The importance of network automation is clear—you can reduce human error, create more efficient workflows, and streamline operations. However, many enterprises delay their automation efforts because of how challenging the process can be.

Fortunately, automating your network operations does not have to be difficult if you start with a comprehensive plan and implement the right tools and solutions.

Best practices for automating your network operations

1. Automate what you need versus what you can

Start your automation journey by identifying and prioritizing the most beneficial workflows for your business to automate. It may seem easier to choose whatever automation tools are provided by your existing vendors and then try to make them work with your infrastructure. However, that could lead you to follow the automation path that’s best for your vendors, versus the path that’s best for your particular use cases and requirements.  Though the former approach may seem simpler in the short-term, it will reduce the overall success of your automation efforts and make it harder to achieve your goals.

You need a full understanding of all the components that make up your network infrastructure so you can accurately identify and prioritize which devices, processes, and applications to automate in which order. Then, you need to ensure your automation solution can get its hooks into every aspect of your infrastructure, including things like environmental monitoring sensors, PDUs (power distribution units), and other devices that may not be part of your initial orchestration framework. Automating your network operations based on what you need, versus what’s easiest, will ultimately save you time and effort in reaching your automation goals.

This ultimately means that every enterprise’s path to automation should look a little different. However, below are some recommendations for network operations, workflows, and tasks to automate.

2. Automate device provisioning

Device provisioning is often a time-consuming, tedious task, which makes it prone to human error—and a prime candidate for automation. There are a couple of common ways to automatically spin up new infrastructure, including:

Zero touch provisioning (ZTP): Devices enabled with ZTP automatically download and execute configurations over the network, allowing you to deploy routers, switches, console servers, and other appliances with very little human intervention. This is especially beneficial for remote infrastructure at colocation facilities, branch offices, warehouses, and other locations where you may not have IT staff available to install and configure devices on-site.

Infrastructure as Code (IaC): IaC uses software abstraction to separate infrastructure configurations from the underlying hardware. This allows you to write configurations as repeatable scripts that you can deploy and manage automatically. You can also use IaC orchestration tools like RedHat Ansible to store and automatically execute configuration scripts for all your infrastructure devices from one central control panel.

Automating the device provisioning process with ZTP and IaC will streamline your network operations by increasing the speed and accuracy with which you can spin up new resources.

3. Automate WAN and Branch management

Managing WAN (wide area network) and branch networks can be very challenging without automation. Often, you don’t have on-site staff to monitor and troubleshoot networking equipment. You also need to back-haul all remote traffic through your primary firewall to apply security policies and controls, which creates bottlenecks on the network and reduces productivity. Plus, every new site you add will further increase the complexity of your enterprise network.

One way to automate WAN and branch management is through software-defined wide area networking, or SD-WAN. SD-WAN decouples the WAN management plane from the underlying hardware and, similarly to IaC, abstracts it as software. This makes it easier to introduce automation to your WAN management. For example, you can use SD-WAN intelligent routing to separate cloud-destined traffic and divert to a cloud-based security stack such as Security Service Edge (SSE), reducing bottlenecks and improving performance. Automating your WAN and branch management through SD-WAN reduces the challenge of distributed network management.

4. Automate with NetDevOps

DevOps is a popular paradigm that combines software development and IT operations departments into one collaborative team to streamline software releases. NetDevOps takes this a step further by integrating network management into the equation. NetDevOps focuses on operationalizing processes by using a systematic approach to automating and orchestrating network management, development, and operations tasks.

NetDevOps automation uses technologies like IaC and SD-WAN but takes things a step further by integrating them with DevOps tools like code repositories, test automation, and CI/CD (continuous integration/continuous delivery). This allows your entire IT department to function together as one efficient unit, eliminating bottlenecks between teams and streamlining product releases.

Automating your network operations does not have to be difficult if you start with a robust plan that focuses on your organization’s unique environment, requirements, and capabilities. Often, enterprises start with automatic device provisioning because it’s a tedious and repeatable process. WAN and branch management is another good candidate for automation because it can have a large impact on overall network performance. Finally, for development-focused organizations, the NetDevOps methodology integrates DevOps tools and processes into network automation efforts to create more efficient software release cycles.

Automating your network operations is easier with the right solution

Not all network automation platforms offer the same capabilities, features, or level of control. For example, many solutions don’t allow integrations with popular IaC tools like Ansible, Chef, and Puppet. If your platform isn’t vendor-neutral, you’re going to find it challenging to create a fully-integrated NetDevOps environment using code repositories, IaC, and test automation. For true end-to-end automation, you need a platform that can get its hooks into every piece of your infrastructure, or else you’ll end up with a bloated patchwork of solutions that’s difficult to orchestrate and optimize.

