Evolution to Cloud RAN Made Easy with Cisco’s Fronthaul Solution

5G is happening now. Across the globe, more than 60 service providers have already launched enhanced mobile broadband (eMBB) or Fixed Wireless Access (FWA) services, with plans to offer more advanced 5G services such as ultra-reliable low-latency communications (URLLC), or industrial IoT in the next 18 to 24 months. But the expansion to 5G has not been easy or without growing pains, as legacy 4G network infrastructures struggle to support so many different services.

They’re struggling because the vast majority 4G transport infrastructures were designed to support consumer services with stable north-south traffic patterns, optimized for best-effort mobile broadband, and no need or ability to support stringent SLAs. Very few adopted advanced 4G features that would support more complex services, such as Enhanced Inter-Cell Interference Coordination (eICIC), Coordinated Multi-Point (CoMP), Evolved Multimedia Broadcast Multicast Services (eMBMS), Multiple-Input Multiple-Output (MIMO), or precise timing.

The expansion to 5G has changed the game, as three groups of services emerge – eMBB, URLLC, and massive machine-type communications (mMTC) – all driving a new set of requirements over the transport network. To match the commercial-grade SLAs these new services will inevitably demand, mobile networks must increase availability, reliability, and security.

To meet the service demands of 5G, service providers need to rethink the economics of their end-to-end infrastructure and make decisions that go beyond the radio. At the top of this list is the RAN architecture, which accounts for nearly 80% of service provider’s Capital Expenditures (CapEx). RAN operating costs are no slouch either; it’s estimated they equate to 60 % of the Total Cost of Ownership (TCO).

New densification strategies are also required to improve the economics of backhaul networks, supporting the high frequency (3,5Ghz, 6Ghz, 24GHz, etc.) spectrum with up to 400Mhz ultra-high cell bandwidth, massive MIMO (64TRX, 32TRX Multi-Access Antennas) and the exponential increase in base stations required to support 4G LTE expansions and 5G services.

Open, software-defined, virtualized, and cloud scalable, the emerging Cloud-RAN or Centralized RAN (C-RAN) architectures, support these densification strategies. C-RAN disaggregates base stations by separating Radio Units (RUs) from Radio Equipment Controllers (REC) and centrally locates these REC functions in regional/distributed data centers.

The centralization of base stations drives the need for fronthaul transport to be able to carry the antenna samples using CPRI or standard-based/open protocols. However, CPRI line rates (currently limited to 24 Gbps) don’t efficiently scale to meet the growing needs of 5G and also require tight delay budgets that lead to limitations in the distance and transport technologies that can be used for aggregation. Another concern is related to MIMO scale adoption as CPRI requires a dedicated link for every antenna. This mechanism becomes problematic as service providers invest in MIMO technology to increase data rates for 4G and 5G radio.

With these new architectures, service provider RAN departments must have a stake in ensuring the network between the RU and the DU delivers the required performance. This was not the case in the past as the RU and the DU were tightly integrated at the cell site.

These attributes are essential to the transport infrastructure meeting performance expectations and assuring a smooth evolution to C-RAN while supporting legacy RAN requirements.

Converged end-to-end IP infrastructure

To improve economics, RAN transport networks need to be optimized to share connectivity for both wireline, wireless and business services. This can be done effectively by leveraging technologies such as Segment Routing to address the diverse 5G transport requirements – for example, different SLAs can be enforced thanks to network slicing capabilities powered by Segment Routing directly from the cell site up to metro and core networks.

As operators move to Cloud RAN, mobile network functions are virtualized and distributed closer to end-users for better service quality and lower latency. Cloud RAN locations, in turn, need to support the dynamic placement of VNFs and Service Edge, while providing telco class resiliency; this is driving service providers to roll out multiservice networking devices that support end-to-end network slicing.

Designed to Evolve

As 4G and 5G RAN specifications and standards evolve towards cloud-scale, open, and virtualized solutions, RAN transport must be extensible to meet current and future RAN functions and technical requirements. Turbo-charging RAN networking devices with Field-Programmable Gate Array (FPGA) will increase the flexibility to quickly adapt to evolving radio interface processing specifications for CPRI, eCPRI and RoE.

