AI for Networking: Separating the Hype from Reality

Networks support explosive growth in traffic volume, connected mobile and IoT devices, and interconnected applications and microservices needed to deliver required services. Today’s networks generate massive amounts of data that exceed the ability of human operators to manage, much less understand.

With unprecedented increases in network complexity and scale, AI is no longer just “a nice to have” – it is becoming essential to helping NetOps teams maintain service and network assurance. Network strategists already know this: More than 50% identify AI as a priority investment needed to deliver their ideal network.

AI: What can’t it do?

However, there are also a lot of over-blown expectations. As the engineering lead on AI for networking at Cisco, I often find myself in conversations about very futuristic, and somewhat unrealistic AI-enabled scenarios. It can be quite entertaining – but we also need to remember that today’s AI technology is not a panacea for every networking ailment.

For now, and for the next few years, AI will only help fully automate a limited set of straightforward use cases. In most cases, that require more complex and flexible analysis, AI will simply help human operators make quantifiably better and faster decisions.

AI: What can it do?

So, what can AI help us do today? One of the most common AI techniques, machine learning (ML) offers unique capabilities that operators can use to assure required network performance.

ML algorithms are certainly very powerful, but they also have a reputation of being difficult to design, tune, and adapt to a variety of situations and sometimes have been known to produce results that may be difficult to interpret.

With Cisco AI Network Analytics, we have created a learning platform that solves issues where ML provides an indisputable and impactful benefit for network operators over existing technologies and approaches. This is possible thanks to the combination of two factors: (1) decades of experience in building some the world’s largest and most advanced networks and (2) deep expertise in ML algorithms that can effectively process networking data.

AI and ML have some useful applications

Let’s look at one of the more useful ML use cases – complex event processing. When applying ML to network telemetry, it is possible to establish dynamic baselines of what constitutes normal operating conditions for a given intent.

For example, the ML model(s) may be used to predict what should be the lower-upper bounds for a given KPI, for example, Wi-Fi on-boarding times. On-boarding refers to the set of complex tasks triggered when a wireless client attempts to join a wireless network.  Joining a network successfully and seamlessly contributes significantly to the Quality of Experience for the end user. Being able to monitor such complex, multidimensional KPIs so as to detect abnormal onboarding times, along with determining potential root causes should an issue occur, is a fundamental task for IT teams.

In this instance, Machine Learning (ML) allows for computing models used to predict the upper and lower bounds of the KPIs for on-boarding. KPIs falling outside a prediction as provided by the ML model would be considered “abnormal” for that unique network involved, and thus would be candidates for raising an alarm (that is, an alarm based on a learned bound, not based on a static value).

The figure below shows a predicted “band” (shown in green) of normal values for the percentage of failed onboarding sessions. As we can see, at some point the percentage of failed onboarding sessions (blue line) became abnormal (falling outside the green band), considering a number of network variables involved, as analyzed by the ML algorithm in use. This departure from normal to abnormal behavior for this network is denoted by the red section of the time-line in the diagram shown.

Predicted range of normal values for the percentage of failed onboarding sessions

A second ML use case that has a lot of potential is correlated insights. ML can provide deeper insights and visibility into the operation of the network and even help predict when an anomalous condition is likely to occur in the future.

A third important use case would be root-causing. In some cases, an ML algorithm may be able to detect anomalies with associated root causing, whereas in other situations more than one ML algorithm may be used in conjunction with anomaly detection to provide root causing.

IBN and AI as disrupters

AI and advanced networking technologies like IBN are disrupting how things are done, especially for networking operations. Testing of new applications can be done in minutes instead of weeks. Troubleshooting gets significantly easier when an assurance engine identifies root causes and recommends fixes. In fact, when armed with powerful dashboards that offer actionable insights, a future network operator may only need to look in a handful of places, as opposed to plowing through heaps of possible causes.

The intent-based networking (IBN) vision is that network teams will simply define the required behavior, and the network will know how to continuously align itself with what the business needs.

