Cradlepoint NetCloud Engine Partner FAQ

Transcription

1 Cradlepoint NetCloud Engine Partner FAQ DOCUMENT FOR AUTHORIZED CRADLEPOINT PARTNER PURPOSES ONLY How do I describe the Cradlepoint NetCloud platform? The Cradlepoint NetCloud platform represents the bundling and branding of all of Cradlepoint s cloud-based network services and edge software. It consists of two primary component services: Enterprise Cloud Manager (ECM) is the cloud-based management for networks NetCloud Engine is the network-as-a-service (NaaS) that provides cloud networking functionality What is the Cradlepoint NetCloud Engine? Short Elevator Pitch: The Cradlepoint NetCloud Engine (NCE) is a new cloud-based, Network-as-a-Service (NaaS) that lets customers easily create a secure private network that overlays the Internet for connecting people, places and things. They can now do this without the cost and complexity of a traditional VPNs, such as Topology Design, Private Circuit Ordering and Provisioning, IP address management, DNS setup, private APNs, sizing hardware VPN concentrators, configuring PKI, and so on. From a partner perspective, this means you can configure and deploy customers faster without tying up your most experienced network engineers. Just like with cloud computing, we ve used the cloud to automate and offload the complexity of building, deploying, managing and securing global networks (think: Amazon AWS for networking). 1

2 Longer Elevator Pitch: As enterprises continue to embrace and expand public cloud, workforce mobility, BYOD and IoT, more people, places, and things are being connected over the public Internet. This creates a new set of challenges for IT organizations that have traditionally relied on private IP VPN networks (like MPLS) and are used to deploying stacks of hardware appliances at the edge to provide visibility, security, and control. NCE provides distributed and mobile enterprises with an innovative, modern way to connect people, places and things using next-generation networking technologies such as Software-Defined Networking (SDN) and Network Service Virtualization (NSV), and it s delivered as a cloud-based service. NCE eliminates the much of the hardware, complexity, and operational costs of traditional WANs for many use cases, and extends the simplicity, utility, and security of a Local Area Network (LAN) anywhere across the Internet. From an end user perspective, NCE is designed to provide a seamless LAN-like experience from anywhere and with any device. This means that an employee using NCE to access private files and applications at Starbucks over NCE has the exact same experience as they would in the office over the wired or Wi-Fi network. Our NCE security foundation provides a secure virtual cloud network over the Internet which protects users, devices and workloads wherever they re deployed. Key feature elements include: Virtual cloud network (VCN) an encapsulated overlay network that is abstracted from the Internet using a private address space and private DNS service. This turns any WAN into your private LAN. Encryption protects data-in-transit end-to-end with the strength of 256-bit AES using TLS 1.2; this is the same security used for financial transactions. Secure Cloud Gateway provides a secure, cloud-based egress to the Internet that enables the use of any untrusted network for secure Internet access and let network admins set per-device and per-user access control and security policies. Multi-layer authentication device, virtual network, domain and certificate level authentication. Who benefits from a service like NetCloud Engine? Distributed enterprises and mobile SMBs and enterprises with lean IT budgets and staffing, and those who are grappling with securely connecting a growing number of remote people, places, and things to their data center, public cloud servers and SaaS applications. Ideal buyer profiles include: IT generalists Network engineers DevOps teams Managed Service Providers Cloud administrators IoT system administrators 2

3 Size of organizations to target with the Early Availability release: SMBs or enterprise business units that need to connect up to ~250 devices and workers Enterprises looking to deploy one or more targeted use cases (land and expand) or proof-of-concepts Any company looking to build a parallel network for M2M/IoT devices NOTE: number of devices may vary, but the overall network bandwidth with the initial phase is 200Mbps for Early Availability (Fall 2016) release. Some of the initial use cases to target with the EA release: Secure remote access (NetCloud Client on Windows, Mac, Linux and Android & ios mobile devices) Secure BYOD access (NetCloud Client) NetCloud as WAN (NetCloud Gateway on Cradlepoint AER series routers) Remote access to public cloud resources (NetCloud Client or NetCloud Gateway) Remote management of M2M devices (NetCloud Client or NetCloud Gateway on select IBR series routers) Ad hoc networks for pop-up retail, events and temporary sites (NetCloud Client or NetCloud Gateway) Secure IoT networks (NetCloud Client or NetCloud Gateway) Extending AD domains to remote worker and sites (NetCloud Client) When will Cradlepoint NetCloud Engine be available? NCE will be released into Early Availability the week of October 10 th for customer trials, proof-of-concepts (PoCs) and selected use case deployments. EA refers to the fact that this is the first commercial release of NCE and deployments at customer sites should be approached based on specific customer use cases. While no features, functions, and capabilities are limited, partners should work closely with their Cradlepoint sales and SE team to determine if the customer s use case is a fit. NOTE: It is very important that as customers and partners start trials or PoCs that Cradlepoint sales and SE teams are engaged. More information on the applicable use cases for the Early Availability release are listed below. The General Availability (GA) version is scheduled for delivery in early, Is there a limit to how many devices can be on a single VCN? For the EA release, we recommend no more than 250 devices per VCN. While this number is somewhat flexible, the Early Availability Release has a maximum Bandwidth of 200Mbps. We will continue to increase throughput in subsequent releases. 3

