Next gen DC secu - Cisco · Segmentation •Establish boundaries: network, compute, virtual •Enforce policy by functions, devices, organizations, compliance •Control and prevent
Post on 10-Oct-2020
0 Views
Preview:
Transcript
Segmentation
• Establish boundaries: network, compute, virtual
• Enforce policy by functions, devices, organizations,
compliance
• Control and prevent unauthorized access to networks,
resources, applications
Threat Defense
• Stop internal and external attacks and interruption of
services
• Patrol zone and edge boundaries
• Control information access and usage, prevent data loss
and data modification
Visibility
• Provide transparency to usage
• Apply business context to network activity
• Simplify operations and compliance reporting
Secure Internal Zone from External Zone
Secure Application Tiers
Secure Data for Compliance
Secure Multitenancy
1 2
3 4
vPC
Campus/Data Center
Internet
Cisco VXI
Front-End (Presentation)
Web Tier (Business Logic)
DB Tier (Data Access)
CTX2
CTX1
VDC1
VDC2
CTX1
CTX2
vPC
Vendor
Partner
Extranet
vPC
CTX1
CTX2
6
Aggregation Layer
Services Layer (option)
Virtual Network & Access
• Initial filter for all ingress and egress to DC services &
compute - “North-South” protection
• Stateful filtering and logging for all ingress and egress
traffic flows
• Physical appliances can be virtualized and applied to
server enclaves
• Virtual firewall, zone/enclave based filtering
• IP-Based Access Control Lists
• VM attribute-based policies – Should Follow VM
• “East-West” protection
Data Center Edge
• Physical Delineation for all ingress and egress into the
‘CORE’ of the DC – Traditional Security Models apply
to North-South Protection
• Additional services location for server farm specific
protection and other potential zones
Traditional Edge
Security
Internal
Zoning
VIRTUAL ACCESS
DC Aggregation
DC Core
DC Access
DC Virtual Access
DC Edge
Layer 3
Layer 2 - 10GE
4/8 Gb FC
Internet Partners IP-NGN (BBG)
VRF-lite
VRF
Vlan/802.1q
Firewall/IDS Partitioning
FEX/A-FEX/VM-FEX
Virtual FW
Vlan/Pvlan
VXLAN
VDC
Compute Separation:
vNICs, VLANs, Port Profiles
Storage Separation:
VSAN, FC Zoning, LUN masking,
vFilers
Application Tier : logical and Physical
segmentation with L2/L3 firewalling
and security zoning
Network Separation:
Per-tenant routing and forwarding
tables (VRF)
VLAN IDs and 802.1 tag provide
isolation and identification of tenant
traffic across L2 domain
VRF-lite implemented at core and
aggregation layers provides per
tenant isolation at L3
VDC to segregate and virtualize the
equipment
Defense in Depth per consumer
(front end ASA, back end VSG)
8
Physical
Hosts
NGIPS ASA FW
• Control North/South traffic with ASA 5585
• Scale and HA with Clustering
• Inspect North/South traffic with NGIPS
• Segment and Protect virtual enclave with ASAv and vNGIPS
9
NGIPS
ASA FW
Clustering
NGA
Virtual FlowSensor
CTD : Cisco Thread Defense
Leverage your Cisco Infrastructure to fight Advanced Pervasive Threats
TrustSec with Security Group Tagging
SGT
SGT SGT
SGT SGT
SGT
SGT
SGT
ISE SGT
Simplify
Automate
Accelerate
Standardize
SGT
Users,
Device
Switch Router DC FW DC Switch
HR Servers
Enforcement
SGT Propagation
Fin Servers SGT = 4
SGT = 10
ISE Directory Classification