Continue reading

How to quickly capture share of the SD-WAN Managed Services market

Early in the 21st century, the subject of applications being delivered across the WAN was being researched.  It took more than 10 years for computing power to increase sufficiently to support analysis of the network traffic in order to make informed decisions in real-time.  This increase enables support of an overlay network that could function as traditional WAN did – but at a much lower cost. In 2014, the term software-defined WAN, or SD-WAN, was being used to describe this overlay network.

The benefits to customers of SD-WAN are significant, but the opportunity for solution partners of all types is vast and profitable. For some partners, providing a managed service for SD-WAN is new territory and they currently don’t have the depth of knowledge on SD-WAN implementations –  and customers may select competing partners that tout more expertise in the service.  A lost opportunity isn’t just the SD-WAN service, it’s also complementary services that can be provided by the service provider.

Just having enough expertise to implement an SD-WAN infrastructure for a customer is not enough.  You need the capacity to deliver and maintain connectivity to applications over the WAN – often to one or more clouds.  With Over-the-Top (OTT) services consuming greater bandwidth, adjusting for the ebbs and flows of business can become a challenge in providing the Application Quality of Experience (AppQoE) your customers need in a multicloud world.

SD-WAN Delivery Models

There are 4 main delivery models for SD-WAN:

1. Re-sell – it’s still the most common in the market. However, the market is changing from large Enterprises buying SD-WAN appliances using CapEx funds and attempting to implement it themselves to one that extends down-market, uses an OpEx model and is managed by a service provider.

Managed Services Practice Models

2. Build – Offering SD-WAN bundled with additional professional services and network connectivity options. The service providers build the SD-WAN infrastructure to a customer’s requirements and provides services for that customer.  This option has the longest ‘time to market’.

3. Co-deliver – This model involves a partner working with an SD-WAN vendor. Partnering with Cisco expands the technical workforce capabilities.  It has a slightly faster time to market than the ‘Build’ model.

4. “As A Service” – This model is based on consumption and addresses the complete lifecycle of deployment. A service provider or system integrator engages a company such as ngena (net) who offers the complete SD-WAN infrastructure, full lifecycle expertise, and flexible options to ensure successful deployments.  This model has some unique benefits for both customers and partners and is our focus for the rest of this discussion.

Let’s say you are a strictly SD-WAN resell partner today and want to take advantage of profitable opportunities delivering managed services for SD-WAN.  You’ll need a Business and Go-to-market plan, you need SD-WAN expertise and the understanding of how OTT services will impact the customer. You need to build out capacity to deliver and support the infrastructure, you will need new billing models, and you will need to implement consumption tracking.  In this fast-moving market, the service offering build-out time could negatively impact your market share, ability to expand service offerings and capture new recurring revenue streams.  Creating new services requires a significant investment in time and resources to develop and can be fraught with risks.

Working with an “As A Service” Partner

Providers can partner with ngena for faster design and implementation, ability to leverage a scalable portfolio of solutions built on Cisco’s SD-WAN products, have confidence in a future proof delivery model, and leverage white label deployments.

Here’s an analogy: You are building a home for a client.  You are the general contractor.  Maybe you have some skills in electrical work too – maybe enough to do the work yourself, but that will take time from you overseeing the rest of the project and keeping to a delivery date.  As the general contractor, you hire an electrician to wire everything up.  The electrician is ngena.  You get expertise and confidence the work will be done correctly – and you save time and get to focus on what you need to focus on.

Partnering with ngena, you are ready to sell now, and it provides the consumption model that allows you to build Monthly Recurring Revenue (MRR) streams.  ngena offers wholesale prices to partners with zero CapEx investment which provides an incremental margin opportunity.  The ngena offering is a Cisco SD-WAN solution which provides a predictable application experience (AppQoE), and security that is built-in to provide secure segmentation across the entire network stack.  Cisco’s SD-WAN is enterprise-grade and provides intent-based networking with multi-domain policy.  CRN honored Cisco SD-WAN with the SD-WAN Product of the Year award for 2019.

ngena delivers the service through a single portal with worldwide orchestrated operations featuring pre-defined services, intelligent automation and predictive analytics, and is DevOps ready.  They offer a global presence through dedicated global infrastructure, backbone and the ability to take care of local loop connectivity as well.  Full lifecycle management enables scalability to address the needs of any migration.

