Nevrijeme u oblacima i kako se zaštititi

Transcription

1 Nevrijeme u oblacima i kako se zaštititi Goran Peteh Enterprise Systems Engineer Zagreb,

2 Agenda Internet trends MorganStanley Identity-aware infrastructure Physical and virtual security Cumulus 2

3 Internet trends MorganStanley Altocumulus 3

4 Identity-aware infrastructure ISE, Trustsec Complex workforce User and Device Mobility Device Proliferation Cloud/Virtualization What devices are in my network? Who are the users in my network? How do I enforce role-based access control? How do I scale my access policy across my network? Cirrocumulus 4 4

5 Wireless Remote Wired Virtual Cirrus 5 5

6 ISE Identity Services Engine Employees should be able to access everything but have limited access on personal devices Internet Everyone s traffic should be encrypted Campus Network Data Center Printers should only ever communicate internally Cisco Switch Cisco Access Point Cisco Switch Cisco Wireless LAN Controller Cisco Identity Services Engine Cirrostratus 6

7 Physical, Virtual, Cloud: End-to-End Security PHYSICAL VIRTUAL & CLOUD PHYSICAL APPLIANCES AND MODULES Multi-scale data center-class ASA devices CLOUD FIREWALL Enhanced cloud security New! Cisco ASA 5585-x ASA SM for Catalyst 6500 Cisco Virtual Security Gateway (VSG) Cisco ASA 000V Scalable in-line performance Data center edge security policies Flexible deployment options Proven firewall to secure your cloud Tenant-edge to -specific policies Automated, policy-based provisioning Altostratus 7

8 Cisco s Virtual Security Architecture Orchestration / Cloud Portals Virtual Network Management Center Extending existing operational workflows to virtualized environments VSG ASA 000V 2 3 Extending network services to virtualized environments Extending networking to virtualized environments Nexus 000V Compute Environment Virtualized Agile Policy- Driven Multi-tenant Cumulonimbus 8

9 : Enhanced Flexibility & Operational Efficiency VNMC ASA 000V (Standby) Nexus Nexus 000V 000V Distributed Distributed Virtual Virtual Switch Switch Ready for upgrade ASA 000V (Active) Efficient Deployment (secure multiple hosts) Dynamic/Mobility Aware (policies follow vmotion) Operationally Simple (easy to upgrade HW) Altocumulus translucidus 9

10 Delivery of Cisco Virtual Security Gateway Virtual Network Management Center Management console for VSG Runs on one of the s Nexus 000V with Distributed virtual switch Runs as part of hypervisor Port Group Virtual Security Gateway Software-based firewall Runs on one of the s Provides zone-based policy and secure segmentation for all s Security Admin Service Admin Physical Host UCS Other x86 server Cumulus congestus 0

11 VSG: Intelligent Traffic Steering with VNMC 4 Nexus 000V Distributed Virtual Switch 3 Decision Caching VSG Initial Packet Flow 2 Flow Access Control Log/Audit Mammatus

12 VSG: Performance Acceleration with VNMC Nexus 000V Distributed Virtual Switch ACL Offloaded to Nexus 000V VSG Remaining Packets from Flow Log/Audit Currus 2

13 VSG: Rule construct Rule Source Condition Destination Condition Action Condition Attribute Type Network User Defined vzone New Attributes Instance Name Guest OS full name Zone Name Parent App Name Port Profile Name Cluster Name Hypervisor Name Network Attributes IP Address Network Port Operator eq neq gt lt range Not-in-range Prefix Operator member Not-member Contains Cumulonimbus 3 3

14 Securing Tenant Edge with ASA 000V Proven Cisco Security Virtualized Physical virtual consistency vcenter Virtual Network Management Center (VNMC) Collaborative Security Model VSG for intra-tenant secure zones ASA 000V for tenant edge controls Seamless Integration With Nexus 000V & Scales with Cloud Demand Multi-instance deployment for horizontal scale-out deployment Tenant A ASA 000V Hypervisor Tenant B VDC VDC VSG VSG vapp VSG vapp VSG ASA 000V Nexus 000V Nimbostratus 4

15 VSG / ASA Intelligent Traffic Steering with VSG Nexus 000V Distributed Virtual Switch ASA Initial Packet Flow Cirrus spissatus incus 5 5

16 VSG Nexus 000V Distributed Virtual Switch ASA Initial Packet Flow 2 ASA in line Cirrus intortus 6 6

17 (policy evaluation) VSG 23 Nexus 000V Distributed Virtual Switch ASA Initial Packet Flow 2 ASA in line Cirrus uncinus 7 7

18 (policy evaluation) 24 VSG 23 Nexus 000V Distributed Virtual Switch ASA Initial Packet Flow 2 ASA in line Cumulus 8 8

19 (policy evaluation) 24 VSG Nexus 000V Distributed Virtual Switch ASA Initial Packet Flow 2 ASA in line Altostratus 9 9

20 VSG Nexus 000V Distributed Virtual Switch 23 ASA Rest of the flow 2 ASA in line (policy downloaded) Cirrus

21 ASA 000V: Consistent ASA Feature Set Blade Developed using existing ASA infrastructure Single code base across all ASA deployments Virtual ASA Appliance Customized to provide enhanced security for tenant edge deployments CLI Altocumulus 2

22 Non-disruptive Operations Server Team Security Team vcenter Attributes VNMC Nexus 000V Network Team Stratus opacus 2 2

23