<blockquote class="wp-block-quote is-style-default is-layout-flow wp-block-quote-is-layout-flow">
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
In the era of rapid digitalization, data centers have become the backbone of modern infrastructure. In the industry, there’s constant talk about scalability, operational efficiency, and continuous optimization. Buzzwords dominate the discourse: &#8220;Everything is containerized, orchestrated, and dynamically provisioned! Each node is self-healing, every flow is microsegmented and analyzed using artificial intelligence, and all services can be migrated to the cloud with a single click.&#8221; It seems like we’re living in a future where infrastructure configures itself effortlessly, everything automated end-to-end, almost instantly.
</blockquote>
</blockquote>



<figure class="wp-block-image aligncenter size-full"><img loading="lazy" decoding="async" width="712" height="240" src="https://wp.arcticstream.ro/wp-content/uploads/2024/12/ClickOps-EN.png" alt="" class="wp-image-1945" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/12/ClickOps-EN.png 712w, https://wp.arcticstream.ro/wp-content/uploads/2024/12/ClickOps-EN-300x101.png 300w" sizes="auto, (max-width: 712px) 100vw, 712px" /></figure>







And yet, despite all these promises and high industry standards, much of the work in data centers is still done&#8230; manually. While advanced automation concepts spread across presentations and business discussions, engineers are often stuck in a much more &#8220;old-school&#8221; reality: click after click in graphical interfaces or, more often, eyes fixed on the command line, configuring network policies, adjusting firewall settings, and managing servers – all defined by&#8230; fingers. Practices ironically referred to as Finger-Defined Networking or ClickOps. Instead of automated scripts, we rely on automated clicks. Although it feels like something from the past, this manual routine persists even in the age of automation. The purpose of this article is to explore how we can avoid the ClickOps trap and build an efficient and functional automation pipeline.



The Scenario



Let’s consider a very relevant use case: onboarding a client in a data center. The onboarding process is critical to providing clients with a quick, secure, and standardized experience. At the same time, each client comes with unique requirements, including compute resources, storage, network configurations, and security policies. Automating this process can reduce implementation time and eliminate human error. We won’t delve into overly technical details, but we’ll cover the basic steps to transition from manual processes to an automated infrastructure – stress-free and with minimal time investment.



1. Defining the onboarding workflow and requirements



Planning is certainly no one’s favorite part. Everyone is eager to open their IDE and start writing the first lines of code, but before diving into automation, we need to lay the project’s foundations. Defining the workflow and requirements is essential; without this step, we risk investing time and resources in automations that provide no real value and might turn everything into a chaotic mess of useless scripts. The first question we should ask ourselves is, “Is this process even worth automating?” – and from there, we will build everything on a solid foundation.



Clarifying the requirements



To go through this first step, we need to ask ourselves some essential questions:



<ul class="wp-block-list">
<li>What resources are available in the infrastructure? How is it currently configured, and which components could be automated?</li>



<li>What types of onboarding scenarios and options are available? What are the specific steps required for each type of client? Are there any particular cases or exceptions to consider?</li>



<li>What data needs to be collected to get started? How can we identify all IPs, VLANs, security policies, and essential configurations?</li>



<li>How can we build a clear reference base for each stage of the automation pipeline?</li>



<li>How can we efficiently test the automation process before deploying it to production?</li>
</ul>



These questions will guide us in creating an effective action plan for automating the onboarding process.



Action plan



<ul class="wp-block-list">
<li>Infrastructure audit: review all network devices, configurations, and existing policies to gain a clear understanding of the current structure.</li>



<li>Defining onboarding scenarios: develop clear onboarding scenarios for different types of clients, covering standard, customized, and complex cases, as well as possible exceptions.</li>



<li>Diagrams and decision trees: visualize workflows using diagrams and decision trees to outline each step and decision point in the onboarding process, from resource allocation to configuring security policies.</li>



<li>Building a source of truth: centralize information in a platform like NetBox to keep records of devices, IP addresses, clients, and other infrastructure elements up to date, serving as the single source of truth.</li>



