HPE SD-WAN Gateways & Advanced Services

Well, just a quick intro. Uh, I'm Adam Fuss, uh, VP of Product Management for SD-WAN here at HPE Networking. Al.

I'm Al Ra, I'm director of Product Management. So this is actually the first time we're showing off our combined SD-WAN portfolio. Um, and so I wanna just quickly walk through what this looks like.

Uh, this is part of our, our overall SASS e offering. And then Dermal is gonna dig into, uh, a specific piece of all this. So, just starting on the left side here, to show you what we had with Aruba, we have HP Aruba Networking here.

We have really, you know, two different SD WAM products. We have the SD branch slash micro branch solution. These ones are fully managed through Aruba Central, and that's why we're gonna focus our time today is in Central.

And the application intelligence engine that we are, are launching. We have, uh, edge Connect SD wan, which is managed to the Edge Connect Orchestrator. This is also known by many as the Silver Peak, uh, offering.

Uh, HP acquired Silver Peak five years ago, which is where I came from. And then we've also added into our, uh, portfolio here, the HPE Juniper Networking Offering with the session Smart Router. And so, uh, this is actually manageable through two different places today, manageable through Mist and through the SSR conductor.

Um, but one of the things I really want to reinforce is that, yes, these devices all do SD wan, but they also do, you know, local edge firewall capabilities. So they're all next gen firewalls. They all service chain traffic to, uh, our security offering.

Uh, and they work within our greater ecosystem. And we are, of course, always working to advance those integrations together. Um, so this is just the, the high level of our SD-wan, uh, gateway portfolio.

And with that, I'm gonna hand it over to Dermal here. Okay, thanks Adam. So, um, so as, uh, Madani talked about, we are part of the, uh, SS e and security pillar.

So obviously Sdwan is part of that. Um, so what I'm gonna be touching on is mostly on the security, uh, side of things. 'cause obviously it's security field day.

Um, so what I'll be talking about is, uh, traditional, uh, viral functions or traditional security functions that is on-prem or at the edge using your gateway or any of your policy enforcement points. So the most common, again, coming from a set, uh, network security standpoint, the most common security challenge. When a bad actor gets into the network, what is the most common problem that you run into?

So, alright, I, I, I'll go with that. So, um, to me, to me it's more of a lateral movement. So once a user gets in or a bad actor gets in, and if one of the devices are impacted, it's going to affect everybody because of the lateral movement.

And that's why, you know, traditionally they come up with this static segmentation, or VLANs and VLANs obviously have problems, uh, which is, you know, it's fixed. There is no mobility, uh, you have to maintain on a regular basis. So then came the, um, whole identity based segmentation or dynamic segmentation based on user and, um, you know, device based identity.

So you basically identify osteo assessment and fingerprint the device based on what they're capable of doing. You admit the net, uh, admit into the network and then park them in a specific, um, you know, B line or a particular segment. And then based on their behavior, you're gonna do, uh, certain analysis.

This is where, um, what is missing here is if I simply go based on user and device identity, that's not sufficient. What we really need is, if you look at the network, typically what is mostly transacting is your application and data. So if I don't know the application posture or application identity or application, what is actually happening in my network, you're not really doing or benefiting from the dynamic segmentation.

So what I'm gonna be talking about is, uh, uh, what we are introducing as application intelligence engine. So this application intelligence engine has a bunch of different functions. One, obviously, you know, is to give you that benefit of protecting from that lateral movement by using dynamic segmentation, using the application posture and application fingerprinting aspect of it.

So if you look at application, um, in general environment, you have multiple different sources of application providing different information. So how do you guarantee that you can identify an application correctly and reliably, uh, for all different scenarios because you have deep packet inspection, you're gonna do, uh, profiling, you're gonna do policy enforcement, you're gonna do, uh, performance monitoring. You're, you're gonna do, um, you know, routing and steering.

There's so many different things that you're gonna be doing. You have to reliably use, uh, a unique way of identifying all of those use cases with the same application or same application identity all the time. So today what happens is each of those engines are going to be using their own way of doing things, so it's hard to correlate and bring them together.

