Presentation by Richard Bayliss at APRICOT 2018 on Tuesday, 27 February 2018.

1. Copyright © Arista 2017. All rights reserved.Copyright © Arista 2017. All rights reserved.
Rich Bayliss
rbayliss@arista.com
Secure SDN

2. Copyright © Arista 2017. All rights reserved.
What Are We Talking About?
3
CLOUD/
NFV
PHYSDN
Automate All
The Things!!
We Live Here
Services Live Here
(Disaggregation)
Shifting Location of Security Or Management Function != Game Changing By Itself
Increased Complexity Creates New Blindspots

3. Copyright © Arista 2017. All rights reserved.
Optimizing A System At Equilibrium – KTM Airport
4
VISA VISA NO VISA NO VISA NO VISA NO VISA NO VISA NO VISA
X-RAY DETECTOR
FEEFEE
PHOTO PHOTOPHOTO PHOTOPHOTO PHOTO
50%
50%

4. Copyright © Arista 2017. All rights reserved.
Traffic Patterns Are Sub Optimal For Dedicated Systems
5
VISA VISA NO VISA NO VISA NO VISA NO VISA NO VISA NO VISA
X-RAY DETECTOR
FEEFEE
PHOTO PHOTOPHOTO PHOTOPHOTO PHOTO
50% 50%

5. Copyright © Arista 2017. All rights reserved.
Traffic Patterns Are Sub Optimal For Dedicated Systems
6
VISA VISA NO VISA NO VISA NO VISA NO VISA NO VISA NO VISA
X-RAY DETECTOR
FEEFEE
PHOTO PHOTOPHOTO PHOTOPHOTO PHOTO
45% 40%
10%
5%

6. Copyright © Arista 2017. All rights reserved.
Traffic Patterns Are Sub Optimal For Dedicated Systems
7
VISA VISA NO VISA NO VISA NO VISA NO VISA NO VISA NO VISA
X-RAY DETECTOR
FEEFEE
PHOTO PHOTOPHOTO PHOTOPHOTO PHOTO
40% 30%
20%
5%

7. Copyright © Arista 2017. All rights reserved.
Traffic Patterns Are Sub Optimal For Dedicated Systems
8
VISA VISA NO VISA NO VISA NO VISA NO VISA NO VISA NO VISA
X-RAY DETECTOR
FEEFEE
PHOTO PHOTOPHOTO PHOTOPHOTO PHOTO
35% 20%
28%2%
5%

8. Copyright © Arista 2017. All rights reserved.
Traffic Patterns Are Sub Optimal For Dedicated Systems
9
VISA VISA NO VISA NO VISA NO VISA NO VISA NO VISA NO VISA
X-RAY DETECTOR
FEEFEE
PHOTO PHOTOPHOTO PHOTOPHOTO PHOTO
30% 10%
36%6%
11%

9. Copyright © Arista 2017. All rights reserved.
Challenges Observed
Traffic patterns are well understood, yet…
• Difficulty in reassigning resources based on instantaneous demand
à Leading to simultaneous overprovisioning and bottlenecks
• Multiple steps to process traffic flow
• Validation occurs as last stage
à some bounced back to photo stage…
• Egress physical security checks becomes a chokepoint
10
KTM Is NOT The Only Airport In The World That Can Be Optimized.

10. Copyright © Arista 2017. All rights reserved.
Tasks For SDN To Solve
SDN can mean a *lot* of things. For today…
• Elastically Scale Out/In Resources For Any Task
• Optimize Traffic
• Embed Security
• Maintain Future Optionality à aka. Zero Touch Operations
11
Service Workflows Cannot Be Hardcoded Into Infrastructure.
Neither Can Security.

11. Copyright © Arista 2017. All rights reserved.
Controller Risks…
12
LINECARD
LINECARD
LINECARD
LINECARD
LINECARD
LINECARD
LINECARD
LINECARD
Integrated Distributed

12. Copyright © Arista 2017. All rights reserved.
Infrastructure Is Moving Further Away From Services
13
Segmentation Underlay
(MPLS or VXLAN Overlay)
Container-Based Application
Platform
Macro Segmentation
Overlay
End User Service layer
Physical Underlay (IP Connectivity)
Abstraction = Blind Spot
Development Model

13. Copyright © Arista 2017. All rights reserved.
What Is the Scope of ‘Secure SDN’?
14
Segmentation Underlay
(MPLS or VXLAN Overlay)
Container-Based Application Platform
Macro Segmentation
Overlay
End User Service layer
Physical Underlay (IP Connectivity)
Here?
Here?
Here?
SECURITY
SDN?
DevOps
SDN?
SDN?

14. Copyright © Arista 2017. All rights reserved.
Protecting Against Data Plane / Application Layer
Cloud Native Mindset: Infrastructure-As-Code
15
Candidate VNF ImageBuild Process
CI/CD
Version Control
Code Repository
+
Base Configuration
Automated Testing
Fail
Stable VNF Image
Pass
Service Catalogue
Service Designer
Running Instance
Order
Customer Order
Operational Lifecycle
Upgrade
Boot Params
Assure / Modify /
Terminate
Version Control and Authenticated API Access Provide Full Audit Trail

15. Copyright © Arista 2017. All rights reserved.
Segmentation Is A Hope, Not A Strategy…
16
Perimeter Macro Micro
Building Smaller Firewalls Isn’t The Solution
Perimeter Nano
ORCHESTRATOR

16. Copyright © Arista 2017. All rights reserved.
Where Do We Start To Build A Secure SDN Platform
17
Dynamic Flow Control
MACSEC
Streaming Telemetry
Including sFLOW
Macro Segmentation
Physical
Logical
Physical
Logical

17. Copyright © Arista 2017. All rights reserved.
Optimizing A System At Equilibrium – KTM Airport
18
ANY ANY ANY ANY ANY ANY ANY ANY
FEEFEE
PHOTO PHOTOPHOTO PHOTOPHOTO PHOTO
50%
50%
PERIMETER
FEE
Consolidated 2nd tier Passport and Security Services for all systems

18. Copyright © Arista 2017. All rights reserved.
www.arista.com
Thank You
19