Interested in quick GTM and expanding your service offerings?  ngena provides a global end-to-end managed platform that is truly unique in the industry – delivering secure SD-WANaaS for any category of partner.  Regardless if your scope is just your domestic market or serving international markets, ngena provides that coverage.

Continue reading

What do ‘Owning Your Edge’ and ‘Customer Experience’ have in common?

It’s not easy to be in the resell and network integration business. For decades, our partners have been wrestling each other for differentiation and relevance in a crowded and unforgiving landscape. We often ask partners “Why do customers buy from you?”, and while the answers vary, they are often predictable, generic, and unconvincing. “We have the greatest engineers” or “We have amazing customer relationships and we do whatever it takes to support them.”

How do partners recognize their differentiation, define their uniqueness and own their edge?

At Cisco Partner Summit 2019, Oliver Tuszik displayed a picture of himself next to a monkey and declared (to the audience’s laughter) that although 99% of their DNA is shared, they are very different indeed. One is relaxed and eating a banana, while the other has an accelerated heart rate and is on stage presenting to 3,000 people. Although the DNA differences are very small, those differences are extremely significant, and a great illustration of what it means to have an edge. The Cisco Partner Consulting & Innovation team has worked with countless partners to help them realize just that. We’ve utilized our Unique Value Proposition (UVP) workshops to help many partners define their edge. For some, their edge is clearly understood, but most struggle with defining and communicating it.

So, what does that have to do with Customer Experience (CX)?

To understand a partner’s edge, it’s important to identify their strengths and align these strengths to what their customers care about. At the heart of it all is the challenge of quantifying how they provide a complete lifecycle experience to their customers. Understanding the technology, managing the product/service/software ordering and billing process are not easy but they are table stakes to be in this business. This, by no means, is an attempt at trivializing these functions. For some partners, their edge is their ability to address fulfillment faster, easier, and cheaper.

For most partners, the opportunity to differentiate happens after landing the deal. Their edge is in how they interact with the customer to implement and adopt the technology purchased. Their edge is demonstrated as they ensure that the customer maximizes the return on the investment they made, and it’s defined in the partner’s ability to manage risk and proactively help the customer achieve their business goals. These lifecycle activities are not new to our partners. It’s in these areas where they can enjoy the margin-rich professional services and managed services they possess. Partners generate (on average) 15% margin with their resell business, but they obtain upwards of 30% margin on their partner-branded and delivered service(s).

For many years, partners have honed their customer relationships so they can build upon the stickiness that post-sales activities promise. Cisco CX defines the steps that partners have followed intuitively for decades. CX identifies the lifecycle milestones and defines the steps for true adoption – where customers are choosing, using, and loving Cisco. It provides the process for systematic execution and holds the promise of automation to lead to the seamless renewal stage. CX also enables the lifecycle and demonstrates to our partners that we not only understand how they define their edge, but we now speak the same language, and lead together. As one partner executive told me at Partner Summit – “Cisco finally understands our world.”

CX fuels the lifecycle that partners embrace to own their edge.

Continue reading

What can you learn from your most profitable competitors?

There is one thing that every CEO wants to know the answer to: How is my company performing compared to others?

This question does not stem from insecurity, but rather from the desire to gain insight, to achieve great results, and to generate maximum returns. “Am I charging enough for my services?”, “Are my costs of sales higher or lower than others?”, “What are my competitors doing that I can learn from so I can increase my operating income and my valuation?” For publicly traded companies, some high-level information is readily available, but specific margin attainment and productivity metrics are not typically reported yet are highly coveted.

Cisco’s Partner Consulting and Innovation (PC&I) team offers confidential financial benchmarking analysis for partners’ complete business operation. Most recently, we completed an aggregate study of our findings and explored what separates the most profitable partners, the 20% of partners with the highest EBITDA, from the rest. Our most profitable partners enjoy EBITDA of 13.1% versus the average attainment of 4.9% – there are many factors that contribute to this impressive 2.7x performance.