What the, um, application intelligence engine brings you is a way to kind of correlate all of these different sources and bring them under one repository by correlating, correlating, uh, normalizing and sanitizing all of these different sources into one, uh, single, um, you know, um, repository, what we call as the application catalog. And once you do that as part of the normalization process, because different sources or different engines, in this case, you know, if you look at this, we have potentially multiple different sources. There's CSI, cosmos, FC, C, a bunch of different things.

Each of them might have overlapping identity. So for instance, cosmos as a, uh, deep packet inspection engine might tell you that this, uh, pattern based on the first five or six or seven or packets, this looks like a Dropbox. Same thing could be done based on a URL.

com, so therefore it is Dropbox. They both may be coming from two different sources. So I have to say that, okay, both of them are talking about the same thing.

com, another might say Dropbox Inc. So both of them are same for humans, it's straightforward, but from a digital standpoint, it's not straightforward. So we bring them together and create them as base applications first, and then we, uh, organize them into different, um, categories as well.

For instance, you can say Dropbox Box and OneDrive, and all of those are file sharing or cloud file sharing. So you group them under one thing and make it as a default, uh, application category that you can make. Take some of these base applications, stick them under the, um, base category and create them as an organized asset.

So where does this help? I mean, uh, before I get to the use cases, how, how does this get, uh, distributed? So what happens is, uh, for each of these different source that you have identified, you can create what we call as the vendor services.

Uh, first of all, this application intelligence engine is a service that is running in the Aruba Central that, uh, Adam Fus talked about. And, um, that service is responsible for all of these functions. So for each of the source that I talked about earlier, it's going to create what is called as a vendor service, and it's going to ingest information from each of those vendor service that will come in and we are gonna merge them into a common repository.

The way I showed you earlier, that is creating a base application using, um, you know, um, normalization and sanitization of multiple sources. Once that is done, the, the application intelligence engine is responsible for pushing down the signature to the right type of devices. In this case, you might have multiple policy enforcement points.

It could be an access point, it could be a gateway, it could be a switch or anything for that matter. So what this does is, uh, it tries to identify what is your capability based on that capability. It's gonna distribute the appropriate signature set to those particular, uh, devices so that they can do the enforcement.

Now each device might have different engines that are running for different purposes. So they go through and ingest those signatures, and each of those, uh, engines will go through and inspect and do their function once they're done with their function and do the policy enforcement, then they upload the telemetry that comes back to central there, we stitch them together because, you know, each engine may have only certain information, but the application intelligence engine has the full data of all the different information. So it's going to bring them together and enrich based on the telemetry that's provided with all the additional metadata and additional information it has.

So that way you get a much better, much, uh, richer information that is all correlated into a commonplace so that they can, uh, leverage this first or different use cases. It seems like there's a lot of configuration. No, this is all hidden behind the scenes.

You don't have to do anything at all. Basically what happens, so let's say for example, you have an access point mm-hmm. com or whatever.

So in this case, there are two different engines that are, uh, impacted. So one is, it's gonna look at the traffic and do, do Deepak and inspection of the pattern and then compare with the signature. All that it's doing is pushing down the signature.

And when it goes through the pattern of packets, it's gonna look at it and say, okay, this is the signature that that matches. com. com?

So it's gonna say, oh, that is streaming and this has this reputation and so on and so forth. So it c brings that down. Now, there are two different engines doing two different things based on the same exact application.

com. Both are actually same because I combine them as a base application. Now I know the DPI, uh, metadata you provided, as well as the other source, other engine that it provided.

I can bring them together and say, this actually means this. This is not just, uh, you know, application, it's also streaming. It has capable of doing all of these functions here, functions.

Here's the reputation, here's the compliance, and so on and so forth. So I'll give you a real, real world example. And this actually happened in one of the customer, uh, environment.

So let's assume that you had only one of those engines, and let's say just like right now we are going through Zoom. One thing you'll notice is, uh, zoom is not reliably identified by, uh, all engines exactly the same way. In our case, that's what happened.

So DPI looked at it, which is a deep packet inspection using the Cosmos engine, looked at it and said, okay, I can identify Zoom in probably say 60 to 65% of the time. Okay, you got that remaining 35% we still have to address. So there's another engine that looks at it and says, this is going to zoom us, therefore this is also Zoom.

