Business Values of Network and Security Virtualization

Transcription

1 Business Values of Network and Security Virtualization VMware NSX in the context of the Software Defined Data Center Klaus Jansen Virtual Networks Sales Specialist VMware NSBU 2014 VMware Inc. All rights reserved.

2 Agenda (1) Context: Software Defined Data Center and Virtual Networks (2) Cost and Security: Increased security through fine grained segmentation (3) Security: Total privacy for multiple tenants on a shared infrastructure (4) Security: Compliance in Architecture, Operations and Auditing (5) Cost and Security with Choice: Integration of 3rd party security solutions (6) Cost and Agility: Automation for Private Cloud and Self Service IT

3 (1) Context: Software Defined Data Center and Virtual Networks The Software Defined Data Center (SDDC) is an approach to virtualize all aspects of data center infrastructure independent of underlying compute, storage or networking hardware. VMware NSX represents a faithful reproduction of physical networks and security in software at full scale. It is an overlay network running on top of current data center networks. It s a key element in the SDDC architecture.

4 (1) SDDC Within, Between and Across Data Centers Software Defined Data Center (SDDC) Inter- Data Center Hybrid- Data Center Any lication Any lication Any lication SDDC Platform Data Center Virtualization Any x86 Any x86 Any x86 Any Storage Any Storage Any Storage Any IP network Any IP network Any IP network

5 State of the Art: Gartner Data Center Networking Magic Quadrant The NSX solution should be considered by existing VMware customers as a way of providing network agility and reducing network operational challenges within the data center. Gartner Data Center Networking Magic Quadrant, April 24, 2014 Most of the leading vendors of physical data center networking share our vision and provide technology for seamless integration of bare metal servers, perimeter security and other non-virtualized workloads. 5

6 SDDC A Platform for Industry Innovation 6

7 (2) Data Center Security? Micro-segmentation is the answer Security in the data center that so far was technically, financially and organisationally unfeasable! Granular, Internet Distributed Controls Internet Reduce attack surface Visibility of all traffic Block lateral movement Zero Trust Model 7

8 (2) NSX Distributed Firewall with Micro Segmentation saves cost Perimeter firewall: fewer devices, smaller devices, less complex device configurations, more choice of vendors Rule sets: better visibility, no unnecessary rules kept forever, less operational cost, easier to deploy and maintain Data Center Netwok: less complex configurations, better utilization, saves costly links due to reductions of East-West traffic between phyiscal hosts, frees network capacity, likely no need to invest in a new network now 8 CONFIDENTIAL

9 (2) Micro Segmentation Use Cases Enterprise s/zones Self-Service IT Multi-Tenant Dev X Test A Dev A Test X Use Cases Virtual DMZ Deployments Virtual Desktop (VDI) Enterprise Zone Segmentation Use Cases DevOps Cloud Use Cases SP: Multi-tenant Cloud Enterprise: On-boarding M&A Key Requirements Flexible Micro-Segmentation Additional Layer of Security Visibility and Operations Audit and Compliance Key Requirements End-to-end Programmatic Provisioning (Network, Security etc) Guard-Rails for Private Cloud Key Capabilities Multi-tenant Deployment Programmatic L2, L3, Security Overlapping IP Addressing Open for 3 rd party cloud management

10 (3) Total privacy for multiple tenants on a shared infrastructure When Enterprise IT acts like a Service Provider HR Group Tenant firewall DMZ/Web DB Services/Management Group Services Mgmt Tenant 1 Tenant 2 Finance Group Total Isolation DMZ/Web DB HR Group Tenant firewall DMZ/Web DB Services/Management Group Services Mgmt Finance Group DMZ/Web DB Completely separate unrelated networks Add advanced services based on virtual network, network segment, or security group Differentiated network services for different tenants 10

11 (4) Compliance in Architecture, Operations and Auditing Perimeter firewall Inside firewall DMZ VLAN VLAN PCI relevant customer data now isolated Finance HR IT Before All s on a VLAN can communicate freely Once one is compromised, lateral movement cannot be restricted No visibility of to traffic DB VLAN Services VLAN Finance Finance HR HR IT IT Now with NSX Full visibility of to traffic Micro-segmentation can granularly control apps even on shared VLAN Ability to monitor, report and audit e.g. with vrealize Log Insight AD NTP DHCP DNS CERT

12 (5) Multi-Layer Security with 3 rd party Integration Tags Security Groups VM Checkpoint, Palo Alto, Trend Micro, McAfee,... NSX 1 Consume 2 Enforce 3 Contribute Use NSX security groups in 3 rd party policy rules Enforce policy rules through 3 rd party physical & virtual GWs Remediate infected VMs by triggering by 3 rd party security solution [Confidential] For designated groups and individuals

13 Cloud Management (6) Cost and Agility: Automation Private Cloud / Self-Service IT NSX On Demand lication Web PRIVATE No external connectivity Including NSX Network & Security and 3rd party vendors Database VM Logical Switch Web ROUTED Any upstream Router Logical Router Web Logical Router Database VM Logical Firewall Database V M Web NAT Any upstream Router Logical Load Balancer Database VM Logical Router NAT Gateway

14 Thank you CONFIDENTIAL 14