TFI2014 Session I - State of SDN - Gary Hemminger
•Download as PPT, PDF•
2 likes•850 views
The document discusses the state of software-defined networking (SDN) from a security vendor perspective. It notes that SDN simplifies the insertion of layer 4-7 devices like firewalls by eliminating the need to reconfigure underlying network configurations. SDN allows traffic to be steered to enforcement points like firewalls without changing the network configuration. The document also describes how some SDN solutions from vendors like VMware, Nuage Networks, and OpenStack can be used to implement firewall insertion and micro-segmentation of traffic between VMs for security purposes.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to TFI2014 Session I - State of SDN - Gary Hemminger
Similar to TFI2014 Session I - State of SDN - Gary Hemminger (20)
More from Colorado Internet Society (CO ISOC)
More from Colorado Internet Society (CO ISOC) (13)
Recently uploaded
Recently uploaded (20)
TFI2014 Session I - State of SDN - Gary Hemminger
- 1. vArmour Networks State of SDN (from a Security Vendor Standpoint)
- 2. State of SDN (from a Security Vendor Standpoint) • Data center traffic is predominantly East-West and visibility and control is somewhat non-existent • Very difficult to re-architect the L2/L3 network configuration to force traffic flows through an L4-7 device (firewall, load balancer) • Micro-segmenting VM to VM traffic on the same hypervisor for visibility and control requires possibly huge number of port groups and VLANs • Organizations don’t like reconfiguring their virtual and physical network configurations • SDN vastly simplifies the insertion of L4-7 devices since the underlying L2 configuration is no longer an issue • Traffic can be steered to a physical or virtual port and forced through an enforcement point (ie firewall) without having to reconfigure the network configuration • Armour sees Security as a use case for why SDN is important and simplifies building secure, agile data centers vArmour Networks, Inc., 2014. All rights reserved. Confidential information. 2
- 3. State of SDN • OpenStack Neutron + KVM/Xen OVS offers a nice SDN construct for firewall insertion - Some issues with OpenStack multi-vendor and patch support but a number of customers are using this approach • VMware NSX Manager and NSX on ESXi offers another alternative SDN solution - Services register with NSX Manager and traffic redirection rules push traffic to firewall port for application inspection, DoS protection, visibility & security analytics - Requires NetX API integration • Nuage networks has a complete SDN solution with service template definitions and traffic redirection for ESX, KVM, and Xen - Hypervisor independent solution - L3 routing capable at hypervisor level - Easy traffic insertion, but does require port groups on ESXi vArmour Networks, Inc., 2014. All rights reserved. Confidential information. 3
- 4. State of SDN NSX + Firewall SDN OpenStack + KVM + Firewall SDN vArmour Networks, Inc., 2014. All rights reserved. Confidential information. 4
- 5. Service Chaining for L4-7 Insertion Firewall App Fabric Delivery Controllers Virtualized Services Platform Software Defined Networking (SDN) vArmour Networks, Inc., 2014. All rights reserved. Confidential information. 5
- 6. L4-7 Application Traffic Steering with Arista Directflow • Arista switches programmed to hash flows across firewalls • Firewall AppID policy drives session flow via Arista Directflow • Eliminates need for 3rd party Openflow controller • Simplifies implementation & operation • Traffic flows can be steered based on application policy • Many use cases: backups, VDI, Security • Includes Threat analytics vArmour Fabric Directflow Broker Arista Switch Distributes Sessions to EPs EP’s Perform App Identification vArmour Directflow Broker programs Arista switch Flow is sent in proper direction based on App Type vArmour Networks, Inc., 2014. All rights reserved. Confidential information. 6
- 7. L4-7 Application Traffic Steering with Arista Directflow • Arista switches programmed to hash flows across firewalls • Firewall AppID policy drives session flow via Arista Directflow • Eliminates need for 3rd party Openflow controller • Simplifies implementation & operation • Traffic flows can be steered based on application policy • Many use cases: backups, VDI, Security • Includes Threat analytics vArmour Fabric Directflow Broker Arista Switch Distributes Sessions to EPs EP’s Perform App Identification vArmour Directflow Broker programs Arista switch Flow is sent in proper direction based on App Type vArmour Networks, Inc., 2014. All rights reserved. Confidential information. 6
Editor's Notes
- The rise and sophistication of cyber crime and breaches in the data center is reaching record levels Detect and block malware and attack is the enterprise top priority Traditional solutions fail: Focus on Perimeter of DC Single location Single-context (connections, or files, or application) Result: Constant Security outbreak due to inadequate security mechanism
- The rise and sophistication of cyber crime and breaches in the data center is reaching record levels Detect and block malware and attack is the enterprise top priority Traditional solutions fail: Focus on Perimeter of DC Single location Single-context (connections, or files, or application) Result: Constant Security outbreak due to inadequate security mechanism