Let’s look at a few:

1. Selling More Partner-Branded Services

Traditionally, services were a capability that partners would attach to an infrastructure deal: “I will sell you the network infrastructure and attach my implementation services”. This service-attach behavior served well for those partners wishing to achieve 10-15% of their revenue via their brand of service. However, most partners strive to offer consulting, architecture, design, and day-2 service capabilities to their customers. We’ve seen a steady increase over time in that business model. In fact, on average, the Cisco partners we have analyzed generated 21.6% of their revenue from their brand of service, while the most profitable generate 27%.

The most profitable partners do not view services as an ‘attach’ play, but rather as a comprehensive and differentiated margin-rich capability that facilitates their customer engagement lifecycle and stickiness. These partners embrace the entire Cisco portfolio of capabilities as a platform which enables them to position their services in a manner that delivers an integrated technology solution to address a business need. Doing so enables them to command higher margin, attain greater project control, and increase customer intimacy.

2. Recurring Revenue and Managed Services

It is no secret that transactional and project-based business is somewhat unpredictable. Our partners have been on a long and challenging journey to increase the recurring revenue components of their business and many have built Managed Services and Cloud capabilities along the way. On average, partners generate 37.5% Gross-Margin on their MS/Cloud business, but the most profitable partners enjoy average margins of 46.2%. These healthy margins are extremely attractive, and they are rather sustainable, but still represent a small percentage of a partner’s overall business at just 7%. What separates the most profitable from the rest is their ability to generate a larger percentage of revenue from their recurring business and provide advanced capabilities to their customers. These partners offer Managed Services that consist of data-driven, proactive capabilities addressed to support the customer’s business needs and not just reactive infrastructure monitoring. The most profitable partners have specific and intentional sales motions with unique & qualified skillsets to sell Managed Services with an emphasis on solving a business needs, addressing different economic buyers, and focusing on the user experience across the full lifecycle.

3. Account Managers (AM) and Systems Engineers (SE) Ratios

The most profitable partners invest in more pre-sales SEs. Over time, the role of the pre-sales SE has evolved from a technical subject-matter expert who addresses features and functionality into a Solutions Architect that bridges the technical and business divide. These resources are focused on ensuring that technology solutions are defined to address a business need, adding significant value to customer alignment and architectural roadmap clarity. The most profitable partners invest in a Systems Engineer for every 1.8 Account Managers, while the rest deploy a Systems Engineer for every 2.9 Account Managers. The impact made through investing in these resources is clear when we look at the sales productivity metrics for the most profitable partners who typically see 10% higher revenue and 16% higher Gross-Profit per sales resource.

Gaining a glimpse into how competitors are defining and achieving success is a valuable lesson in realizing what is possible and paves the way on the journey to excel. The secret for optimal performance and profitability is multi-faceted and requires excellence across all the business functions operating in unison.

By knowing how one compares to the competition, one gains visibility into the possibilities.

Continue reading

Cisco Introduces Segment Routing v6 on Nexus 9000 GX Series Platforms

When discussing the Internet of the future recently, Cisco CEO Chuck Robbins said, “We really want our customers to consume the technology in any way they want.” With that in mind, I am pleased to announce the first Cisco Nexus platform that supports Segment Routing v6 (SRv6) running NX-OS which gives customers’ business the next-generation programmable data center network capabilities. Our Cisco Nexus platforms already support Segment Routing (SR-MPLS); now the Nexus GX platform supports SRv6 as well.

Segment Routing Introduction

Segment Routing (SR) is a flexible, scalable way of doing source routing. In Segment Routing, the source chooses a path and encodes it in the packet header, as an ordered list of segments. The network does not need to maintain state per-application and flow. Instead, it obeys the forwarding instructions provided in the packet. The first version of SR used the MPLS data plane.

