Jason Sones VNO North America – Nuage Networks from Nokia Sherif Awad SDN Solution Architect Lead - Nuage Networks from Nokia Extending the Zero Trust Security Model for Containerized Applications to Public Clouds April 30th, 2019 VNO

Agenda Extending the Zero Trust Security Model for Containerized Applications to Public Clouds or Blah Blah Blah! [title is too long !!!] Overview The Journey The Dream Challenges The Solution Demo Questions

What is this presentation about? Overview What is this presentation about?

Overview What is the Zero Trust Security Model? Never implicitly trust any public infrastructure. Start with the assumption that every potential shared resource can be compromised. Implement policies to enable services based on minimal required access privileges. Always use micro-segmentation, authentication, authorization and encryption Between application and/or user endpoints. Constantly monitor access requests (analytics) and intrusion attempts and adjust policy to maintain the ZTM Prevent/Detect and Respond  Automate this if you can!

Overview The move towards unified networking and IT Unifying Islands of connectivity though central policy and control. Impact of the move to public cloud The emergence of hosting sensitive enterprise IT applications as containers work-loads in public clouds. Challenge is applying enterprise grade security policy to public cloud applications. Simplifying service provisioning and management across branch, private and public clouds. How to ease the end-user provisioning, consumption and management of these new unified services.

How did we get to this point? The Journey How did we get to this point?

1 2 The journey Data Center Connecting & Serving Disparate Locations (Private Cloud) vm Connecting & Serving Disparate Locations (SD-WAN) Site A Site B Site C VPN Kubernetes 1 2 Trusted Infrastrucutre = VxLAN only Public Transport  VxLAN over IPSEC

The journey (continued) SDN Policy Engine Kubernetes Branch 4 MPLS 3 App 1 Branch 3 WAN SDN Controller DC SDN Controller MPLS PE Internet Any DC underlay Branch 1 VNF 2 SDN GW WAN Data Center End-to-End Service Overlay Public Transport  VxLAN over IPSEC Trusted Infrastrucutre = VxLAN only

The Unified Secure Multi-Cloud

The Dream Why Orchestration

Why Orchestration? Internet Underlay SD-WAN overlay SDN / Nuage SlimCPE Internet Underlay SD-WAN overlay Nuage VNS VxLAN SDN / Nuage NSG-BR Local Cloud Nuage VCS OpenStack Telco Cloud Firewall n Enterprises m Branch types q versions p VNF types r configurations a underlays b datacenter stacks c VPC environments ThickCPE NAT Anti-DDoS Access Control WAN optimization Load-balancing Mail-scanner Other VAS 3rd party Cloud AWS Azure GCP ThinCPE GRE IP/MPLS Underlay Legacy Legacy IP/MPLS VPN SR/vSR NSP

Single-click deployment Why Orchestration? Service Updates Maintainable Service Single-click deployment Hypervisor Hypervisor Hypervisor Hypervisor Public Cloud Hypervisor Hypervisor

Identifying the obstacles that are standing in our way. Challenges Identifying the obstacles that are standing in our way.

Challenges What is missing to be able to realize the dream … How to ensure only authorized hosts can run containers workloads? How to secure traffic between containers on different hosts? How to provide end-to-end service provisioning, security, monitoring and visibility from branch to private DC to public cloud? Can I rely on public cloud for data that I am responsible to keep secure?

Putting it all together The Solution Putting it all together

End-to-End Service Overlay The Solution Orchestration SDN Policy Engine Kubernetes WAN SDN Controller Bootstrap Proxy Branch 4 MPLS 3 App 1 Branch 3 DC SDN Controller MPLS PE Internet Public Cloud Network Branch 1 App-22 Public Cloud GW WAN Public Cloud Network End-to-End Service Overlay ZTM  VxLAN over IPSEC

We actually got it to work!!! … mostly … Demo We actually got it to work!!! … mostly …

Lab Topology VSD VNO OpenShift Cluster Branch User Master Node01 Nuage SDN Cluster DATA/CP MGMT VSD WAN Cloud Master Node01 Node02 OpenShift Cluster DNS-NTP Kubernetes Branch SSL Proxy VNO

Demo And so it begins

Questions Don’t be shy! Contact Info sherif.awad@nokia.com jason.sones@nokia.com