<li>Identifying automatable solutions: analyze which parts of the onboarding process can be automated.</li>



<li>Setting validation points: define a testing process to ensure that every configuration is correct before implementation.</li>
</ul>







2. Configuring the automation infrastructure



After defining the workflow and requirements, the next step is to choose the right tools for automating the infrastructure. Below are some examples of commonly used solutions in network automation, each with its own advantages and use cases:



REST API



REST API allows direct configuration of network devices using HTTP requests (e.g., GET, POST, PUT, DELETE). Essentially, a REST API provides a suite of endpoints that must be accessed programmatically to interact with the infrastructure. API documentation, typically available on the vendor’s portal or within the device&#8217;s interface, describes the structure of each endpoint, including parameters and authentication requirements. Once the endpoint is identified, and the request structure is defined, the request can be sent to the device using a script in programming languages such as Python.



<figure class="wp-block-image aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="447" src="https://wp.arcticstream.ro/wp-content/uploads/2024/12/swagger-1024x447.png" alt="" class="wp-image-1947" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/12/swagger-1024x447.png 1024w, https://wp.arcticstream.ro/wp-content/uploads/2024/12/swagger-300x131.png 300w, https://wp.arcticstream.ro/wp-content/uploads/2024/12/swagger-768x336.png 768w, https://wp.arcticstream.ro/wp-content/uploads/2024/12/swagger.png 1300w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /></figure>







NETCONF and RESTCONF



NETCONF and RESTCONF are standardized protocols for configuring networks, based on YANG data models that define the structure and types of configuration data. These protocols provide access to standardized models, such as OpenConfig (for common configuration across multivendor devices) or vendor-specific models like Cisco NX-OS-device. NETCONF works over SSH and is better suited for complex and transactional configurations, supporting atomic operations and automatic rollback. RESTCONF, on the other hand, uses HTTP/HTTPS and is simpler to integrate, making it optimal for quick interactions like retrieving data or making incremental changes.



Python scripts. Python is an excellent choice for automation due to its wide range of modules that simplify network tasks. Here are some of the most useful solutions for network automation:



<ul class="wp-block-list">
<li class="has-lg-font-size">Python SDKs: modules like Cisco ACI Toolkit or UCS Python SDK provide predefined functions for managing policies and interfaces, eliminating the need for direct REST API calls.</li>



<li>Netmiko: a simplified library for SSH connections, compatible with multiple platforms (Cisco, Juniper, HP), enabling direct configuration via CLI.</li>



<li>NAPALM: a multivendor library that abstracts common networking functions – configurations, state data collection, and compliance checks – useful in mixed equipment environments.</li>



<li class="has-lg-font-size">Nornir: an automation framework for complex workflows, with easy integration with Netmiko and NAPALM for centralized management on a larger scale.</li>
</ul>







Ansible



Ansible is a simple and efficient automation solution based on YAML playbooks, which facilitates standardization of configurations for networks and servers. Thanks to its modularity, Ansible is compatible with a wide range of network and server platforms, making it ideal for multivendor scenarios that require a unified approach. Ansible includes dedicated modules for networks, allowing for quick and efficient configuration of key elements such as VLANs, ACLs, interfaces, and security policies on popular platforms like Cisco IOS, NX-OS, and ACI.



<figure class="wp-block-image aligncenter size-full"><img loading="lazy" decoding="async" width="760" height="557" src="https://wp.arcticstream.ro/wp-content/uploads/2024/12/ansible-1.jpg" alt="" class="wp-image-1959" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/12/ansible-1.jpg 760w, https://wp.arcticstream.ro/wp-content/uploads/2024/12/ansible-1-300x220.jpg 300w" sizes="auto, (max-width: 760px) 100vw, 760px" /></figure>







Terraform



Terraform is a powerful Infrastructure as Code (IaC) tool, ideal for managing resources both on-premises and in the cloud, in a declarative manner. Terraform allows engineers to define the desired state of the infrastructure and automatically apply the necessary changes to reach that state. A major advantage of Terraform is its support for infrastructure version control. This allows modifications to be tracked and managed in a controlled manner, enabling quick rollbacks if issues arise.