And that let's say it covers another 10, 15%. Then we look at the potent protocol, which is another, you know, local, you know, homegrown environment, uh, homegrown, uh, identification engine that will look at ports, protocols, things of that nature and say, I'm gonna create a repository and based on this port, this protocol, this looks like zoom. Now if you look at this, this might cover another five to eight percentage.

So if you look at all of this together, now I'm getting close to 95% of the overall identification and of an application. Whereas if I only took one, uh, particular engine, I would've only covered 60% or 65%. So that's the advantage of bringing all of them together and merging it into a common, um, repository.

Did I answer your question? Yes. Okay.

Those seems pretty complex. No, it's all, it's all behind the scene. That's what the system is doing.

You are not doing much. I'll show you how, what you're configuring. Sure.

Something goes wrong, but go ahead. Yeah, Yeah. Can can you expand on that?

Well, troubleshooting, Yeah, I, I can I, yes, I'll show you that aspect. That's why I think bring, bringing them together is helpful because different engines point out same application differently at different point in time. So I need to know that what this one said versus this one said is all same.

So that's the whole reason we are creating that common distribution. And, and I'll, I'll get to the demo so you can see, uh, what is going on. So, I, I'll start with, uh, the dashboard.

I dunno how familiar you are with the central. Um, so Central is the our management, uh, portal where you can use it for provisioning, onboarding, licensing, um, and all kind of management, including policy monitoring, um, um, policy definition, troubleshooting, all aspects of it you can actually do. Um, that and what you see here, I have, uh, an environment which has multiple sites, and I'm going to, let's say I'm gonna take a role of a security person who's managing, um, a company's network, let's say they are into, uh, web hosting and development and things of that nature.

So let's say I am that person. So I come in and one of the first thing I'm gonna do is, uh, I'm gonna say, okay, let me go to my site and figure out what's going on. So I'm gonna go and run, uh, a command, which is like a chat command saying that, uh, tell me the application posture of my site.

So obviously this is a, um, agentic, uh, mesh that we announced couple of months back. What this is doing is it's spawning a multiple set of agents that's going to go through and look at my, um, prompt that I submitted, and it's going to analyze information with the, uh, with the information that it knows, and it's gonna spawn multiple agents, as you can see, finish thinking. But you would've noticed that it was going through using multiple different agents to do different things.

One for documentation, another for search, and so on and so forth. So it, it gave me a, a quick summary of what actually happened or what is in my environment, because the question I asked is, tell me the application posture of my site so it understands my site and gives me that information. So here at the top level, it says, your s site shows healthy network with 23 active applications, predominantly trustworthy.

So that's good. I don't have a problem with that, but I am a, you know, a security person who's responsible for my company network, and my company's involved in hosting and development tools. So let me go, Was that, was that information that you just prompted, exportable?

Yes, you can, you can export it. So if I go here, so I can select that and you can, you can export the data table. Yeah, you can export that information.

So, So, um, so now, now that I'm working for this, uh, company, what I'm gonna go and do is I'm gonna look at all the different application that my application catalog has gathered to see, you know, how are my applications in my network, or what applications are available for somebody to use. So one thing I'll start off with is the application catalog that I talked about where you take the base application, categorize them and combine them and curate them and create a category. So it's giving me the list of category and tells me what are all the application in each of the categories.

So for example, if I click on this, it's gonna show me the list of applications. And as an administrator, I can say, I don't want some of these applications to belong to social network. I want it to belong to something else.

I can actually uncheck this and market into something else. But in my case, I don't have access to make those changes because, uh, based on the role that I'm provided, I'm not allowed to make changes to these, uh, applications because I'm a security person not dealing with, uh, application catalog itself. So it gives me the insight into that.

So it's giving me the category. Now, if I go to application, um, this is where you'll see some, uh, some interesting information. So for instance, um, I talked about multiple sources of information coming together.

So if you look at this one, it's telling me Dropbox, it's giving the history of the company itself, where who it belongs to. It tells me all the different domains that, uh, this Dropbox application is potentially going to be using. And it also going to gimme a security score with information of how did I come up with its score.