Automated

To curb OpEx costs and better manage operational life-cycle, RAN transport solutions need extensive and open automation capabilities that can integrate into existing management domains and end-to-end systems.  As densification can require on-site interventions, network operators need greater automation in deployment processes and tighter security requirements.

Packet-based 

Traditional fronthaul optical solutions have been static TDM solutions using dedicated optical resources to carry fronthaul traffic. By contrast, packet-based solutions leverage statistical multiplexing to share transmission capacity, using valuable fiber resources more efficiently. Packet-based solutions also support an enhanced CPRI (eCPRI) protocol that scales bandwidth 10x more effectively than 4G CPRI, meaning fewer transport resources are required.

Packet-based solutions support Point-to-Point and Ring topologies, offering easy bandwidth growth while providing the telco class resiliency demanded by mission-critical enterprise services. Fronthaul optical transport solutions are typically implemented using point to point topologies.

Open

Already, service providers have shown an unprecedented interest in open, virtualized RAN solutions that dovetail into their broader SDN architectures. As an early leader in the creation of the Open vRAN ecosystem, we’ve witnessed great progress, but there still is a long road ahead. Continuing to grow and mature the Open vRAN ecosystem will ensure new open RAN solutions find their way into service providers’ infrastructures.

Continue reading

How to Create a Dashboard for Webex Device Monitoring

Demand for remote work systems is growing

The rapid growth in demand for remote work systems has resulted in new challenges of monitoring and troubleshooting devices used for this purpose. Recently, Webex events (calls, messages, etc) have jumped from 39 billion to 270 billion per day.

All well known video services are under heavy load. Cisco’s advantage in unified communication solutions is also based on high-quality functional devices equipped with high-quality cameras, sound systems, and microphones as well. Many employees started working remotely. Someone uses laptops for video conferencing; many employees make use of advanced devices, such as Webex devices: Series DX, MX, SX; Room/Roomkit/Codec and Webex Board’s.

Below we will take a particular look at the necessary elements to create a dashboard to monitor and manage Webex devices.

By using one dashboard, Collab admins can manage and automate many remote devices

Automatic monitoring and use of dashboards eliminates the need for tracking certain parameters and transfers all the necessary information into one center.  This allows you to track and manage parameters.

What kind of useful cases can be implemented?

Using the dashboard as a remote control and automation system makes it possible to implement useful use cases such as:

◉ Track the number and quality of ongoing calls
◉ Monitor employees who joined an online meeting/standup
◉ Manage QoS parameters based on network capability needs
◉ User management (Admit, Mute, Disconnect)

What metrics and events can you collect and monitor:

◉ Call Disconnect
◉ Audio Settings
◉ Video Settings
◉ Network configuration
◉ Software update settings
◉ User interface interaction

Example dashboard you can create using the templates and functions described in this blog.

Create your dashboard using functions and templates

To track these and other parameters, we can use the jsxapi library written in JavaScript. Accordingly, we will consider examples of functions and codes which will also be written in JavaScript. Everything we will examine can be integrated into ready-to-use templates (Angular, React, Vue) for visualization and data management.

In many cases, we will use WebSockets to track parameters quickly. You must subscribe to this data to receive parameters.

We first import the appropriate packages into the code

const jsxapi = require ('jsxapi');

Initializing WebSockets connection

this.wsconnection = jsxapi.connect (this.ip, {username: this.login, password: this.password});

Looking ahead, you should also remember to create a function that will close WebSockets connection and disable feedback listening for all listeners of the group.