SRv6 – Building Next-Gen Programmable Network Infrastructure

SRv6 further simplifies the network by eliminating MPLS altogether. It relies on the native IPv6 header and header extension to provide the same services and flexibility as SR-MPLS, directly over the IPv6 data plane.

SRv6 adds network programming capabilities by taking advantage of IPv6 Extension Headers. We can now insert Segment Routing headers into IPv6 packets. Thanks to the increase in Segment ID size, it is now possible to pack more than IP addresses into a Segment ID and hence go beyond routing purposes.

The IPv6 flavor of Segment Routing allows user-defined functions to be associated with segments. By leveraging the segments encoded in the dedicated segment routing extension header (SRH), the IPv6 packet carrying the network instructions explicitly tells the network the path it should traverse and the functions to be executed at each SRv6 node. These functions may implement any computable behavior, enabling simplified network programming.

Beside the main advantage of SRv6 providing the most advanced SRv6 Traffic Engineering (TE) capabilities, the network can be turned into a multi-service infrastructure. New Flexible Algorithm (Flex-Algo) capabilities make multiple optimizations of the same physical network infrastructure along various dimensions possible.

The SRv6 architecture (Segment Routing based on IPv6 data plane) is a promising solution to support services like Traffic Engineering, Service Function Chaining, and Virtual Private Networks in IPv6 backbones and data centers. The SRv6 architecture has interesting scalability properties as it reduces the amount of state information that needs to be configured in the nodes to support the network services.

Fundamentally, SRv6 provides a way to simplify the network by eliminating MPLS – using the native IPv6 header and header extension to provide the same services and flexibility as SR-MPLS, over the IPv6 data plane.

Cisco Nexus GX Platform Supports SRv6 Functionality

Cisco Nexus 9000 platforms support Segment Routing v6 (SRv6), which brings many advantages to our customers. The GX platform provide customers with:

◉ 4 TBPS Packet Processing in a single 1RU/2RU switch with port speeds up to 400G
◉ Insert up to 9 SIDs (Segment IDs)
◉ Encapsulate IP/L2 payloads with SRv6 and add up to 5 SIDs in Segment Routing Header (SRH)
◉ Line Rate SRv6 forwarding
◉ Operational management tools for troubleshooting and monitoring
◉ Nexus 9000 Series platform models
     ◉ N9K-C9316D-GX: 16 x 400/100/40-Gbps QSFP-DD ports
     ◉ N9K-C93600CD-GX: 28 x 100/40-Gbps QSFP28 ports and 8 x 400/100-Gbps QSFP-DD ports
     ◉ N9K-C9364C-GX: 64 x 100/40-Gbps QSFP28 ports

Business Drivers for going with SRv6

Build Scalable Networks

The SRv6 architecture allows to build scalable networks by reducing the amount of state information that needs to be configured in the nodes to support the network services.

Traffic Engineer (TE) customers traffic across any size of networks

SRv6 Traffic Engineering leverages IPv6 underlay and forwarding by adding Segment Routing Header (SRH) to SRv6, this facilitates Traffic Engineering and path protection capabilities. Accordingly, Traffic engineering enables use cases such as Disjoint Paths for selected traffic, Color Affinity traffic forwarding based on link colors, low latency path selections for certain traffic, high bandwidth path selections, and many more to come.

Build Data Center Interconnection (DCI) with Core/WAN running SRv6

Data Centers mostly based on VXLAN technology can hand-off the traffic to the service provider or core/WAN running SRv6.

Reduce Network Operational Complexity and OPEX

SRv6 eliminates the need for LSP management. As networks become more complex; this helps to simplifies network operational management. This is one of the key differentiators comparing SRv6 to SR-MPLS and MPLS LDP technologies.

Enable Network Programmability

In SRv6, a segment routing identifier (SID) is an IPv6 address. It can be conceptually separated to two parts: locator and function. The locator is the route to the node performing the function. The function can be any possible function bound to SRv6 SID. Customers have the complete flexibility to program the SID in SRH to enable simplified network programming.

Introduce Operation, Administration and Maintenance (OAM)

Enables customers with operational management tools for troubleshooting and monitoring.