So it tells me this is a trustworthy application of score of 94, and it gives me based on these, what you see, these different bars, or these are based on the different domains. It's giving you score for each of the domain. So some of them, or most of the domains are in a trustworthy state, but some of them have low risk, some of them moderate, and so on and so forth.

It also gives you, um, uh, another set of information, which is what are the potential vulnerabilities in these, in this application, it's giving me a list of, uh, vulnerabilities. So I can go and right click and look at the vulnerabilities itself to see what's, uh, what are those vulnerabilities. So GI gives me some high level information.

So here it says application, clear text credential, exposure in memory, vulnerability. That's one of the things, uh, one of the vulnerability is talking about. In addition, it also tells me about the encryption protocol, what type of protocol it's using, uh, what is my access control, if they have, uh, MFA enabled us or not, what are the certifications are there?

So if you look at this, there are two different sources that are giving me this information, and they're also different timebound. The top portion is actually, uh, over a period of time, it's an aggregate of everything that's happening until now. And this one is more, more real time in a sense related to this.

It may be in the last one day or one week or so on and so forth, which tells you that these here are the details based on what I know last, uh, from the recent time. So it basically, these are two those different sources that you're come bringing together as a security administrator. Now I get a much better sense of what these applications are capable of or what, what kind of security it applies.

Now, because I am a, you know, um, a security person for an IT hosting company, a web hosting company, what I'm gonna do is I'm gonna look for applications that are, uh, necessarily relevant to me. So I'm gonna go look at, uh, it se services and hosting, um, sales and SCRM. I'm gonna look at development tools, uh, cloud sharing, um, and so on and so forth.

So let's say I picked a few, uh, applications and because I'm looking at security, and today, as of right now, what I, uh, ran, it says it's in a pretty decent form. You know, it's in a trustworthy state. I don't wanna mess up that.

So I'm gonna look for any, um, any of these kind of risky applications. So let's go ahead and, uh, do a search on that. And it gives me, let me sort, sort by, uh, risk score.

So it says that there is at least one application that is high risk, and there are some suspicious and moderate. So it'll, if I go in, it's gonna tell me, uh, why it is so here it's a hundred percent of them are all bad. So in this case, there's only one domain, and that whole thing is really bad.

There's no MFA, the encrypted access is, it's not encrypted, there's no authentication. It's pretty bad. So, and if I look at this, there's many of them in that state.

So most of them, actually more than 44 applications are in a state of pretty bad state. So I don't wanna mess up my network, which is in a pretty decent state. So what I'm gonna go ahead and do is kind of preemptively, I'm gonna say, I'm gonna set a policy such that, um, you know, I'm not gonna allow my users to use this application while they're on my network.

So if you notice, all of these are done at a global level, basically what it does is all these policies, as a administrator, I'm defining at a global level. I don't know who's gonna be the enforcement point, I don't know which device is going to get what signatures, I don't know any of that stuff. I'm doing everything at a global level.

So I go in and I select a role based. So as I mentioned earlier, we can use identity based, um, um, profiling to admit users into the network. And then you use the application posture to figure out dynamic segmentation.

So here, what it gives me is the list of, um, different policies that I have defined based on, you know, who I'm as assigning it to. So in my case, I'm gonna be doing this for my employees. I'm gonna set a policy here.

So I notice that, you know, any, any allow, which is not a great idea. So I, I, I notice that there are many applications that are not in a good state. So I'm gonna go ahead and add a rule about this to deny, uh, applications that are not supposed to be there.

So how I'm gonna do that is I'm gonna select based on a role. Role is basically, if you are familiar with the Aruba approach, it is a, a combination of fingerprinting, a user and device and posture assessing and getting that information and creating a tag for that. So that's what it does.

So I'm gonna say I'm going to choose certain roles that I'm going to apply this. So, because, you know, I am hp, I'm gonna look at all the different ones. Let's say here at HI identified a role for camera, so I'm gonna block that as well.

Um, I'm gonna block, I'm gonna select contractors engineering organization marketing, because they may be use Salesforce and CRM tools. And we saw that they were actually, um, moderate risk. And I'm also gonna block, uh, product management.