<figure class="wp-block-image aligncenter size-full"><img loading="lazy" decoding="async" width="1024" height="386" src="https://wp.arcticstream.ro/wp-content/uploads/2024/12/terraform.png" alt="" class="wp-image-1951" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/12/terraform.png 1024w, https://wp.arcticstream.ro/wp-content/uploads/2024/12/terraform-300x113.png 300w, https://wp.arcticstream.ro/wp-content/uploads/2024/12/terraform-768x290.png 768w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /></figure>







Secret management



Regardless of the chosen solution, secret management is crucial for securing automated processes. The last thing we want is to have credentials or API keys publicly exposed in a Git repo history! Tools like HashiCorp Vault allow for the secure storage of these sensitive details, reducing the risk of accidentally exposing them to scripts and configurations.



<figure class="wp-block-image aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="665" src="https://wp.arcticstream.ro/wp-content/uploads/2024/12/tools-1024x665.png" alt="" class="wp-image-1953" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/12/tools-1024x665.png 1024w, https://wp.arcticstream.ro/wp-content/uploads/2024/12/tools-300x195.png 300w, https://wp.arcticstream.ro/wp-content/uploads/2024/12/tools-768x498.png 768w, https://wp.arcticstream.ro/wp-content/uploads/2024/12/tools.png 1345w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /></figure>







Installing automation tools



After selecting the automation tools, the next step is installing them. For centralized and efficient management, it is recommended to install all automation tools on a dedicated automation server. This can be a virtual machine on-premises or a cloud server, depending on the infrastructure and security requirements.







3. Creating and testing automation templates



After all this research, it’s time to move on to the exciting part: building automation templates and scripts. These will bring consistency, reducing errors and configuration time for each implementation.



Building templates and scripts



To create effective templates and scripts, it’s important to follow a few basic principles. First, we need to ensure they are reusable and easy to adapt, so they can be used for various configuration scenarios without major modifications. Each template will be parameterized, allowing configurations (such as VLANs, IPs, and security policies) to be customized simply by adjusting certain values.



Building a testing environment



To avoid scenarios like “who disabled all the interfaces?”, it’s critical to test templates and scripts in a controlled environment before running them in production. For this, we need to create a testing environment. To build an effective testing sandbox, a dedicated lab environment will be set up where templates and scripts can be safely executed on simulated or non-critical resources. Ideally, the testing environment should replicate production settings as closely as possible.



Running scripts and validation in the test environment



Once the testing environment is ready, it’s time to run the templates and scripts to validate their functionality. We will execute the scripts and closely monitor their behavior to ensure the outcome is as expected. If any issues arise, the templates will be adjusted before being implemented in production to avoid unpleasant surprises.



Implementation in production



Once the templates and scripts have been validated, they can be applied in production environments. It is recommended to ensure a fallback mechanism is in place before executing them in production, allowing configurations to be reset in case of unexpected bugs.







4. Integration, monitoring and maintenance



After automation is validated in production, the next step is to centralize and ensure the smooth operation of configurations by integrating them into a CI/CD pipeline, continuous monitoring, and active maintenance. These practices help maintain network stability and adapt automation to the organization&#8217;s needs.



<figure class="wp-block-image aligncenter size-full"><img loading="lazy" decoding="async" width="612" height="289" src="https://wp.arcticstream.ro/wp-content/uploads/2024/12/cicd-pipeline.png" alt="" class="wp-image-1955" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/12/cicd-pipeline.png 612w, https://wp.arcticstream.ro/wp-content/uploads/2024/12/cicd-pipeline-300x142.png 300w" sizes="auto, (max-width: 612px) 100vw, 612px" /></figure>



Integration into a CI/CD pipeline



Integrating automation into a CI/CD pipeline, such as Jenkins or GitLab CI/CD, ensures a centralized and efficient implementation of network changes. A CI/CD pipeline provides a step-by-step process, covering essential stages such as resource provisioning, script execution, testing, and configuration validation. Every update to templates and scripts can go through these stages of testing and approval, reducing the risk of errors and providing constant version control, which is essential for infrastructure stability.