4 Is there a tool I can use to determine if the EA product will meet the needs of my customer? We recommend looking at the table below or using an online bandwidth calculator such as to determine how many users can be supported within the 200Mbps guideline. User Type Typical Applications Bandwidth/User (100 User Sample) # of Users for 200Mbps Basic Basic & Web Browsing Kbps Moderate Multi-Media Power User Some File Downloads, Streaming Music, Streaming Video, Cloud based resources; VOIP Large File Downloads (high volume), Interactive Web Conferencing (video, desktop replication) High Bandwidth Demand; Intense Internetbased Application Use; Multiple Devices Per User Kbps Kbps Mbps Custom Your Applications Your Number Here Does NetCloud Engine limit my bandwidth? While the NCE service itself does not limit bandwidth beyond the current 200Mbps per network (assuming compliance with the authorized use policy within the Terms of Service agreement), the throughput of any client or gateway connected device is dependent on the speed of the customer s broadband access link or Wi-Fi network. You might find that some applications such as Windows file browsing are impacted more than others if you're using it to connect devices that are separated by long distances. How can my customer setup a trial of NetCloud Engine? There are two ways to connect people (users), places (sites), and things (connected devices) to the NCE service: 1. Use the new NetCloud Gateway function that runs on select Cradlepoint routers, or OR 2. Install the NetCloud Client on customer machines, such as PCs, servers and mobile devices 4

5 New customers can trial NCE from our corporate site: This will launch a trial of ECM Prime and NetCloud Engine Prime features. Existing customers will be able to trial from within the ECM console: Under the Applications tab, a new tile will enable the trial of NCE. (See below.) How do I access NetCloud Engine from the ECM console to setup my trial network? As part of the NCE EA release, the NCE configuration and management functions have been integrated into the ECM console to provide single pane of glass management. To accomplish this, Cradlepoint has deployed a new Single Signon (SSO) function for ECM. For new users of NCE or ECM, this will be a seamless login experience. For existing users of both products, there is a chance that duplicate addresses exist in our backend systems, which has to be resolved before the user can successfully log in using SSO. Existing customers can avoid this potential duplication problem by ensuring each network admin user account has a unique address. A user workflow wizard is built into the ECM/NetCloud platform to help walk users through these conflicts, and automatically migrate them to the new SSO Login system. How do I test the Cradlepoint NetCloud features? Within the NetCloud/ECM web console there will be a new navigation tab and new actions that are available when a trial is initiated. If you have compatible routers deployed within ECM, there will be an option to enable the NetCloud Gateway function which allows you to create a VCN within the NCE service. 5

6 NOTE: Routers must be running a NetCloud OS software (formerly referred to as Firmware) version at or higher than 6.2. What routers support the new NetCloud Gateway feature? AER1600 & AER1650 AER2100 AER3100 & AER3150 CBA850 IBR1100 & IBR1150 IBR350 IBR600B & IBR650B NOTE: NetCloud Gateway will NOT run on IBR6x0. What happens when I install the NetCloud Gateway on a router? The NCE service will instantly create a VCN and you can connect any router-attached device to it by Whitelisting it within the router firewall. Once the gateway-attached device is authenticated, it joins the same VCN subnet with all other devices connected via other NetCloud Gateways or NetCloud Clients. Each device can then reach any other device just like a virtual LAN switch, and connections are encrypted end-to-end. Customers will be able to securely access remote desktops and behind-the-firewall applications, files, and printers from anywhere! For Early Availability, the Whitelisting is done by LAN IP address (behind the Cradlepoint) versus using a MAC address or other identifier. Thus, if you only want to whitelist certain devices behind the NetCloud Gateway, it is recommended to setup DHCP reservation before whitelisting. How do I deploy the NetCloud Client on other devices, like my phone or PC? We've developed several methods for deploying the NetCloud Client onto devices: You can add and invite new end users directly from the ECM web console. They will receive an invite asking them to download the NetCloud Client software directly to their Windows, Linux or Mac device. For Android devices, users will be redirected to the Google Play store to download a NetCloud Client App. For larger deployments, you can use Active Directory GPO or Microsoft's WSUS software update tool with our MSI package to automatically deploy to machines on your domain. For automated deployments of VMs and containers, an Authentication Key can be used with popular cloud automation tools like Puppet and Chef. For supported NetCloud Client operating systems and versions, please see this KB: ( 6