I'm also gonna block the, um, sales folks. I'm gonna allow the support and, uh, security folks to deal with it. It's okay.

So now I selected those roles and I'm going to assign it to any destination. And what you'll notice here is there is a new category that we have created, or new destination, which is based on this combined, uh, repository or the tag that application engine that is doing. So I'm gonna choose this, and I'm gonna go based on application category and say, I noticed that most of the IT services, uh, and hosting had pretty bad.

The first one we saw was high risk. There was a suspicion suspicious one. So I'm gonna select that category, which has a bunch of different applications under that category.

So I've selected these six different roles, and I said, if it belongs to this category, now I'm going to block it or deny it, and I only care about when they're in my network. So I'm going to define a time, a time range. So I already defined business hours, so I'm gonna choose that as my time when I'm gonna enforce this policy and create the policy.

So once this policy is created, you notice that it'll get added here, uh, because I said, uh, above. Now the policy is done and it is created. And yeah.

Now two things that get pushed down to the device. One is the application signature from that repository that you saw, and these policies that I have defined. What happens is, um, there's a bunch of things that happen behind the scene, which is it look at the capability to the device, the scope of the device and topology where the device device belongs.

Based on that, it's gonna push these policies based on the scope it belongs to, because if you see here, I have multiple different scope, I can do it at global site collection sites, so on and so forth. And based on the device that belongs to, uh, and where these policies are supposed to go, it'll push those, uh, policies. In addition, it's also gonna push these signatures that we saw, uh, before from this application, uh, itself.

So once that gets pushed down, uh, you'll notice that those signatures are gonna get enforced. So I'm gonna go to the command line and show you quickly what, how that, how that, how that information went into. So, because I'm, uh, particular about my site, which is the San Jose site, I'm gonna go to the, uh, command line, uh, console, remote console of the gateway right from here.

And I'm gonna choose, in this case, I have three gateways. I'm gonna choose this gateway because I know that's where the traffic is set up. So I'm gonna log in using my credentials, and I'm going to look for, um, the session information.

So show data, And because I'm looking for specific type of, um, things in this case, because it's a gateway, I know that they can receive all the different signatures. So I'm gonna look for specific ones. In this case, as you saw in the, uh, presentation, I had different tagging for each of them.

So I'm gonna choose a specific one. In this case, it's called C, which is designating to cloud security intelligence as an engine that I want. And I, in addition to that, I also want to know all the base applications.

So what you see here is telling me all the data, uh, path or the, the transaction that's happening based on, uh, what has been, uh, delivered here. And you'll notice that some of the tags are identified here. So in this case, Aruba Networks is a website.

It has the tag that is classified by CSI with a tag of this one, and there's a transaction of that type. And there is, in this case, I, since I only look for C, it's gonna show me all the, uh, ones that are classified by this particular engine, and it's, uh, matching that particular signature. So that's what it's actually doing.

But this applies to the whole data path as, as it goes through the data path. Different engines might use different aspects of it, but it's showing, showing you that part of it. So this is, this is give you a, a quick high level of what is going on, but you know, this is not enough.

You want to know what happened, uh, overall from the, you know, the, the complete set of things. So I can go to the applications and see all the different applications that has been going through and gives me a high level information about those applications who are using it, uh, when, uh, when did they use it, all that information, uh, about it. In addition, it's also gonna give me some ance information, all that.

But main thing to point out is now I have a unified view of all the application, independent of the use cases that I can use for security as well as for performance, uh, aspect of it. So that's one part of it. And you know, from a use case standpoint, the same classification can also be used for fingerprinting, as I mentioned before.

So if I go up, uh, it's gonna tell me some information about, uh, security and notice that it's giving me some insights that these are all based on the application, um, pattern or usage pattern that's, so it's giving me, for example, it's telling me that there's an abnormal data upload or there's a suspicious, um, you know, uh, protocol that's happening. And this is because I'm able to see the pattern of the traffic and then recognize that this device, although it was onboarded based on the pattern, I know the behavior. Based on that, I can figure out what type of device as a dynamic, dynamic prioritize, I mean, dynamic profiling standpoint.