SRv6 Use-Cases on the Nexus 9000 Series Platforms

Cisco Nexus GX platforms with SRv6 enables realize the following key use cases.

The first and immediate use case is interconnection of data center networks with core networks. VXLAN has been widely deployed in the data center and the core networks are transitioning to SRv6 from MPLS. Nexus GX platform is a perfect choice for performing a seamless VXLAN to SRv6 hand-off function interconnecting VXLAN data centers with SRv6 core networks. This is the most-tailored and scalable design for GSPs (Global Service Providers) and large enterprises with SRv6 Core. Benefits offered are simple, scalable architecture and seamless inter-connectivity between globally spread data centers and the SRv6-based core/WAN.

The second use case that SRv6 brings to service providers is L3 VPN (Layer 3 Virtual Private Network) over SRv6. L3VPN over SRv6 enables multi tenancy for next generation IPv6 networks, 5G networks of global service provides, large and small data centers that support 5G, and beyond.

Another important SRv6 use case is network service chaining, also known as service function chaining (SFC). It is a capability that uses software-defined networking (SDN) capabilities to create a service chain of connected network services (such as L4-7). This network service chaining enables customers to have, for example, security (firewall) services embedded within the SRv6 network.

A key advantage SRv6 brings to networks is Unified Data Plane (UDP), where customers can run IPv6 everywhere in data center and core networks. This enables the Global VRF (Virtual Routing Forwarding) over SRv6 use case, where IPv4 as well as IPv6 data center fabrics interconnect over SRv6. This use case is applicable for MSDCs (Massive Scaled Data Centers) and globally spread data centers inter-connectivity.

Continue reading

Top 5 new features in Cisco DNA Center 1.3.3.x

Cisco DNA Center 1.3.3.x just dropped and it’s full of new features. Here are the five most popular additions in this free upgrade and what they mean to your business.

The next time you login to your Cisco DNA Center dashboard, you’ll see a notification for a new software upgrade to version 1.3.3.x. Included in this free upgrade are 47 new features, all accessible from the Cisco DNA Center dashboard. Here’s a quick look at five of the features that our customers are talking about most.

Cisco’s partnership with Samsung enables Galaxy smartphones, including the S10 and S20 families, to speak to Cisco DNA Center with client diagnostics. This provides a more comprehensive view of all potential root causes of wireless issues.

Samsung client analytics

This feature allows Samsung mobile clients (such as the Samsung Galaxy S10 and S20 families of smartphones) to send alerts and error codes to Cisco DNA Center for increased insights into the health and user experience of clients on your network. You’ll recall that in early 2018 Cisco and Apple joined together to allow iOS devices to send device information and error codes to Cisco DNA Assurance. The results of this collaboration have been great, and our customers love the ease with which they are able to diagnose connectivity issues with iOS devices.

Now we have added Samsung Galaxy smartphones to this effort. When a mobile client sends an error code to Cisco DNA Center your IT team is given the exact cause of a wireless issue. This eliminates the guess work and troubleshooting and can eliminate any problem that is not a network-related problem.

Wireless sensor enhancements

From the release of our Cisco DNA Assurance wireless sensors back in 2017, they have been a hit. But many customers have asked for an easier way to deploy these magic boxes in remote offices. We answered by completely rewriting the software on the Cisco AP1800S Wireless Active Sensor and adding new capabilities into Cisco DNA Center. The result are wireless sensors that are easier to setup and scale across large-scale network environments. Moreover, the interface is easier to read with new location-based sensor heatmaps to quickly identify failed tests and potential network issues. We have added “Day-0” provisioning so that the sensor can be automatically provisioned once it is powered on. This makes connecting at a remote office a snap! Next, we made the wireless link to the network a dedicated backhaul link, which means that the wireless connection is “always on” regardless of wireless testing activities. A new Heatmap View displays the top five rankings for statistical categories. This view also displays a heatmap representation of the sensor test result failures. This focus on location makes it much easier for teams to prioritize and locate issues quickly.

