Welcome!

Containers Expo Blog Authors: Mehdi Daoudi, Elizabeth White, John Rauser, Pat Romanski, Liz McMillan

Related Topics: Containers Expo Blog

Containers Expo Blog: Blog Feed Post

When Closed Is Not a Bad Thing

Rather quickly most network operators figured out that the network needed some basic protection from silliness

I remember the days when the network was open. Your PC, workstation or whatever you had on your desk could access whatever it needed (or not needed). Networking was an enabler of communication, it allowed you to put stuff onto the network, take other stuff off the network. Rather quickly most network operators figured out that the network needed some basic protection from silliness. Most of the early silliness was based in bad network implementations. Devices not responding correctly, spitting out broadcasts when they should not or just going haywire. We now call it DoS filters on switches and routers, but some basic filtering of malformed packets came rather quickly as a reaction to network outages. They were not very deliberate then, pretty much any hit against these rules should be considered deliberate these days.

hanging lockSince then a lot has changed. Universal connectivity, the Internet, Denial of Service attacks, hacking, and all things associated with it have drastically changed our view of free connectivity. Everyone has a firewall between the Internet and the corporate network. Many networks have firewalls between internal portions of the network attempting to control which devices and applications can talk to each other and which cannot.

When talking to datacenter and cloud customers, there is an interesting shift in the open connectivity approach we have always used to build networks. If you take a step back and think about how servers, applications and appliances communicate, there are very specific and very limited patterns of communications. A VM or bare metal server hosting a SQL database should only expect communication from a specific set of database clients on tcp port 1433 or udp port 1434. In a datacenter based service, the clients of this database are well known. They are specifically instantiated applications themselves, either as bare metal servers, or as VMs. They don't just pop up with the data center orchestration system knowing it. There is really no need for the network to allow any communication from or to this database application if its not from the defined database clients, on the defined sets of ports.

For such basic "weeding out traffic that is not allowed", you do not need a firewall. The network devices are perfectly capable of examining traffic with these basic rules and making a allow or discard choice. Typical networks have fairly complex ACL generation machines (read "a ton of Perl/Python/Ruby/... scripts") to ensure that some of these basic rules are enforced. The challenge is that managing these ever increasing set of lists gets more complex any time you add a new device, a new application, a new service. And this does not just apply to physical switches, the challenge is no less for virtual switches.

There are several evolutionary or even revolutionary things that are being done to make this easier. You have hopefully heard us talk about devops many times and this is a fine example of devops. The script machines mentioned before are most certainly devops, but as network solution providers, we can do so much more to make the life of the network/devops engineer easier. In a controlled data center environment, every application instantiation is a deliberate one. It has a role,  service, and a very well defined set of other applications it talks to. Kind of like what we created Affinities for.

This week specifically, there is huge amount of application-centric news. The desire or need to very clearly allow only needed communication is impossible without taking an application-centric view. The provisioning of the network has to become an integral part of the deployment of applications. Today, this takes the form of the deployment of specific ACL like policy rules to narrow down what these applications can talk to. Or the reverse, the creation of ACL like policy rules explicitly create the ability to communicate on a network that is otherwise closed down. And not closed down because some overarching rules are throwing away everything not explicitly allowed, but closed down because the network itself was built closed down as a fundamental choice.

When you think about it, it makes perfect sense to turn the old model upside down in a very controlled application environment. Start with no connectivity at all on the network. Every packet except those the network needs to find out where and what the application is (perhaps ARP, first MAC learning packet) is dropped. Clear, concise and very explicit integration of provisioning and orchestration systems create the application deployment workflow that actually enable packets to start to flow. And again, I very deliberately make no distinction between virtual and physical network. Our view there should be clear, the two of them must be treated as a integrated system.

The post When Closed is Not a Bad Thing appeared first on Plexxi.

More Stories By Marten Terpstra

Marten Terpstra is a Product Management Director at Plexxi Inc. Marten has extensive knowledge of the architecture, design, deployment and management of enterprise and carrier networks.