Here’s what it might look like

   closeConnection () {
     this.wsconnection.close ();
     this.feedbackGroup.off ();
     console.log ('Connection closed');
   }

Then, after creating necessary variables and functions, we will start them to collect and process information from devices

    this.wsconnection.on ('ready', () => {
      this.getCallHistory ();
// List of fuctions
    });

Through jsxapi, you can run xConfiguration, xCommand and xStatus commands, and you need different methods to use them.

xConfiguration (sample)

        this.wsconnection.Config.Audio.DefaultVolume.set(this.newVolume);
xCommand (sample)

        this.wsconnection.command("Time DateTime Get")
          .then((data) => {
            if (data.status === 'OK') {
              // process with data
            }
           });

xStatus (sample)

        this.wsconnection.status.get("Network 1 IPv4 Address")
          .then((history) => {
            this.ipv4 = history
          });

For online tracking of parameters, metrics, and different changes we need to register listeners.

Here’s a sample of listener that tracks changes of a device name

this.wsconnection.status.on('UserInterface/ContactInfo/Name', (newName) => {
        console.log('SystemUnit Name', newName);
        this.SystemName = newName;
      }),

Here’s a sample of listener that tracks changes of number of active calls

this.wsconnection.status.on('SystemUnit/State/NumberOfActiveCalls', (newNumberCalls) => {
        console.log('NumberOfActiveCalls', newNumberCalls);
        this.NumberOfActiveCalls = newNumberCalls;
      })

Bandle is used for mass subscription for various events

        this.feedbackGroup = this.wsconnection.feedback.group([
          // Register listeners for track changing
        ]);

Continue reading

Here’s What You Need to Know About Digital Transformation

According to the new Cisco Annual Internet Report 2018-2023, there will be 29.3 billion networked devices by 2023, up from 18.4 billion in 2018, (9.8% compound annual growth rate) globally and 5.3 billion total Internet users (66% of the population) by 2023, up from 3.9 billion (51% of the population) in 2018.

In addition to the many, many billions of users and devices connecting to global IP networks, the new report also projects faster speeds for wired and wireless networks (driven by new fiber deployments and cable standards as well as Wi-Fi6 and 5G).

◉ Globally, the average fixed broadband speed will grow 2.4-fold from 2018 to 2023, from 45.9 Mbps in 2018 to 110.4 Mbps.

◉ Globally, the average Wi-Fi speeds from mobile devices will grow 3.0-fold from 2018 to 2023, from 30.3 Mbps in 2018 to 92 Mbps by 2023.

◉ Globally, the average mobile (cellular) connection speed will grow 3.3-fold from 2018 to 2023, from 13.2 Mbps in 2018 to 43.9 Mbps by 2023.

Better network performance (faster speeds and lower latencies) serve as the foundation for other network innovations and application advancements for consumer and business users. Network users demand and expect more from their online experiences. Ubiquitous access and millisecond responsiveness are now table stakes characteristics (not features). Next-gen applications must be customized and tailored to individual user preferences. This “new normal” adds complexity and scale that are often difficult for service providers and IT teams to keep with and support. Fortunately, artificial intelligence (AI) and machine learning (ML) are helping to automate many types of repetitive network jobs/processes and develop new insights into online user behaviors and preferences.

And with the many next-gen applications being created, new models of business are being created as well. Artificial Intelligence and Machine learning and many other applications are now taking advantage of the digital transformation which is very much underway thus creating new models of business and impacting various industries.

AI Platforms and applications are enabling enterprises to leverage ML capabilities and provide enhanced accuracy and user experiences. AI is projected to be utilized everywhere from edge to core to cloud. Technology providers should continue to partner and support rapid deployment, interoperability, and standardization of AI solutions.

Take a look at our executive insights on “Reimagine your applications”. Across almost all business sectors there is an increased demand for new or enhanced applications that increase workforce productivity or improve customer experiences.

IT departments are often challenged to transform infrastructures to accommodate new technologies. The Internet of Things (IoT), artificial intelligence (AI), machine learning (ML), and business analytics are changing how developers build smart applications to simplify customer transactions and deliver new business insights.

Take the music industry, for example, Watson BEAT helped create a better soundtrack than an original composition with the help of a cognitive machine. The IBM® Spectrum Computing team asked IBM Watson® Beat to come up with killer beats for its latest Red Bull Racing video—and the AI composer used its neural network to lay down a unique track.

