This document summarizes a presentation about securely connecting customers' sites to cloud-hosted applications. It discusses the challenges of connectivity, operational readiness, and security/compliance when onboarding customers. Specifically, it outlines limitations of native AWS/Azure VPN solutions and the lack of visibility, automation, and security controls. The presentation promotes using a communication module that can automate provisioning IPsec or SSL tunnels without requiring changes to customer edge devices or opening firewall ports. This provides centralized management of connectivity and compliance reporting across customer environments.

1. Securely Connecting Customers’ Sites
To Your Cloud Hosted Apps – In Minutes
AWS Bootcamp #6 – May 24, 2018
Sherry Wei, Founder & CTO
Neel Kamal, Head of Field Operations
Frank Cabri, VP Product Marketing

2. © 2018 AVIATRIX SYSTEMS, INC. | 2
• Use Cases for App Providers
• Understanding the Challenges of
Customer On-Boarding
- Connectivity
- Operational Readiness
- Security & Compliance
• Demo
• Live Q & A
Welcome & Agenda
SHERRY WEI
Founder & CTO
NEEL KAMAL
Head of Field Operations
FEATURED SPEAKERS

3. © 2018 AVIATRIX SYSTEMS, INC. | 3
Check Out More Bootcamps – Available On-Demand
www.aviatrix.com/bootcamps

4. © 2018 AVIATRIX SYSTEMS, INC. | 4
Networking Use Cases for Hosted Apps Providers
AND
Managing Your Internal
PaaS Operation
Onboarding Your Customers
Customers
YOU
Users

5. © 2018 AVIATRIX SYSTEMS, INC. | 5
1. Connectivity Challenges
- Building IPsec connectivity to the customer environment
- Handling overlapping CIDR blocks
- Supporting connectivity from the hosted environment to customer environment,
which can be on-prem, AWS, Azure, Google Cloud, etc.
2. Operational Challenges
- Lack of monitoring/insights into customer experience: latency, performance
- Lack of alerting and troubleshooting ability
- Lack of automation, which leads to delays and errors
3. Security & Compliance Challenges
- Policy-based, remote user access to separate internal staff from customer staff
- Isolate and segmenting VPCs to tighten the security perimeter and reduce audit scope
Challenges in Connecting Customers’ Sites to Cloud Hosted Apps
Onboarding Your Customers
Customers
YOU
Users

6. © 2018 AVIATRIX SYSTEMS, INC. | 6
Challenges in Connecting Customers’ Sites to Cloud Hosted Apps
3. Security & Compliance 2. Operational Readiness
1. Connectivity

7. © 2018 AVIATRIX SYSTEMS, INC. | 7
Why Is It So Complex?
- Requires involving customers’ network & security teams
- Hits customers’ change control process when touching an edge device
(for IPsec) and their perimeter security appliance
- Requires your team to have expertise on a variety of customer edge routers
What Does AWS/Azure Provide Natively?
- AWS Virtual GW (VGW) & Azure VPN
What’s Missing?
- AWS VPN Gateway Limitation (supports 10 connections per VPC.)
- Azure VPN Gateway Limitation (supports only 1 VPN connection for IKEv1)
- Overlapping IP addresses
- Traffic Direction Problem
- Encryption Algorithm Mismatch
1. Connectivity Considerations

8. © 2018 AVIATRIX SYSTEMS, INC. | 8
Why Is It So Complex?
- No visibility into your customer’s environment
- Requires deep network expertise by the internal staff who supports connectivity to the
customer environment (BGP, IPsec)
- Committed SLAs impossible to prove
What Does AWS/Azure Provide Natively?
- No tools
What’s Missing?
- No Visibility: Cloud provider’s VPN gateway is a blackbox, there is no visibility
- Automated Configuration: manually configuring traditional vRouter for 100s of IPSEC
tunnel is not possible)
- Too Slow to Onboard a Customer: VPN runs on UDP port 500/4500 which require
opening corporate firewall ports)
- Downtime Problem: When you add new IPsec tunnel, it will reset all existing tunnels
2. Operational Considerations

9. © 2018 AVIATRIX SYSTEMS, INC. | 9
Why Is It So Complex?
- Giving customer users/groups limited access to your cloud-
hosted app is just hard
- SOC2-compliant reports (“who accessed what, at what time”) is
even harder
What Does AWS Provide Natively?
- No AWS-native services
What’s Missing?
- A cloud-native User VPN solution
- Profile-based access control with MFA
- Audit logs that are exportable to your tool of choice
3. Security and Compliance Considerations for Remote Users

10. © 2018 AVIATRIX SYSTEMS, INC. | 10
• A communication module that you can include with your product to your
customers:
• Works in every type of customer environment: data center, private cloud, etc.
• Does not require changes to edge routers or security appliances (opening ports)
• Can sit inside the DMZ
• Supports both IPsec and SSL termination
• Provisioning and configuring these modules can be automated centrally
• Does not require deep network expertise on your site as well as on your
customer site
A Better Approach for Connecting Customers’ Sites to Cloud-
Hosted Apps

11. © 2018 AVIATRIX SYSTEMS, INC. | 11
• You’ll receive email w/ a
link to a replay and slides
• Take 10 minutes and start
a free 14-day trial ….
https://www.aviatrix.com
• To view other bootcamps:
https://www.aviatrix.com/bootcamps
Next Steps with Aviatrix