Because when it comes to profiling, you're not doing just going based on static information. You can use dynamic information. And in this particular case, because we are talking about dynamic segmentation, I can also use the pattern of the application usage and get information to figure out how, how should I treat this, uh, device.

So that kind of gives the overall on the demo part. So, you know, from a, from the simplicity aspect of it, you know, everything I'm doing is at a global level, I don't know how it gets implemented, how it gets pushed down, how it gets imposed As a global security administrator or site administrator, I only care about pushing the right set of policies to keep my network sane and without any problems how it was when we started. So other than that, the application administrator can go and, you know, do their side of things.

So for instance, in this example, it shows that I have business application that I create as a custom, uh, category. I put in certain application that I feel is right for my business users and they go and do this stuff. But I, as a security administrator, I don't have to worry about that.

All I care is setting the right policies and pushing down the right policies. So there is distribution of labor, there is no overlap, I don't have to worry about them. And it's completely dynamic, uh, taking all of that into account.

I have a question on discovery of shadow it, um, just broadly, I suppose, understanding how does the, how is the IT team take comfort in, um, that any new applications, uh, fall under this? Uh, so unknown applications, unknown Applications? Yeah, so we do have, um, you can actually look at unknown application, but because we are looking at, you know, as you saw this, like five, six different categories or engines that are providing these different sources, and since we can bring all of them together, you know, we can cover quite a bit of applications if any application is out there at all, because a lot of these are almost live updates where anytime I get new applications, I'm gonna push it down.

So it's very rare that you're not going to know, but it is common that I can still market as unknown or not evaluated. We will see those applications, you'll see the traffic pattern, it'll be marked as unknown or not evaluated. So just like how I did right now, if I know that this is, this is unknown or suspicious or, um, not evaluated, I might put it only to pilot users and not allow it for everybody else.

So by default, I can deny for everyone and only make it available to certain power, uh, folks until it is made available on top of it. Because I know even if there's, you know, unknowingly being allowed, I know based on the telemetry and information that somebody has used this application and how are they using it? And since I can do a chat and figure out how many are using unknown applications, I can still get that info.

Just for clarity, all this was done in Central. Yes. So this is relevant.

We, we saw those three different SD-WAN or connectivity solutions. This is relevant only for that first one, correct? The subject line branch, The application intelligence engine can be used across because it's a service.

Sure. As of right now it is on central. It's running as a service on Central.

Okay. So there is intent in bringing all of them together or using that engine for multiple different sources. Like you saw, um, you know, edge Connect for instance, uh, which is right now a separate orchestrator, you can use the same engine for that as well, But that's a future state.

That's where you Want. Yes. That's not in current.

That's what I'll make sure that we just Yeah, yeah. Not current. Understood.

What is, what is relevant today versus today. That is correct. It is only in central.

That is correct. Thanks. Thank you, Al.

Thank you. Um, and thank you, uh, delegates here in the room delegates that were remote and those of you that are watching the live stream, um, as I sort of led the opening of the session, there's a lot of really cool security technology now bringing these two, uh, great companies together. Uh, we just only had enough time to kind of cover two areas.

Uh, you know, we, we almost said let's do for three, but we kind of knew a lot of the technical questions may take us down a different path at trying to do two presentations. Just wouldn't make a whole lot of sense. So as I said before, we really hope, uh, that we have opportunities in the future to come present to you.

Uh, and, and you know, I did definitely hear a couple questions and comments. Hey, I see the technology over here. How's that gonna work over there?

Uh, I would say it's all sort of evolving at the moment. Um, but you'll certainly see a lot of that sort of cross pollinization, uh, pollination as if you will, between our different product sets, wherever we possibly can. Um, I also want to sort of highlight, there's other security technologies that are part of the greater HPE and even outside of our business unit.

Um, that would also be great opportunities for us to come present on things like Zerto, for example, which focus a lot, uh, on, uh, or ransomware prevention, uh, detection and so forth. So I think there's a lot that we can talk about. Wanna thank you again very much, uh, for this, and uh, we hope those of you watching enjoyed it as well.

And, uh, of course, uh, great conversations here and I think we'll have a few more. So I think at this point I'll go ahead and close out our session.