VNS3 Secure Network Appliance Service Defnition for G-Cloud 7

Transcription

1 VNS3 Secure Network Appliance Service Defnition for G-Cloud 7 What does VNS3:net do? VNS3:net secures your applications in the cloud. VNS3:net is a cloud native network, routing and security solution which allows you to Connect, Integrate and Secure your cloud applications. VNS3:net functions as a hybrid networking and security device. Customers can build enhanced network services over top of any IaaS cloud platform network by using VNS3 s layer 4-7 services and the Docker container system. By creating their own network customers have control over end-to-end encryption, the encryption keys, IP addressing and Network Topologies. They do not have to trust the third party cloud provider for encryption and key management, as such they can attest to the security of their data. Secure your systems in the cloud; not only is all your data in motion encrypted but VNS3:net's stateful frewalls also give you defence in depth allowing you to enforce security policies and multiple orthogonal layers for added security. VNS3:net lets you manage your cloud based systems and servers as if they are running in your on-premise data centre. You can create your own custom network which you overlay on top of the physical/native network to give you control over your application and user connectivity. Use cases range from creating a simple VPN tunnels, to building a distributed, scalable, highly available set of federated resources connected via a VNS3:net mesh network. VNS3:net is multi-cloud use it to distribute your network across multiple public, private and hybrid clouds with the control and security you need. VNS3:net creating a simple VPN tunnel Because it separates the network identity from the underlying cloud network location VNS3:net gives you cloud mobility and agility without compromises. A VNS3:net network can be distributed across multiple public and private clouds to create one logical group of federated resource. VNS3 doesn't require new knowledge or training to implement, so you can integrate with existing network equipment Since its launch in 2008, VNS3:net has been used to secure over 500 million virtual device hours in the cloud. Over 1,000 VNS3:net customers have successfully created nearly 5,000 secure and interoperable solutions that work in and across clouds

2 Scalable Highly Available Meshed Overlay Network What is it? VNS3:net is diferent from other SDN and Network Function Virtualization (NFV) solutions in that it is application centric and allows you to create a customer controlled overlay network on top of the underlying network backbone which may be physical, virtual or SDN. VNS3:net is a hybrid virtual device that acts as seven devices in one: router, switch, SSL/IPSec VPN concentrator, frewall, protocol re-distributor, extensible NFV container scriptable SDN The VNS3:net virtual machine integrates with existing network equipment and can be delivered as part of the application deployment in virtualized infrastructures. Meet compliance requirements, attest to data security, and manage your cloud deployments with the VNS3:net UI. Dynamically launch and confgure your overlay network in minutes using the API or web-based UI. Use VNS3:net as a pay-as-you-go virtual network server to eliminates cloud networking risk. VNS3:net supports Docker containers allowing you to easily extend the VNS3:net virtual appliance to add new features (networking or other software) to tailor virtual networking functionality to specifc use cases. With Docker, VNS3:net can now support a range of application network (layer 4-7) services. E.g., third party products such as: Nginx (proxy, reverse proxy, SSL termination, load balancer) HAProxy (load balancer, proxy/reverse proxy) Squid (proxy, reverse proxy, cache) Snort (NIDS), and more...

