nsx overview with use cases 1.0

Editor's Notes

• #25: It’s important to understand we are not talking about replacing the North-South Firewall, you will likely leverage hardware based performance and throughput capacity for a very long time at the perimeter of the data center.   However it is important to understand that there is a BIG difference between physical or virtual firewalls and distributed firewalling. Hardware-based firewalls are designed to deliver high performance, high capacity throughput, typically ranging from 2 to 30 Gbps, with some of the most powerful chassis-based solutions exceeding 100 Gbps. I believe Palo Alto’s most recent PA-7050 series chassis solution delivers is in the range of 120 Gbps firewall throughput. Virtual firewalls, are effectively the same from an operational standpoint, but often reduce feature sets and deliver far less throughput capacity, in the range of 1 to 3 Gbps The BIG difference with a distributed firewall solution is the combination of an automated operational model and scale-out throughput performance. Using an SDDC approach, firewalling policies are provisioned with and enforced at each VMs virtual interface. The firewalling function is done in the hypervisor kernel and delivers on the order of 30 Gbps, per hypervisor. So the more hypervisor hosts you have the more East-West firewalling capacity you have.
• #28: Darker blue shows performance of forwarding packets without filtering, about 20 Giga bits per second Lighter blue shows performance of forwarding packets while filtering, about 19.7 Giga bits per second Very little impact to the hypervisor’s ability to forward packets, because we are doing the filtering in the kernel.
• #29: And, we get about 80 thousand connections per second, compared to a typical virtual appliance firewall getting about 6 thousand connections per second.
• #41: You might be asking, why hasn’t this been done before? It’s really hard to understand the intended state of an application. The infosec team is not the team that built the app and tracking down all of the details about which processes should be running and how those processes should be communicating inside the app is tedious and labor intensive. The biggest differentiator that AppDefense has is its position in the hypervisor. AppDefense leverages its position in vSphere to automatically discover the intended state of an application. This process is aided with integrations into automation and provisioning systems, like VRA, so that as applications are built and provisioned, AppDefense sees their intended state from the get go. This authoritative understanding of the application’s intended state is critical and AppDefense makes this process relatively simple. In order to detect what’s bad, we need to know what good looks like. Once we can discern what’s bad, we can automate responses with confidence. AppDefense uses vSphere and if it’s installed, NSX as well, to take action in response to a detected threat. For instance, we can take a snapshot of the compromised VM for forensic analysis later using vSphere, then quarantine the VM using NSX. Or we can suspend the VM or increase logging on the machine – we have a number of options we can take. The key here is that AppDefense allows us to orchestrate all of this ahead of time and automatically trigger the response when it detects a given threat. The third differentiator is one that we talk about with respect to NSX a lot as well – because AppDefense is embedded in vSphere, it is protected in the event that a VM is compromised. Unlike AV agents that live on each individual data center endpoint, AppDefense cannot be simply turned off if an attacker or a piece of malware gains control of a VM. This layer of isolation is a major benefit to AppDefense’s architecture, and is fairly unique in the industry.
• #44: Use Case 1: Pure micro-segmentation What do we achieve?  Control traffic between devices within same subnet or within a network without the need for re-addressing or hardware purchase. For what purpose?  Cyber-security (eliminate the threat of lateral attacker movement within DC) and compliance. Without NSX? Operational nightmare to maintain complex solution, such as Private VLAN
• #45: Use Case 2: Pass your PCI audit in record time What do we achieve?  Segment zones based on business purposes, without the need for re-architecture, re-addressing or expensive capital expenditure. For what purpose?  Achieve compliance (such as PCI) in very little time. Without NSX? PCI scope encompassing the entire DC, lengthening the whole audit process & a nightmare to pass PCI audit without huge capital and operational investment
• #46: Use Case 3: Micro segmentation to secure VDI What do we achieve? Control traffic between virtual desktops for cybersecurity For what purpose? Cyber-security as it would prevent adjacent spread due to a VDI breach Without NSX? Not possible nowadays unless every VDI is protected by a virtual firewall which does not scale.