Or look to the Automotive industry, where self-driving cars use Artificial Intelligence. Next-gen applications such as “Reinforcement learning” have found its way in revolutionizing the automotive industry by creating autonomous driving cars and the financial services industry with new ways of portfolio management.

Tesla, for example, uses AI and effectively crowdsources its data from all of its vehicles with its internal and external sensors. While this will help Tesla refine its self-driving systems, this data holds tremendous value in its own right. Researchers at McKinsey and Co estimate that the market for vehicle-gathered data will be worth $750 billion a year by 2030.

Another example of a next-gen application is predictive analytics which involves using advanced analytic techniques that leverage historical data to uncover real-time insights and to predict future events. Predictive analytics can help transform the way a business operates and can be used for many Industrial IoT solutions- using sensor data to predict equipment failure, weather patterns, crop rotation, and yield predictions and various other impacts on agriculture and the food industry and many other IoT solutions.

New next-gen applications and their rapidly evolving use cases and real-life examples are being built every day—the most successful of which will involve shifting technologies and evolving business models as we digitally transform.

Continue reading

Implementing Cisco SD-WAN deployments with Cisco Action Orchestrator

Since the Cisco developer program (DevNet) began five years ago, we have seen huge growth and maturity of tools and platforms that enable engineers, operations teams, and software developers to deliver critical outcomes for their businesses. From the surge in growth of services in the public cloud to all of the open-source automation and orchestration platforms – such as Chef, Puppet, Ansible, so there has never been a better time to increase the way we tackle the challenges.

Our networks are composed of multiple operational domains (for example campus, data center, and security), that are tightly interconnected. However, engineers need more than interconnected domains to support customer and business needs. They need security, and an access policy that spans domains. And they need the agility to support new needs as they arise, with complete end-to-end visibility.

The need for tight integration, despite the differences in the domains, is one of the biggest drivers for moving to a controller-based, fully abstracted architecture.

Cisco Action Orchestrator provides a unified solution

Using Cisco Action Orchestrator we built a complete workflow. Action Orchestrator is a powerful workflow automation and technology-agnostic cross-domain orchestration product. This orchestration platform easily binds Cisco products together and connects smoothly to third-party products and open-source solutions, providing a unified solution. The following designs are applicable to provide advanced automation.

Imagine that your company wants to open a new store or remote office. When the company employees or customers connect on the network they need access to all their resources. This could be to enable applications to check stock, take payment, process invoices, or even just to safely surf the web. Ensuring your business is connecting safely and securely can be a challenge, this is where automation will help solve many of these once teething issue.

Let’s look at how we can deliver this, quickly and securely. Here we will focus on connecting the store to our data center and other locations and how we do this with Cisco SD-WAN API’s and Cisco Action Orchestrator.

Multi-Domain with Cisco SD-WAN

Our infrastructure must be flexible enough to accommodate those restraints. An intelligent, software-layer, such as SD-WAN, can change the inflexible and often slow networking models of the past. In the largest awareness, it is DevOps meets networking, this can be (and often is) referred to as ‘NetDevOps’.

When using Cisco Action Orchestrator we can use REST API calls to authenticate, to get a list of devices that are part of the SD-WAN fabric, and get device status deploying templates instantly connects our stores/remote office and data center networks. Now our routing algorithms accommodate application requirements and can adapt to real-time link conditions. The ability to connect any data services into the SD-WAN gives organizations amazing elasticity.

Let’s go over the steps that are required

You must first establish an HTTPS session to the server. To do this, you send a call to log in to the server with the following parameters: URL to send the request to use URL: `https://{vmanage-ip-address/j_security_check` which performs the login operation and security check on the vManage web server at the specified IP address.  The API call payload. The payload contains the username and password in the format j_username=username&j_password=password.

After we have established the HTTPS session, we can list the devices attached to the fabric, we use the call that retrieves a list of all devices in the network. To retrieve this list, use the following URL: https://vmanage-ip-address/dataservice/device.  In the templates table, the Device Templates column indicates how many device configuration templates are using a particular feature template the next URL being called is URL: `https://{vmanage-ip-address/dataservice/template/feature` which show the devices in to which the feature template is deployed.