Network speed tests can now be performed via NDT or iPerf3, depending on which you prefer. Finally, we have added a “Sensor-360” view with time travel to the main Assurance menu in Cisco DNA Center. This allows you the same analytics and troubleshooting on your sensors as the rest of your network. This feature can verify the appropriate sensor functionality and performance so that you can rely on the tests that you perform with the sensor. If you have never tried the Cisco AP1800S Wireless Active Sensor, now is the time! They are now simple to install, even in remote offices, they are easier to use, and they can save you from constant remote site visits for network troubleshooting.

Executive Summary Reports

The answer to the question: How can I demonstrate the many network improvements my team have achieved in a clean, simple to understand, graphical report? Cisco DNA Center’s new Executive Summary Reports gives you a myriad of categories with which to assemble a network report.  Set up the areas of focus (sites, users, or devices) and capture detailed data about network devices and clients, which you can use to analyze network performance. From simple reports such as overall health, to device data, or even an overview of network issues trending. A weekly (7-day) overlay shows the change in performance. This feature allows other company stakeholders or executives to get a clear and easy-to-read overview of network performance and trends.

Meraki Automation

Many Cisco customers have deployed a hybrid Catalyst + Meraki network. This is usually because a company needs a sophisticated switch solution for their large campus network, and cloud-managed devices in remote branches that are simple, secure, and reliable. Many of you have asked for ways to provision and inventory Meraki devices from within Cisco DNA Center. In version 1.2.1.x, we included full Meraki visibility and inventory into the Cisco DNA Center dashboard. Now we are including provisioning of Meraki wireless access points. The diagram below shows five branch offices with Meraki enterprise networks. The corporate campus and regional sites are larger operations and have deployed Cisco DNA (Catalyst/Aironet) on their campus’. The new Meraki Automation feature in Cisco DNA Center allows the corporate campus to provision new Meraki access points into any sites in the network and maintain control of the addition of new devices – this is a common company policy.  Once these Meraki devices are installed and provisioned, they can be managed from any site via Meraki dashboard.

Rogue wireless management

This provides increased security and control of wireless networks by enabling detection of unauthorized access points plugged into local switches or access points with the same SSID but not connected to the customer’s wired network. These wireless security breaches are known as “the honeypot” and “the unauthorized access point.” The diagram below shows a graphic explanation of these scenarios. Cisco DNA Center’s new Rogue wireless management feature will discover and flag both security cases allowing your team to immediately (and remotely) disable the rogue access points.

The new 1.3.3.x software includes many, many other features including: StackWise Virtual support, ASA Firewall automation, APIC-EM migration, policy extensions for SDA, and customizable device health scores.

Continue reading

SaaS-delivered Encrypted Traffic Analytics with Cisco Stealthwatch Cloud

We’ve reached an interesting turning point for encrypted traffic.

Gartner predicted that 80% of web traffic would be encrypted by 2019. Sure enough, this prediction came true. Last year, the team at Let’s Encrypt, an organization that helps enable encryption for websites, cited that 80% of web traffic they’ve seen is now encrypted. We have reached the point where the average volume of encrypted traffic on the internet has now surpassed the average volume of unencrypted traffic.

This is largely good news, as moving forward, encrypting internet traffic is now the new norm online and will continue to grow. This is good for data privacy and should let us sleep a bit easier knowing that as out information traverses the internet, it’ll be encrypted.

However, much like the adoption rate of encrypted traffic, encrypted threats are also on the rise. This year, Gartner has predicted that more than 70% of malware campaigns will use some type of encryption to conceal malware delivery, command-and-control activity, or data exfiltration. Complicating matters, it’s also predicted that 60% of organizations will fail to decrypt HTTPS efficiently, thereby missing critical encrypted threats.

Traditional threat inspection methods that rely on bulk decryption, analysis, and re-encryption are not always practical or feasible, for both performance and resource reasons. These methods also compromise privacy and data integrity. Unfortunately, many organizations do not have a way to detect malicious activity in encrypted traffic without the use of decryption. With the growing amount of encrypted traffic and the number of threats hiding within it, how should organizations ensure the encrypted traffic coming into their network is safe, without compromising the integrity of that data?

