Securely Connecting Your Customers to Their Cloud-Hosted App – In Minutes
- 1. Securely Connecting Customers’ Sites To Your Cloud Hosted Apps – In Minutes AWS Bootcamp #6 – May 24, 2018 Sherry Wei, Founder & CTO Neel Kamal, Head of Field Operations Frank Cabri, VP Product Marketing
- 2. © 2018 AVIATRIX SYSTEMS, INC. | 2 • Use Cases for App Providers • Understanding the Challenges of Customer On-Boarding - Connectivity - Operational Readiness - Security & Compliance • Demo • Live Q & A Welcome & Agenda SHERRY WEI Founder & CTO NEEL KAMAL Head of Field Operations FEATURED SPEAKERS
- 3. © 2018 AVIATRIX SYSTEMS, INC. | 3 Check Out More Bootcamps – Available On-Demand www.aviatrix.com/bootcamps
- 4. © 2018 AVIATRIX SYSTEMS, INC. | 4 Networking Use Cases for Hosted Apps Providers AND Managing Your Internal PaaS Operation Onboarding Your Customers Customers YOU Users
- 5. © 2018 AVIATRIX SYSTEMS, INC. | 5 1. Connectivity Challenges - Building IPsec connectivity to the customer environment - Handling overlapping CIDR blocks - Supporting connectivity from the hosted environment to customer environment, which can be on-prem, AWS, Azure, Google Cloud, etc. 2. Operational Challenges - Lack of monitoring/insights into customer experience: latency, performance - Lack of alerting and troubleshooting ability - Lack of automation, which leads to delays and errors 3. Security & Compliance Challenges - Policy-based, remote user access to separate internal staff from customer staff - Isolate and segmenting VPCs to tighten the security perimeter and reduce audit scope Challenges in Connecting Customers’ Sites to Cloud Hosted Apps Onboarding Your Customers Customers YOU Users
- 6. © 2018 AVIATRIX SYSTEMS, INC. | 6 Challenges in Connecting Customers’ Sites to Cloud Hosted Apps 3. Security & Compliance 2. Operational Readiness 1. Connectivity
- 7. © 2018 AVIATRIX SYSTEMS, INC. | 7 Why Is It So Complex? - Requires involving customers’ network & security teams - Hits customers’ change control process when touching an edge device (for IPsec) and their perimeter security appliance - Requires your team to have expertise on a variety of customer edge routers What Does AWS/Azure Provide Natively? - AWS Virtual GW (VGW) & Azure VPN What’s Missing? - AWS VPN Gateway Limitation (supports 10 connections per VPC.) - Azure VPN Gateway Limitation (supports only 1 VPN connection for IKEv1) - Overlapping IP addresses - Traffic Direction Problem - Encryption Algorithm Mismatch 1. Connectivity Considerations
- 8. © 2018 AVIATRIX SYSTEMS, INC. | 8 Why Is It So Complex? - No visibility into your customer’s environment - Requires deep network expertise by the internal staff who supports connectivity to the customer environment (BGP, IPsec) - Committed SLAs impossible to prove What Does AWS/Azure Provide Natively? - No tools What’s Missing? - No Visibility: Cloud provider’s VPN gateway is a blackbox, there is no visibility - Automated Configuration: manually configuring traditional vRouter for 100s of IPSEC tunnel is not possible) - Too Slow to Onboard a Customer: VPN runs on UDP port 500/4500 which require opening corporate firewall ports) - Downtime Problem: When you add new IPsec tunnel, it will reset all existing tunnels 2. Operational Considerations
- 9. © 2018 AVIATRIX SYSTEMS, INC. | 9 Why Is It So Complex? - Giving customer users/groups limited access to your cloud- hosted app is just hard - SOC2-compliant reports (“who accessed what, at what time”) is even harder What Does AWS Provide Natively? - No AWS-native services What’s Missing? - A cloud-native User VPN solution - Profile-based access control with MFA - Audit logs that are exportable to your tool of choice 3. Security and Compliance Considerations for Remote Users
- 10. © 2018 AVIATRIX SYSTEMS, INC. | 10 • A communication module that you can include with your product to your customers: • Works in every type of customer environment: data center, private cloud, etc. • Does not require changes to edge routers or security appliances (opening ports) • Can sit inside the DMZ • Supports both IPsec and SSL termination • Provisioning and configuring these modules can be automated centrally • Does not require deep network expertise on your site as well as on your customer site A Better Approach for Connecting Customers’ Sites to Cloud- Hosted Apps
- 11. © 2018 AVIATRIX SYSTEMS, INC. | 11 • You’ll receive email w/ a link to a replay and slides • Take 10 minutes and start a free 14-day trial …. https://www.aviatrix.com • To view other bootcamps: https://www.aviatrix.com/bootcamps Next Steps with Aviatrix