7 Is NetCloud Engine creating point-to-point connections between my devices? No. Every device on the same VCN is connected to the NCE via an encrypted tunnel and has full, any-to-any connectivity to all other devices just like an office LAN. Each VCN is hosted on a NCE ServicePoint that acts as a cloud-based data plane (formerly called Tunnel Server), the location of which is based on a geo-location algorithm to provide optimized performance. In addition, the availability of each VCN is ensured with NCE s self-healing and self-optimizing functionality. This means customer networks are migrated to another ServicePoint within the same or different cloud data centers in the event of an underlying service disruption. For example, if an Amazon AWS data center goes down or is impaired, affected VCNs will be instantly migrated without disconnecting active users. What public cloud providers does Cradlepoint use as NCE infrastructure? The Cradlepoint NetCloud platform runs on 9 different top-tier cloud data centers around the world. These include but not limited to Amazon Web Services, Rackspace, and Digital Ocean. Does all device data traffic flow through the cloud network? By default, any device connected to NCE, either through a Client or Gateway, operates in split tunnel mode. This means that ONLY traffic destined for another device on the same VCN will traverse the cloud network. All other traffic will be routed to the local LAN connection or internet destination. However, Prime-Service customers have access to the Secure Internet Access (SIA) feature on the NetCloud Clients. Using the SIA, all device traffic that is not destined for the local LAN is routed over the cloud network. All Internetbound traffic is routed to the ServicePoint Secure Cloud Gateway function that provides egress firewall and CG-NAT functionality. NOTE: For the EA release, the SIA will not be available for NetCloud Gateway attached devices. In the future, you will be able to specify which gateway devices operate in SIA mode and traverse the cloud network for non-local traffic. Among its many use cases, SIA is a valuable feature for mobile workforces who need secure, encrypted access to the web and corporate applications from public Wi-Fi hotspots such as restaurants, train stations, or airports. Can I configure a site-to-site connection using NCE? The NetCloud Engine is not a Site-to-Site VPN, but for small sites and sites where the workers are often mobile, deploying the NetCloud Client provides a simple and mobile-friendly alternative to traditional site-to-site VPNs. Customers can build a cloud network in minutes and connect users to the files and applications they need, whether in the office or on the road. For devices that do not support the client, Cradlepoint recommends using one of our supported routers running the NetCloud Gateway to connect IP-enabled devices (such as printers) to a VCN. 7

8 NOTE: Cradlepoint does not interconnect separate VCNs. For larger sites and more static workers, Cradlepoint routers combined with NetCloud Gateway provide a flexible and cloud-managed site-to-site solution where devices can be connected over either VPN or VCN connections. What types of environments block NCE connections? Connections to the NCE service from either clients or gateway attached devices use TLS 1.2, leveraging outbound port 443, just like SSL-encrypted web traffic. In the rare case of a Firewalls configured with SSL filtering or proxies may block these devices from connecting to their VCN. Should this occur, a firewall exception rule will be required to permit outbound connections. How does NCE handle authentication? Cradlepoint uses multiple factors of authentication. First, end users are authenticated based on credentials created when they were invited to a cloud network and set up their account. Once a device is authenticated with credentials at installation, a PKI certificate is issued for the device and checked every time it connects to its VCN. We also allow IT admins and DevOps teams to generate a machine-level Authentication to use with their Microsoft distribution tools (such as GPO and WSUS) and cloud automation tools used for the deployment of VMs and containers. What encryption is used? NCE uses AES 256-bit encryption leveraging elliptic curves. This is the same level of encryption banks use to keep data transactions secure end-to-end. What device operating systems are supported by the NetCloud Client today? Cradlepoint s cloud platform supports Windows 7 and above Windows Server 2008 R2 and above Mac OS X 10.7 and above Ubuntu Linux Redhat/CentOS Linux 6.5 Android 4.1 and above ios 8.0 and above (beta) How do I manage my cloud network? Network admins have full control over their cloud networks via the NetCloud/ECM web console. From there, an admin can add and remove users and devices, manage policies, view network activity, and enable NetCloud Services for complete visibility, security and control. 8