@ThingsExpo Stories
SYS-CON Events announced today that CA Technologies has been named "Platinum Sponsor" of SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CA Technologies helps customers succeed in a future where every business - from apparel to energy - is being rewritten by software. From planning to development to management to security, CA creates software that fuels transformation for companies in the applic...
SYS-CON Events announced today that IBM has been named “Diamond Sponsor” of SYS-CON's 21st Cloud Expo, which will take place on October 31 through November 2nd 2017 at the Santa Clara Convention Center in Santa Clara, California.
In his session at Cloud Expo, Alan Winters, an entertainment executive/TV producer turned serial entrepreneur, presented a success story of an entrepreneur who has both suffered through and benefited from offshore development across multiple businesses: The smart choice, or how to select the right offshore development partner Warning signs, or how to minimize chances of making the wrong choice Collaboration, or how to establish the most effective work processes Budget control, or how to ma...
We build IoT infrastructure products - when you have to integrate different devices, different systems and cloud you have to build an application to do that but we eliminate the need to build an application. Our products can integrate any device, any system, any cloud regardless of protocol," explained Peter Jung, Chief Product Officer at Pulzze Systems, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA
SYS-CON Events announced today that Cloud Academy named "Bronze Sponsor" of 21st International Cloud Expo which will take place October 31 - November 2, 2017 at the Santa Clara Convention Center in Santa Clara, CA. Cloud Academy is the industry’s most innovative, vendor-neutral cloud technology training platform. Cloud Academy provides continuous learning solutions for individuals and enterprise teams for Amazon Web Services, Microsoft Azure, Google Cloud Platform, and the most popular cloud com...
With major technology companies and startups seriously embracing Cloud strategies, now is the perfect time to attend 21st Cloud Expo October 31 - November 2, 2017, at the Santa Clara Convention Center, CA, and June 12-14, 2018, at the Javits Center in New York City, NY, and learn what is going on, contribute to the discussions, and ensure that your enterprise is on the right path to Digital Transformation.
"When we talk about cloud without compromise what we're talking about is that when people think about 'I need the flexibility of the cloud' - it's the ability to create applications and run them in a cloud environment that's far more flexible,” explained Matthew Finnie, CTO of Interoute, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
In his session at @ThingsExpo, Eric Lachapelle, CEO of the Professional Evaluation and Certification Board (PECB), provided an overview of various initiatives to certify the security of connected devices and future trends in ensuring public trust of IoT. Eric Lachapelle is the Chief Executive Officer of the Professional Evaluation and Certification Board (PECB), an international certification body. His role is to help companies and individuals to achieve professional, accredited and worldwide re...
Amazon started as an online bookseller 20 years ago. Since then, it has evolved into a technology juggernaut that has disrupted multiple markets and industries and touches many aspects of our lives. It is a relentless technology and business model innovator driving disruption throughout numerous ecosystems. Amazon’s AWS revenues alone are approaching $16B a year making it one of the largest IT companies in the world. With dominant offerings in Cloud, IoT, eCommerce, Big Data, AI, Digital Assista...
When growing capacity and power in the data center, the architectural trade-offs between server scale-up vs. scale-out continue to be debated. Both approaches are valid: scale-out adds multiple, smaller servers running in a distributed computing model, while scale-up adds fewer, more powerful servers that are capable of running larger workloads. It’s worth noting that there are additional, unique advantages that scale-up architectures offer. One big advantage is large memory and compute capacity...
Internet of @ThingsExpo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal and enterprise IT since the creation of the Worldwide Web more than 20 years ago. All major researchers estimate there will be tens of billions devic...
IoT solutions exploit operational data generated by Internet-connected smart “things” for the purpose of gaining operational insight and producing “better outcomes” (for example, create new business models, eliminate unscheduled maintenance, etc.). The explosive proliferation of IoT solutions will result in an exponential growth in the volume of IoT data, precipitating significant Information Governance issues: who owns the IoT data, what are the rights/duties of IoT solutions adopters towards t...
With the introduction of IoT and Smart Living in every aspect of our lives, one question has become relevant: What are the security implications? To answer this, first we have to look and explore the security models of the technologies that IoT is founded upon. In his session at @ThingsExpo, Nevi Kaja, a Research Engineer at Ford Motor Company, discussed some of the security challenges of the IoT infrastructure and related how these aspects impact Smart Living. The material was delivered interac...
The Internet giants are fully embracing AI. All the services they offer to their customers are aimed at drawing a map of the world with the data they get. The AIs from these companies are used to build disruptive approaches that cannot be used by established enterprises, which are threatened by these disruptions. However, most leaders underestimate the effect this will have on their businesses. In his session at 21st Cloud Expo, Rene Buest, Director Market Research & Technology Evangelism at Ara...
No hype cycles or predictions of zillions of things here. IoT is big. You get it. You know your business and have great ideas for a business transformation strategy. What comes next? Time to make it happen. In his session at @ThingsExpo, Jay Mason, Associate Partner at M&S Consulting, presented a step-by-step plan to develop your technology implementation strategy. He discussed the evaluation of communication standards and IoT messaging protocols, data analytics considerations, edge-to-cloud tec...
Artificial intelligence, machine learning, neural networks. We’re in the midst of a wave of excitement around AI such as hasn’t been seen for a few decades. But those previous periods of inflated expectations led to troughs of disappointment. Will this time be different? Most likely. Applications of AI such as predictive analytics are already decreasing costs and improving reliability of industrial machinery. Furthermore, the funding and research going into AI now comes from a wide range of com...
SYS-CON Events announced today that Enzu will exhibit at SYS-CON's 21st Int\ernational Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Enzu’s mission is to be the leading provider of enterprise cloud solutions worldwide. Enzu enables online businesses to use its IT infrastructure to their competitive advantage. By offering a suite of proven hosting and management services, Enzu wants companies to focus on the core of their ...
SYS-CON Events announced today that MobiDev, a client-oriented software development company, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. MobiDev is a software company that develops and delivers turn-key mobile apps, websites, web services, and complex software systems for startups and enterprises. Since 2009 it has grown from a small group of passionate engineers and business...
SYS-CON Events announced today that GrapeUp, the leading provider of rapid product development at the speed of business, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Grape Up is a software company, specialized in cloud native application development and professional services related to Cloud Foundry PaaS. With five expert teams that operate in various sectors of the market acr...
SYS-CON Events announced today that Ayehu will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on October 31 - November 2, 2017 at the Santa Clara Convention Center in Santa Clara California. Ayehu provides IT Process Automation & Orchestration solutions for IT and Security professionals to identify and resolve critical incidents and enable rapid containment, eradication, and recovery from cyber security breaches. Ayehu provides customers greater control over IT infras...