Once the new site/devices are identified we push and attach the feature template to the devices with URL: `https://{vmanage-ip-address/dataservice/template/device/config/attachfeature`.  Validation of the feature template is completed by URL: `https://{vmanage-ip-address/dataservice/template/device/config/attached/[id]` validates which sites/device.

Building the workflow in Cisco Action Orchestrator

Now we know our API’s we are using from Cisco SD-WAN, we can add these into Cisco Action Orchestrator. A workflow is basically a constructed workflow that consists of activities, invocations of child workflows, and logic components that can be included to complete the workflow. Action Orchestrator allows you to automate IT processes based on our requirements using a workflow format. Once we have added in our Cisco SD-WAN workflow the whole thing looks like this.

To kick this off, we simply hit the “RUN”. When you create a workflow, you must specify where you want the workflow to run. You can also specify that the workflow runs on a specific target or target group. The target group can be defined once and reused in several processes. For example, you might have a database maintenance process that is scheduled to run every month on all database servers. Instead of scheduling the process multiple times to run on each database server, you can create a target group that includes all the database servers and schedule the process to run on all the servers at the same time. If you choose to execute the process on a target group, you can further specify to run the process on all objects that are included in the target group or run the process on a specific object within the target group.

The colors associated with the individual activities determine the status of the process and activity instances, upon completion we see green which means our process has completed successfully (if any of the steps failed we would see these as red which means the process has failed and did not complete the process execution). We also see a 200 OK,  as our request succeeded, STATUS 200 OK appears in the results area, here our request was successful and we see a STATUS 200 OK and the result is contained in the response body.

Now our new device and location have had its template pushed to the end device and the traffic will begin to flow as expected and our new device has all our router, policy and security feature that our requirements for our company.

Continue reading

Cisco DNA Center with Cisco 1800S Active Sensors: Better than Helpdesk Tickets Alone

As the networking director of San Jose State University – or rather, a small city of about 40K people where the wireless network is the most visible service – I have always struggled with the gap between what my network management tools tell me about the wireless network and what the actual user experience is.

For some time, I have argued that just because my network assurance solution shows all green, it doesn’t mean that zero users are having a dismal wireless experience. I have to ask myself, are the four service tickets we get a week on average representative of the wireless network issues as a whole or are they a proxy indicator? Let’s face it, some users don’t open helpdesk tickets, they just vent on social media. These have been my user experience pickles!

Measuring the user experience has been something I have been trying to get my hands around – for me it is the proverbial pot of gold at the end of the rainbow. Probably one of the reasons I have been so intrigued with wireless sensors is because they are not a synthetic client, they’re a “real” client with vast automation. My initial attempts at leveraging wireless sensors proved to be quite time consuming. For me, the 30 sensors required 4-6 hours of setup time before the actual testing could commence. Both sensors and test setup consuming the better part of a day really isn’t conducive to measuring the highly dynamic fluctuations of a wireless network.

Happily, things changed markedly for the better when we upgraded our sensors and our Cisco DNA Center to version 1.3.3. Our Cisco DNA Advantage for Wireless software subscription includes upgrades to the latest innovations and any new capabilities (like new sensor software and workflows) developed within the IBN (intent-based networking) framework and the assurance platform within DNA Center.

From Hours to Minutes

With the new workflows in Cisco DNA Center 1.3.3, those same 30 sensors are automatically discovered and easily onboarded in about 20 minutes. Once the sensors are onboarded, the complete wireless sensor test setup from beginning to end takes less than 10 minutes. Now we’re getting somewhere and we can easily measure our user’s experience! Additionally, the sensors themselves are integrated into the issues dashboard for real time monitoring.

Wireless Network Assessment Using Sensor Tests

With the new software and workflow, we test and measure onboarding, DHCP performance, DNS response time and Web site performance. There are some additional tests which don’t apply to us such as FTP, radius, e-mail and more. Some of the test options we use are pictured below:

One particular capability that we rely on: Each sensor can now run a test against a preset number of access points in the “neighborhood”. Meaning a single sensor can target and validate multiple access points in the area assuming a minimal level of RSSI (we prefer -70dBm). This has helped us identify problematic APs in our network and zero in on wireless channel interference.