9 What do end users of the NCE service experience? The end user, or "user", enjoys a LAN experience from anywhere, without the traditional hassle of remote VPN access. There's no VPN client to start, no profile to select, and no extra login steps; users just power up their device and are on their cloud network within seconds across any Internet connection. With our ADConnect feature (see below), users can authenticate directly to the domain, extending the benefits of policy, permissions and password resets just as if they were in the office. NOTE: For the EA release, ADConnect is available for NetCloud Client devices, but is not available for devices without the client connecting through the NetCloud Gateway on Cradlepoint routers. Why should I trust NCE as my company WAN? Cradlepoint is trusted by some of the world s largest retailers, financial services companies, and transportation companies to deliver secure and reliable 4G LTE network solutions. NetCloud Engine was specifically built from the ground up to provide distributed and mobile customers with secure, reliable and resilient WANs in the cloud. Just like MPLS, NCE provides a private network and traffic is encrypted end-to-end without ever being stored or cached. Each cloud network uses a private IP address space to abstract it from the public Internet and eliminate the risk of address-borne attacks. Because NCE is a managed service, it constantly monitored by our operations staff and automated tools to ensure uptime and updated regularity to mitigate the risk of zero-day attacks. To further ensure the platform robustness, regular 3rd-party penetration tests from recognized leaders in the security industry are commissioned. What is ADConnect? ADConnect is one of the services that illustrates the power of NCE. ADConnect lets customers extend Active Directory (AD) domain services to remote devices on a cloud network. In just three simple steps, they can use ADConnect to extend domain services to remote users and devices anywhere without complex changes to DNS, policy, and firewall configurations. This means that geographically dispersed users remain part of the corporate Active Directory domain and are authenticated and authorized to access resources on the network as if the user was sitting on the office LAN. How does Network Access Control (NAC) feature work? Network Access Control (NAC) offers network admins an additional level of security when inviting users to a cloud network. Since most people have more than one device, this feature enables administrators to approve each device to avoid end users installing the NetCloud Client and using their credentials to onboard non-sanctioned devices. If NAC is enabled, each device a user on-boards will be displayed with the status of Pending in the web console until the admin approves or denies admission. 9

10 How does Application Filtering work? Application Filtering is a service that runs on NCE s Secure Cloud Gateway and can be used for application-based microsegmentation or to control access to business applications or common web applications like Pandora, Salesforce.com, Dropbox and Microsoft 365. Application Filtering uses a Deep Packet Inspection (DPI) engine to analyze traffic flowing across a VCN and discover and classify over 1,500 discreet business and web applications. It can also use defined TCP ports and protocols. Network admins can define polices to allow, restrict or block specific application traffic (such as Pandora or Hulu) on a per network, user or device basis. NOTE: For the Early Availability release, the SCG will not be available for NetCloud Gateway attached devices. One example of the benefit of Application Filtering would be with BYOD devices. A network admin can restrict a user s BYOD device so that it can only access a single application like Microsoft Dynamics on a single behind-the-firewall server, blocking all access to any other system. As the same time, the admin can allow that user s corporate-owned device to have full access to files and applications on any server on the same cloud network. How do customers buy Cradlepoint s NetCloud Engine? Purchasing the Cradlepoint NetCloud Engine follows the same packaging, pricing, and discounts as other Cradlepoint Products. See the price list for all available SKUs. What plans are available for Cradlepoint s NetCloud Engine? ECM Standard or Prime customers can buy an upgrade or new bundled license to the corresponding NCE Standard or Prime package. However, customers cannot mix different levels of between ECM and NCE. For example, an ECM Prime customer would need to buy NCE Prime if they want to use them in the same account. NCE Standard provides basic cloud network functionality while Prime offers advanced security and policy features such as AD integration, bandwidth monitoring, ios, Secure Cloud Gateway, Application Filtering, and other NetCloud Services. For a full list of plans and features see SKUs available on the pricelist or consult our website ( Can a customer buy a combination of both standard and prime packages? Plans are set at the account level. All licenses must be purchased as either a standard OR prime plan depending on the account plan. Please consult your Cradlepoint sales team for specific details on this scenario. Are there any pre-requisites or consideration before buying NCE? NCE provides two modes for connecting devices to a cloud network: 1. Use a Cradlepoint router that can run the new NetCloud Gateway function 2. Install the NetCloud Client on a supported device. 10

11 When purchasing NetCloud Gateway for a Cradlepoint router, purchasing ECM is required and a bundled option is available for purchase. If deploying a NetCloud Client only environment, then purchasing ECM is not required. What bundles are available for NCE? For NetCloud Gateway on Cradlepoint routers there is Standard or Prime bundle which include both ECM and NCE license. Additionally, a Standard or Prime bundle is available that includes CradleCare support. NOTE: NetCloud Client can be purchased with or without CradleCare bundled. I am an existing ECM customer -- how do I add NCE? For customers with ECM or the ECM and CradleCare bundle, there is an upgrade SKU to add NCE to your entitlements. Please consult the price list for full details. 11