• #47: Use Case 4: Consolidate VDI pools for TCO reduction What do we achieve? NSX and Identity-Based FW enables us to consolidate multiple VDI pools into one For what purpose? Greatly reduced TCO Without NSX? Required multiple VDI pools and high number of firewall rules causing high cost and operational complexity
• #48: Use Case 5: Optimize Performance for VDI environments What do we achieve? Move the AV function from inside each virtual desktop to a dedicated service virtual machine, greatly enhancing performance on each virtual desktop For what purpose?  Greater consolidation ratio, reducing the Total Cost of Ownership Without NSX? AV agents on each VM add a 25% performance hit, reducing the maximum number of virtual desktops a host can support.
• #49: Use Case 6: Dynamic isolation of out-of-support servers like Windows Server 2003 What do we achieve? Isolate Windows Servers 2003 behind firewalls without the need to re-address them For what purpose? Reduce security risk associated with out-of-support Windows Servers 2003  Without NSX? Isolating servers would require server re-addressing (and associated challenges) and manual firewall rules changes. Let’s take a quick look at what that intelligent grouping enables: One of our customers had a significant concern. Microsoft announced it would no longer be supporting Windows XP. Our customer had hundreds of VDI desktops that were actually running XP in different locations spread across the globe. They needed to be able to identify which machines were running the unsupported OS, and define a policy that would restrict access for those systems to internal resources only. The problem in a traditional networking construct, is that this policy would be incredibly complex, taking into account all of the various physical networking constructs needed to implement consistent security. This would have taken weeks to months. With NSX, we are actually able to identify a group based on OS in minutes. This enables us to move into our policy definitions immediately.
• #50: Use Case 7: Dynamic isolation of virtual machines based on their security posture What does this solution do? Automatically scans VMs and place affected machines in quarantine until they are remediated For what purpose? Quickly and dynamically isolates security risk.  Without NSX? Requires manual scan, server re-addressing, manual firewall rule change before and after quarantine. Automated security allows you to quarantine vulnerable systems until the threat can be remediated CLICK – Create your policy definition policies CLICK – Apply those policies to specific security groups i.e. web servers, windows server etcCLICK – Once a threat is found the system is isolated from the network in it’s own L2 network with access to remediation services i.e. patch updatesCLICK – Once the threat has been remediated it’s allowed onto the network
• #51: Use Case 8: Micro-Segmentation applied to Mobile Devices What does this solution do? Restricting mobile applications access to specific enterprise applications For what purpose? Provides enhanced security for mobile devices enrolled with AirWatch Without NSX? Mobile Applications would typically be able to access most enterprise applications
• #52: Use Case 9: Advanced IDS/IPS security – Palo Alto Firewalls example . What do we achieve? L4-L7 security services as close to the source of the traffic (Virtual Machine). For what purpose? Reduce security risk associated with east-west traffic. Without NSX? Traffic is hair pinned to expensive physical firewall. When you integrated Palo Alto Networks NGFW with NSX you now have the ability to performance advanced application layer filtering CLICK – The Palo Alto Networks firewall manager called Panorama will talk to the NSX controller CLICK – The NSX controller will provision Palo Alto firewalls on all hosts CLICK – You then create a security policy within Panorama with your firewall rules, IDS and IPS policies CLICK – This will then get pushed out to your perimeter Palo Alto firewalls as well as the host firewalls CLICK – Traffic steering is then used to re-direct traffic form the distributed firewall to the Palo Alto firewall running on the host CLICK – Traffic is blocked, allowed or inspected depending on the rule set configured
• #53: Use Case 10: Collapsed DMZ What do we achieve? Deploy new services and applications onto a flat network, removing the need for multiple physical connections to a firewall For what purpose? Facilitates provisioning of services and reducing time to market.  Without NSX? Current DMZ architectures prevent fast services deployments, have complex firewall rule sets and require costly physical firewalls
• #54: Use Case 11: Integrate Dev, Test and Prod environment into single infrastructure What do we achieve? Consolidate multiple environments on single one while maintaining security isolation For what purpose? Infrastructure rationalisation Without NSX? Complex and highly dependent on whether network infrastructure can support features such as VRF Isolation – No communication path, separate tenants, separate Dev, test and production environments
• #62: It’s this combination of hypervisor-based in kernel distributed firewalling and platform-based automation that is making data center micro-segmentation Nirvana a reality for security teams today.
• #64: Thank you!