Consolidated Test Result Dashboard

So now for the smile moment: Inside the Cisco DNA Center Assurance under dashboards, the “Wireless Sensor” page paints the user experience picture very quickly. This dashboard provides summarized results and also contextual location results based on sites, buildings or floors. As I had hoped, the speed tests were working consistently; this is an important measurement point as this is a common wireless complaint (slow wireless).

The dashboard also indirectly provides guidance on where not to place sensors (see the two red locations in the below screenshot). As you can see, we placed two sensors in locations that were convenient for us (in a data closet for easy POE access), but not optimal for wireless testing. Think about what you are trying to test and where to test it. The dashboard showed us that we needed to relocate those two sensors to areas closer to where our users congregate.

I would like to encourage readers who are planning on using the sensors to keep a subset of sensors to move around to monitor special events or install them in reported trouble areas. This is immensely important for high profile meetings where measuring after the fact is pointless. When moving or relocating the sensors, all you have to do is assign their new location in the Provision Devices section and the test suite will “automagically” start testing in that area.

Overall, I am very happy with the new workflow and capabilities of the sensor and how Cisco DNA Center has provided me with a true user experience measurement capability. I am planning on adding many more sensors – in classrooms, meeting spaces and study spaces on campus – to provide us with an even more holistic and granular view of our users’ experience (and get me even closer to that pot of gold!).

Continue reading

Navigating supply chain disruptions for agile retail

Business continuity is so important for retailers that face disruption to their supply chain. Between overseas shipments decreasing and physical stores closing, it’s no secret that the retail industry is coming face to face with the changing business landscape. Retailers that have solely relied on in-store offerings are now looking to quickly take their business to the web with a secure network. Luxury brands that rely heavily on global supply chains are particularly looking to creatively pivot their business model. Some sectors of retail are experiencing an uptick, particularly those leveraging delivery services and curbside pickup (such as quick service restaurants). The surge in remote workers and the need for visibility across both the network and across business operations, calls for agility for all retailers alike.

The largest question for retail brands around COVID-19 quickly becomes how to manage resources when they see interruptions to their supply chain. The best way to combat these disruptions is to engage employees, associates, suppliers and consumers with the right digital solutions. The goal of course being to find business continuity and a rhythm across the value chain, however manageable. Here’s a look at what how retailers can leverage the power of IT, and even look ahead to the increasingly evolving end consumer.

◉ Information and communication Real-time insight around product availability levels is especially important, as the continuous flow of updates requires up-to-the-minute inventory management. Retailers that can leverage a unified communication platform to support timely product information is key for all workers across the distribution center, to the customer service centers, to those managing stock in stores, and newly remote workers supporting retail operations from home.  For broader internal communications, collaboration and video conferencing enables retailers to ensure alignment around priorities and company strategy. Ramping up additional licenses to scale efforts aimed at helping organizations move as a unit has become top of mind as well.

◉ A whole new network A timely approach to setting up virtual firewalls is another beneficial move for retailers. A newly mobile workforce that can leverage a VPN connection allows workers to more effectively help customers in their online purchase journey while keeping transactional data secure. That in mind, threat detection and protection for an increasingly remote workforce is the best way to not only protect customer information but, to keep integrated retail systems secure as well across the network.

◉ Lock down on secure data Increased online presence for shoppers who are no longer visiting physical stores means online retail platforms may have to support a higher volume of traffic. An agile IT infrastructure and the right data storage for your network can up-level digital capabilities to grow that ecommerce channel and improve overall customer sentiment.

◉ Unified commerce The right contact center solution can help get customers the answers to their delivery or pickup questions more quickly, and location awareness can speed up the pickup process. From an omni-channel perspective, direct to consumer communication such as click to chat features can improve that customer experience and awareness around their order. This simply pushes the envelope around click-and-collect fulfillment methods that the industry has seen consumers gravitate to for years. What was a convenience has just become more of a necessity. Retailers that can support unified commerce are able to remain fluid during dynamic and uncertain times, as the consumer behaviors continue to evolve.