A better approach to analyzing encrypted traffic

Stealthwatch Cloud is a Software-as-a-Service (SaaS) solution that is easy to try, easy to buy, and simple to operate and maintain. Stealthwatch Cloud analyzes network behavior to detect advanced threats, even those hiding in encrypted traffic. Cisco’s proprietary Encrypted Traffic Analytics (ETA) technology uses attributes like Initial Data Packet (IDP) to detect malware in encrypted traffic, without decrypting the data.

Recently, Stealthwatch Cloud has added further integrations with Cognitive Intelligence, our amazing cloud-based machine learning and AI R&D team as well as its Confirmed Threat Service.

These integrations allow Stealthwatch Cloud to ingest ETA telemetry from supported Cisco networking devices and provide additional, enhanced fidelity of encrypted (as well as non-encrypted) traffic. From there, ETA will alert users of potential threats that might be hiding in encrypted traffic. These alerts include cryptomining, unpublished TOR, botnets, Ramnit, Sality, malicious file download, phishing and typosquatting and more.

In a performance study by Miercom, Cisco Encrypted Traffic Analytics showed as much as 36% faster rates of detection, finding 100% of threats in three hours. Furthermore, the study found that Cisco ETA detected 100% of malicious flows within three hours

How it Works

Cognitive Intelligence’s Confirmed Threat Service provides Stealthwatch Cloud with a list of high-confidence Indicators of Compromise (IOCs in the form of IPs and domains), a full description of the related global threat, and a write-up of recommended remediation steps. These IOCs are generated as a result of processing billions of connections from across the globe using a pipeline of analytical techniques which include the collection of Initial Data Packets. In essence, the Confirmed Threat Service is the outcome of multi-layered machine learning and encrypted traffic analytics that can convict known as well as unknown global threat campaigns. Cisco ETA can match field data extracted from the IDP against known IOCs which allows Stealthwatch Cloud to then correlate local customer telemetry to the global Confirmed Threat Service.

New alerts created via this threat intelligence will show up as “Confirmed Threat Watchlist Hit” alerts. These alerts can include named malware type families and also provide details on what they do (exfiltration, exploit, content distribution, botnets, ransomware, etc). Some of the threat intelligence provided by the Confirmed Threat Service is created in collaboration with Cisco Talos. Talos will seed intelligence (initial set of seed IOCs), title and description of a threat. Cognitive Intelligence will then expand this seed set of IOCs with new occurrences using information gathered from IDPs and machine learning – which in turn yields new IPs and domains that are also related to the given threat and appear in real customer telemetry.

Meeting Compliance Needs

In addition to being able to effectively monitor encrypted traffic coming into their network, organizations also have to consider how they use encryption on their own data. When using encryption for data privacy and protection, an organization should be able to answer major questions:

How much of the digital business uses strong encryption?

What is the quality of that encryption?

This information is critical to prevent threat actors from getting into the encrypted stream in the first place. Today, the only way to ensure that encrypted traffic is policy compliant is to perform periodic audits to look for any TLS violations. However, this method isn’t perfect due to the sheer number of devices and the amount of traffic flowing through most businesses.

Cisco Encrypted Traffic Analytics provides continuous monitoring without the cost and time overhead of decryption-based monitoring. Using the collected enhanced telemetry, Stealthwatch provides the ability to view and search on parameters such as encryption key exchange, encryption algorithm, key length, TLS/SSL version, etc. to help ensure cryptographic compliance.

Together, Cisco ETA and Stealthwatch Cloud can also identify encryption quality instantly from every network conversation, providing organizations with the visibility to ensure enterprise compliance with cryptographic protocols. These tools deliver the knowledge of what is being encrypted and what is not being encrypted on your network so you can confidently claim that your digital business is protected and compliant. This cryptographic assessment is displayed in Stealthwatch Cloud and can be exported via APIs to third-party tools for monitoring and auditing of encryption compliance.

Continue reading