes it possible to deploy best-of-breed at the choice of the company from the Cloud console of the ZPE solution. It is thus possible to deploy solutions embedding the various software from pre-validated suppliers.

Here is the list:

  • Ansible
  • Gluware
  • Stackstorm
  • On-ramp to Cisco SIG/Umbrella/CDFW, Fortinet, Palo Alto Networks’ PANOS firewalls, ThousandEyes agents

The solution thus provides a complete automation plan that can be orchestrated from Nodegrid for configuration change management, network monitoring and response to attacks and thus avoid service interruptions.

LInformaticien
Download the PDF Visit L’Informaticien