Continue reading

Remote Working: Endpoints Have Left the Building

Got DNS?

So, my first answer to address this challenge often surprises them; does your agency have DNS for your remote workforce? Talking it over, most agree that many remote employees consume web and cloud applications without turning on their VPN. This means that roaming users will likely be at the mercy of a random, unknown DNS provider. Why would anyone accept this risk?

Enhancing your agency’s endpoints with DNS security should be a no-brainer. Cisco Umbrella Roaming protects employees when they are off the enterprise VPN by:

◉ Blocking malicious domain requests and IP responses while DNS queries are resolved

◉ Enforcing security at the DNS-layer so malicious connections cannot be established and malicious files will not be downloaded

◉ Preventing malware from infecting laptops and command & control (C2) callbacks, or phishing from exfiltrating data over any port

◉ Plus, any infected laptop that exhibits any C2 activity can be immediately identified.

Hence, with an integrated, security-minded approach to DNS, Cisco Umbrella protects users from malicious Internet destinations whether they are on the enterprise VPN or roaming off the network. Delivered from the cloud, Umbrella makes it easy to protect users everywhere in minutes – without any performance degradation. Even better, Umbrella Roaming is fully integrated into AnyConnect client for Windows or Mac OS X.

How to secure endpoint access

After my friends pull me down off my soapbox about needing DNS for your remote workforce, our discussion changes to what you should expect from your VPN. It’s one thing for a VPN to simply enable an employee to work outside the office and provide the means to securely connect to the corporate network. However, any modern, security-minded VPN should enable a wide range of security services—to include functions such as remote access, posture enforcement, web security features, and roaming protection.

For government customers whose endpoints must maintain a level of posture compliancy, advances in VPN technology now enable security checks to be conducted on endpoints to ensure they meet posture requirements before connecting to the enterprise.

In the context of Department of Defense (DoD) Comply-to-Connect (C2C) efforts, I have previously discussed the need to think “bigger picture” in terms of adopting a Zero Trust lifestyle. Much more than a VPN, Cisco AnyConnect VPN Client, among its security capabilities, contains an endpoint compliance module that includes significant functionality essential to Federal C2C efforts and taking a Zero Trust approach. The Federal government can take advantage of a Remote Access VPN that enables the very foundation of C2C endpoint compliance and an essential Zero Trust capability via the same desktop application.

Simply put, far more than a VPN, Cisco AnyConnect Secure Mobility Client empowers remote working from anywhere on government laptops or mobile devices; whether connected to the enterprise or when needing roaming DNS protection. It also provides visibility and control for Federal agency enterprise operators and security teams to identify who (what devices and the compliance status of those devices) is accessing the enterprise infrastructure.

Remote working needs multi-factor authentication

It almost goes without saying, but multi-factor authentication is a must these days, especially for remote working. It is a must to verify the identity of all users with effective, strong authentication (two-factor authentication) before granting access to your agency’s enterprise VPN, applications and data resources.

Duo Security enables agencies to verify users’ identities and establish device trust before granting access to applications and data. By employing a Zero Trust model, Duo decreases the attack surface and reduces risk by helping to define and enforce policies that limit access to the users and devices according to a Federal agency’s risk tolerance levels.

Cybersecurity for remote working

Although it may sound daunting, when it comes to remote working, Federal agencies must be able to defend against threats, no matter where they are and no matter where their employees are working. This can be done using:

◉ Duo’s adaptive multi-factor authentication (MFA) provides the means for verifying user identities in order to gain secure remote access

◉ Cisco Umbrella Roaming, extends protection when employees are roaming off the enterprise VPN

◉ Integrated with Cisco AnyConnect Secure Mobility Client, employees can not only securely access enterprise resources, but network security teams can also prevent noncompliant devices from accessing the network in accordance with C2C Policy and according to a Zero Trust lifestyle.

Continue reading