Data + SGT:5 SGT = 5
•
•
®
•
•
Clu
ste
r C
on
tro
l L
ink
Sourcefire on 5585-X
(Blade)
Sourcefire on 5500-X
(Software)
Subscriptions: Threat: IPS, AVC, URL Filtering, AMP
ASA 9.2 : INCREASED CLUSTERING SIZE AND PERFORMANCE
*Estimated Max with Jumbo frame no asymmetric traffic
Nexus 7000 Nexus 7000
Nexus
2000
Nexus
5000
10Gig Server Rack
vP
C
ASA5585-X
vP
C
Cisco
UCS
vP
C
vP
C
ASA5585-X
DC Edge
Internal DC
Zone(s)
DCI With
Dark Fiber
DC Core VDC
(Routed) Nexus 7000 Nexus 7000
DC Aggregation
Layer VDC
Compute Access
Layer
Nexus
1000v
VSG ASA1000
v
FW
CLUST
ER
Nexus 7000 Nexus 7000
Nexus
2000
Nexus
5000
10Gig Server Rack
vP
C
ASA5585-X
vP
C
Cisco
UCS
vP
C
vP
C
ASA5585-X
Nexus 7000 Nexus 7000
Nexus
1000v
VSG ASA1000
v
FW
CLUST
ER
RTT <10ms +
<100Km
Double-Sided vPC over Dark Fiber
10G-400G
Dark Fiber could be
connected to Core /
Aggregation or to a
dedicated Services
layer. Each has pros
and cons based
upon environment
Inter-DC FW
CLUSTER
C
CL
Nexus 7000
Nexus 7000
Nexus
2000
Nexus
5000
10Gig Server Rack
vP
C
ASA5585-X
vP
C
Cisco
UCS
vP
C
vP
C
ASA5585-X
DC Edge
Internal DC
Zone(s)
DCI (OTV)
Extranet
DC Core VDC
(Routed) Nexus 7000
DC Aggregation
Layer VDC
Compute Access
Layer
Nexus
1000v
VSG ASA1000
v
Inter-DC FW
CLUSTER
Nexus 7000
Nexus 7000
Nexus
2000
Nexus
5000
10Gig Server Rack
vP
C
ASA5585-X
vP
C
Cisco
UCS
vP
C
vP
C
ASA5585-X
Nexus 7000
Nexus
1000v
VSG ASA1000
v
FW
CLUST
ER
OTV VDC OTV VDC
Layer 2
Extension (OTV)
CCL
RTT <10ms +
<100Km
FabricPath Spine
Compute Access
Layer
Pod A3
Pod B2 Pod B1 Pod A1 Pod A2
Data Center A
Interconne
ct
L2 or L3
Data Center B
Pod B3
FabricPath Leaf
RTT <10ms +
<100Km
ASA
Cluster
•
-
-
-
-
•
•
•
•
•
•
Data Center Design Zone : http://www.cisco.com/go/vmdc
Source: Cisco® Global Cloud Index 2012
• Proven Cisco® security: virtualized
physical and virtual consistency
• Collaborative security model
Cisco Virtual Secure Gateway (VSG)
for intra-tenant secure zones
Cisco ASA 1000V for tenant edge
controls
• Transparent integration
With Cisco Nexus® 1000V Switch and
Cisco vPath
• Scale flexibility to meet cloud
demand
Multi-instance deployment for scale-
out deployment across the data
center
Tenant B Tenant A VDC
vApp
vApp
VDC
Cisco
VSG Cisco
VSG
Cisco
VSG
Cisco ASA
1000V
Cisco ASA
1000V
Cisco
VSG
Removed clustering and
multiple context mode
• Parity to physical form-factor feature-set
• Scaling through virtualization
• Up to 10 vNIC interfaces
• Crypto in software
• SDN and traditional management tools
• Scales to 4 vCPUs and 8 GB of memory
• Ability to manage one policy on both physical
and virtual ASAs
MULTI-TENANT AND APPLICATION AWARE
READ / WRITE SOUTHBOUND API
PUBLISHED DEVICE MGMT PACKAGE FOR
ACI
STANDARDS COMPLIANT
MONITORING FEATURES
Hypervisor Support
Orchestration Frameworks
ASA OPEN SECURITY PLATFORM
System Management
CSM
PNSC
ASA
ASAv
(Active) ASAv
(Standby)
2
4
Routed Firewall • Routing traffic between vNICs
• Maintains ARP and routing table
• Tenant edge firewall
Transparent Firewall
• VLAN or VxLAN Bridging / Switching
• Maintains MAC-address tables
• Non-disruptive to L3 designs
Service Tag Switching
• Applies inspection between service tags
• No network participation
• Fabric integration mode
®
®
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