Maintenance and continuous improvements



To keep automation relevant and functional, it is essential to have an active process for maintenance and optimization. As requirements evolve, templates and scripts will need to be updated, whether by adding new scripts or optimizing existing ones. Additionally, periodic audits help identify potential improvements and ensure that automation continues to function as expected.







Conclusions



Well-designed automation brings us closer to the ideal of a scalable, effortlessly configurable infrastructure. We&#8217;ve seen how moving from ClickOps to an efficient automation pipeline can reduce errors and simplify processes, freeing up teams from repetitive tasks and redirecting their attention to optimization and innovation. Ultimately, automation brings data centers closer to the promise of a modern infrastructure, truly prepared for the future.



If you want to transform the processes in your company&#8217;s data centers and take the step from ClickOps to DevOps, the Arctic Stream team is here to support you! Contact us at <a href="mailto:sales@arcticstream.ro">sales@arcticstream.ro</a> for customized solutions and assistance in building an automation pipeline tailored to your needs.

From ClickOps to DevOps: optimizing Data Center processes

Datacenter

In a world that’s increasingly interconnected, organizations need to ensure that their networks are not only fast, but also secure and scalable. MPLS (Multiprotocol Label Switching) stands out as one of the leading solutions that addresses these needs. Recently, I had the opportunity to dive deep into this technology through implementing VPN solutions based on MPLS and BGP, helping me understand not just the power of this technology, but also its significance in today’s network landscape.



<figure class="wp-block-image aligncenter size-full"><img loading="lazy" decoding="async" width="544" height="242" src="https://wp.arcticstream.ro/wp-content/uploads/2024/11/Screenshot-2024-10-10-112240.png" alt="" class="wp-image-1744" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/11/Screenshot-2024-10-10-112240.png 544w, https://wp.arcticstream.ro/wp-content/uploads/2024/11/Screenshot-2024-10-10-112240-300x133.png 300w" sizes="auto, (max-width: 544px) 100vw, 544px" /></figure>



What is MPLS and why is it so important? At its core, MPLS is a routing technology that enables efficient data packet transmission across a network using “labels.” Unlike traditional routing, which relies on IP addresses, MPLS directs data packets based on these labels, significantly reducing processing time and optimizing data flow. This is essential for applications requiring low latency and high availability, such as IP telephony or video streaming. One of MPLS’s greatest strengths is its flexibility. The technology is not restricted to a specific type of traffic or protocol, making it ideal for networks to handle a variety of services. Additionally, MPLS allows service providers to offer a wide range of network services, such as VPNs (Virtual Private Networks), QoS (Quality of Service), and more, all on the same infrastructure. &nbsp;



How does MPLS work? &nbsp;



MPLS works by assigning a label to each data packet upon entering an MPLS network. This label contains information about the path the packet should follow through the network, enabling it to be quickly switched from node to node without requiring a detailed IP address inspection at every step. This label-based switching process is what makes MPLS significantly faster than traditional routing methods. In a project I recently worked on, I configured protocols like OSPF (Open Shortest Path First) and LDP (Label Distribution Protocol) to establish and manage routing paths within the network. For instance, OSPF was used to ensure rapid route convergence within the service provider’s network, while LDP distributed the essential routing labels required for MPLS functionality.