3 Compliance and Compatibilities: VNS3:net is at IL0, however, it does not itself hold and process information, it provides an encrypted virtual network communication layer on which data can be moved and processed. VNS3:net is used for maintaining control of network topology, the network addressing, encrypted communication, and desired network protocols, when deploying to clouds thus enabling higher level IL and ISO/IEC accreditation for cloud deployments utilising it. If a higher IL accreditation is require for VNS3:net itself Cohesive Networks will work to achieve the required level. VNS3:net has been used by customers to create PCI and HIPPA compliant solutions deployed in the public cloud. VNS3:net itself is not accredited or certifed for compliance, but does support a broad range of standards out of the box, eg.; Tunnelling/VPN: SSL VPN. Ipsec VPN, Layers 2 bridging over GRE, Layer 3 Cloud WAN, Remote VPN (PPTP, L2TP, Ipsec) OpenVPN credential generation. Ipsec Support: Native Ipsec, NAT Traversal, 3DES, AES encryption, MD5 and SHAI Authentication, RSA, Dife Helman Key Management IKEv1 and IKE v2, Key Lifetime Management, BGP Peering, GRE over Ipsec, Multiple Peer List Support. SSL Support: Multi platform client, high Availability/Failover, Scaleable Mesh Deployments, Open SSL, Polar SSL, 1024, 2048 and customer key sizes. Certifcate-based Authentication. 3DES, AES Encryption, MD5 and SHAI Authentication, DTLS, TLS. Administration and Authentication: Web GUI. Scriptable API. Multiparty/factor support access. Network Interface Monitor, SNMPv2, confgurations Recovery. Identity Access Management, Live Licence Upgrade. VNS3:net supports most IPsec data center solutions: Preferred: Most models from Cisco Systems*, Juniper, Watchguard, Dell SONICWALL, Netgear, Fortinet, Barracuda Networks, Check Point*, Zyxel USA, McAfee Retail, Citrix Systems, Hewlett Packard, D-Link, WatchGuard, Palo Alto Networks, OpenSwan, pfsense, and Vyatta. Best Efort: Any IPsec device that supports: IKE1 or IKE2, AES256 or AES128 or 3DES, SHA1 or MD5, and most importantly NAT-Traversal standards. *Known Exclusions: Checkpoint R65+ requires native IPSec connections as Checkpoint does not conform to NAT-Traversal Standards and Cisco ASA 8.4(2)- 8.4(4) bugs prevent a stable connection from being maintained.

4 Available for Public Clouds Amazon Web Services EC2, Amazon Web Services VPC, Google Compute Engine (GCE), HP Cloud Services (Helion), IBM SoftLayer, Terremark vcloud Express, ElasticHosts, CloudSigma, Flexiant, Rackspace, InterRoute, Abiquo, and more Available for Private Clouds Openstack, Flexiant, Eucalyptus, Abiquo, and more Available for Virtual Infrastructure VMWare (all formats), Citrix, Xen, KVM, and more Backup/restore and disaster recovery: VNS3:net Controllers are virtual appliances that can be deployed in mesh for high availability, Controllers can be deployed in multiple availability zones or even in multiple clouds. The ability to deploy your network across multiple clouds can go along way in mitigating risk on three vectors; Grid-Geo- Political (location based), Infra Platform and Vendor Process risk. In the event one of the VNS3:net Controller instances fails the cloud servers on the overlay network will automatically failover to the next available Controller and where the IPsec routers support failover the remote Data Centre endpoints can also failover to the next Controller. Where a redundant resilient mesh of VNS3:net Controllers is not utilised the Controller can be quickly relaunched, confgurations can be quickly re-installed from snap shots (previously taken and stored) and the network connections quickly restored. On-boarding and Of-boarding processes/scope etc. : The creation of the overlay network by deploying and confguring VNS3:net Controllers and implementing connections is all self-service with easy to follow confguration guides. If required Cohesive Networks can provide implementation services at 100 per hour these services are delivered remotely via phone and screen sharing. Service constraints (e.g. maintenance windows, level of customisation permitted, schedule for deprecation of functionality/features etc.); VNS3:net licences are stackable they can be upgraded without down time. Version upgrades require new Controller instances to be launched and confgured during scheduled operational windows with limited downtime of 1 to 3 minutes. Service Levels: Standard suoport is included in the licence subscription fee. Enhanced 24/7 Priority Technical Support is available. This is a High Priority Service with SLA of 1 hour response with personnel on call, and the option to continue work 24x7. Financial recompense model for not meeting service levels: None Training: With use of the self-service confguration guides training is not normally required, but short knowledge transfer sessions are available on request. Ordering and invoicing process: Contact [email protected]

5 Termination terms: Monthly license subscription can be cancelled at any time. Customer responsibilities: VNS3:net Controllers are virtual appliances deployment in your public and/or private cloud environments and controlled by you the customer. There is not currently a managed service option, although this service could be explored if desired.cloud licence fees are not included in the licence fees. Trials/POC/Evaluations: Free edition is available for small production uses, and tailored Eval/POC licences can be made available on request to [email protected] More information at