9.2.1 9.3.1/9.3.2
ASAv PHASED RELEASE
APPLICATION
SECURITY
INFRASTRUCTURE
Web
Tier App
Tier
DB
Tier
Trusted
Zone DB
Tier
DMZ
External
Zone
Cloud
Application Admin
Security Admin
Network Admin
Cloud Admin
Application Admin
Security Admin
Network Admin
SECURITY
Trusted
Zone DB
Tier
DMZ
External
Zone
APPLICATION
COMMON POOL OF RESOURCES
Cloud Admin
Cloud
“Users” “Apps”
Intelligent Fabric
Logical Endpoint
Groups by Role
Heterogeneous clients, servers,
external clouds; fabric controls
communication
Every device is one hop away,
microsecond latency, no power or
port availability constraints, ease of
scaling
Flexible Insertion
ACI Controller manages all
participating devices, change
control and audit capabilities
Unified Management
and Visibility
Fabric Port Services
Hardware filtering and bridging;
seamless service insertion, “service
farm” aggregation
Flat Hardware
Accelerated Network
Full abstraction, de-coupled
from VLANs and Dynamic
Routing, low latency, built-in
QoS
Cisco Nexus 9000
Service Producers EPG “Users” EPG “apps”
Leaf Nodes
Spine Nodes
ACI Fabric
EPG “Internet”
Virtual Leaf
Service Consumers
TENANT AND APPLICATION AWARE
READ / WRITE ALL FABRIC INFO
PUBLISHED DATA MODEL
OPEN SOURCE
APIC
Hypervisor Management
Automation Tools
Orchestration Frameworks
System Management
Security
ASA
Industry Standard Compliant
A Platform approach to Data Centre infrastructure
“Users” “Apps”
Policy Contract
“Users → Apps”
ACI Fabric
Define Endpoint Groups
Any endpoints anywhere within
the fabric, virtual or physical
Ingress Fabric Rules
Programmed from Contract
Hardware rules on each port, security in
depth, embedded QoS
Single Pass Firewalling
with Flow-Specific Policy
Security administrator
defines generic templates in
APIC, availed to contract
creation
Single Point of
Management
Different administrative
groups use same interface,
high level of object sharing
Application Policy
Infrastructure Controller (APIC) Define Contracts Between
Endpoint Groups
Port-level rules: drop, prioritize, push
to service chain; reusable templates
EP
.
.
.
EP
EP
EPG WEB
EPG APP SERVER
provider
consumer
Contract specifies rules and policies on groups
of physical or virtual end-points without
understanding of specific identifiers and
regardless of physical location. … …
…
identifies what
traffic
L4 port ranges
TCP options
…
identifies actions
applied
QoS
Log
Redirect into SVC graph
…
End points in group
WEB can access end-points in
group APP SERVER according
to rules specified in the contract
defined bi-directionally in the “provider” centric way
Permit
Deny
Redirect
Log … …
Copy Packet
Mark Packet DSCP
There are six policy options supported: Permit the traffic Block the traffic Redirect the traffic Log the traffic Copy the traffic Mark the traffic (DSCP/CoS)
Policy encompasses traffic handling, quality of service, security monitoring and logging.
EPG
“Web”
Application Container
“Web”
EPG
“Database”
Application Container
"Database”
Policy Contract “Web → Database”
Service Chain
“Web →
Database”
192.168.1.0/24
FW
_A
DC
1
Application
Admin
Service
Admin
ASA
5585
Netscaler
VPX
Policy-
based
Redirection
•
•
•
•
Nexus 7000
•
•
-
-
-
-
ACI Fabric
Graph Physical Logical
•
-
-
•
-
-
-
ACI Fabric
Graph
Physical
Logical
top related