ZPE Systems delivers a vendor-neutral network automation platform that doesn’t suffer from any of these limitations. Our Zero Pain Ecosystem can “say yes” to any device, system, or service you add to your network, ensuring you’re able to automate what you need, when you need it. With features like secure zero touch provisioning, SD-WAN, and even SD-Branch, you can automatically deploy and manage your infrastructure from behind one pane of glass. And, all ZPE solutions integrate with leading third-party automation tools, giving you end-to-end automation with consolidated, centralized orchestration.

How autonomous decommissioning via out-of-band has become essential to disaster recovery for edge deployments in uncertain geographies

To say there’s instability in Eastern Europe would be a drastic understatement. Russia continues its attacks on many fronts in Ukraine, displacing millions of Ukrainians who are now left with an uncertain future. Security is on everyone’s mind, and while many have answered the call to arms and stand ready with AK-74 in hand, others recognize that defending Ukraine involves shielding IT infrastructure and intellectual property from cyberattacks.

For this, some of ZPE Systems’ customers are using an unlikely defense: out-of-band management. Despite recent attacks using wiper malware and DDoS to take down government websites, organizations are able to use generation 3 out-of-band to decommission their sites in order to protect their data against adversaries who have boots on the ground.

In this post, we’ll examine the current issues surrounding compromised edge sites and what organizations are doing right now to shield their intellectual property (IP).

What disaster looks like

Every enterprise and government organization should assess their level of risk regarding equipment deployed at the edge. Risks can come from geographical and geopolitical factors — such as tornadoes or flooding during seasons of inclimate weather, or regional instability during times of international conflict.

Imagine you’re in charge of a corporate or government organization. One day you stop receiving pingbacks from your edge sites, and you suddenly find that you’re cut off from these locations.

There’s no network. There’s no access. And like many organizations currently struggling in Ukraine, you’re simply no longer in control of what happens to your data.

What do you do now?

Your sensitive user credentials, customer information, and intellectual property are in jeopardy, and possibly being stolen by adversaries.

Could you have prevented this?

Disaster recovery: Autonomous decommissioning to stop data theft

Part of an adequate disaster recovery plan involves having hermetic and autonomous operations, down to the device level. In the case that you need to go into disaster recovery mode, consider all of the information that needs to be wiped at your locations:

• Servers need to be wiped
• Disks and partitions need to be wiped
• Disks need to be overwritten so data can’t be recovered
• Switches and supporting infrastructure need their configurations wiped

The problem is that since you’re cut off and unable to remotely access this equipment, you can’t perform these tasks.

However, ZPE’s customers are currently using our programmable out-of-band infrastructure for this exact use case. It’s being called ‘autonomous decommissioning’, and it combines network automation with manual commands to essentially perform the inverse of launching network sites. This process is being used to protect IP and personal identifying information from falling into the wrong hands.

How does it work?

With our generation 3 serial consoles and services routers co-located at data center and critical edge locations, customers are able to connect all of their equipment to the out-of-band network. Receiving pingbacks at regular intervals from HQ signals that all is well at these sites.

Due to instability in the region, some sites are becoming compromised and cut off from HQ. When this happens, the infrastructure goes into disaster decommissioning mode, and ZPE’s devices serve as on-prem automation workers which help remote IT admins to begin wiping the entire infrastructure.

These devices are hooked into every piece of equipment, and they’re able to receive automated scripts and manual commands from remote admins to push decommissioning tasks to all connected gear. The ZPE device is then able to have its own configuration wiped and returns to its initial ‘seed of life’ mode, in which it awaits further instructions until the connection is restored to HQ. Once this connection is restored, Nodegrid waits for instructions to rebuild the infrastructure following the immutable infrastructure framework.

This autonomous decommissioning prevents data from being stolen by adversaries. By wiping all data and returning to its seed-of-life state, it also keeps the environment’s configurations secure. That’s because the devices no longer contain any configuration information once they’ve been wiped, and configurations can only be restored once an authenticated connection is reestablished with HQ.

Check out a live demo at ONUG!

See how to automate without anxiety to combat cyberattacks. Join us Thursday, April 28 at 11:10am EST at ONUG for a live demo. Click here to register or get your free virtual pass.