<figure class="wp-block-image aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="527" src="https://wp.arcticstream.ro/wp-content/uploads/2024/11/Topologie-VPN-MPLS-trei-furnizori-1024x527.png" alt="" class="wp-image-1747" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/11/Topologie-VPN-MPLS-trei-furnizori-1024x527.png 1024w, https://wp.arcticstream.ro/wp-content/uploads/2024/11/Topologie-VPN-MPLS-trei-furnizori-300x154.png 300w, https://wp.arcticstream.ro/wp-content/uploads/2024/11/Topologie-VPN-MPLS-trei-furnizori-768x395.png 768w, https://wp.arcticstream.ro/wp-content/uploads/2024/11/Topologie-VPN-MPLS-trei-furnizori-1536x791.png 1536w, https://wp.arcticstream.ro/wp-content/uploads/2024/11/Topologie-VPN-MPLS-trei-furnizori-2048x1054.png 2048w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /></figure>



MPLS VPN topology with three providers



MPLS and VPNs: a powerful combination



One of the most important applications of MPLS is in creating VPNs (Virtual Private Networks). By using VRFs (Virtual Routing and Forwarding), MPLS allows multiple routing instances to coexist on the same physical infrastructure. This means that each client (in the case of a Service Provider) or department within a single client organization can have its own private network, completely isolated from others, with unique routing rules and security policies.



For example, we can set up two separate VPNs for two different clients. Each VPN would have its own routes and security policies, managed through VRFs on the Provider Edge (PE) routers. This not only ensures data confidentiality for each client but also allows for centralized and efficient network management, even with shared infrastructure.



<figure class="wp-block-image aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="729" src="https://wp.arcticstream.ro/wp-content/uploads/2024/11/Topologie-VPN-MPLS-un-singur-furnizor-1024x729.png" alt="" class="wp-image-1750" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/11/Topologie-VPN-MPLS-un-singur-furnizor-1024x729.png 1024w, https://wp.arcticstream.ro/wp-content/uploads/2024/11/Topologie-VPN-MPLS-un-singur-furnizor-300x214.png 300w, https://wp.arcticstream.ro/wp-content/uploads/2024/11/Topologie-VPN-MPLS-un-singur-furnizor-768x547.png 768w, https://wp.arcticstream.ro/wp-content/uploads/2024/11/Topologie-VPN-MPLS-un-singur-furnizor-1536x1093.png 1536w, https://wp.arcticstream.ro/wp-content/uploads/2024/11/Topologie-VPN-MPLS-un-singur-furnizor-2048x1458.png 2048w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /></figure>



MPLS VPN topology with a single provider



Integration with BGP Another crucial component in MPLS implementation is integration with the BGP (Border Gateway Protocol). BGP is used to manage routes between different autonomous systems (ASes), and in the MPLS context, its extended version, MP-BGP (Multiprotocol BGP), enables the transport of not only IPv4 routes but also VPNv4 routes. This functionality is essential to ensure that VPN traffic is routed correctly across the MPLS network. MP-BGP is configured to transport routes between different client sites, making sure each data packet reaches the right destination, regardless of the complexity of the provider’s network. BGP also plays an important role in preventing routing loops and ensuring redundancy, both of which are crucial in large-scale networks. The practical benefits of MPLS After going through the stages of implementation and configuration, I realized the power of this technology. Essentially, MPLS provides a solution that not only simplifies the routing process but also significantly enhances network performance. Scalability is another major advantage: as an organization grows, MPLS can be easily expanded to accommodate new locations and users without compromising security or performance. Another significant benefit of MPLS is enhanced security. Additionally, by using encryption technologies, such as IPsec, to protect data, MPLS becomes even more attractive for organizations handling sensitive information. &nbsp;



MPLS is not just a networking technology; it’s a game-changer for companies looking to improve the performance, security, and scalability of their networks. While its implementation may seem complex initially, the long-term benefits make the effort well worth it. With its unique combination of speed, flexibility, and security, MPLS is undoubtedly the solution modern networks need to tackle future challenges.



 For anyone interested in exploring this technology further, I recommend starting with the implementation of an MPLS VPN solution on a small topology using a network simulator like GNS3. Not only will it give you a practical understanding of how MPLS works, but it will also prepare you for real-world challenges in a complex network infrastructure. Exploring and implementing SD-WAN technologies or other software-defined network solutions can offer additional benefits in terms of flexibility and centralized management, adapting to the dynamic requirements of client networks. References: &nbsp;



Luc. De Ghein, MPLS fundamentals. Cisco Press, 2006. &nbsp;



Lancy. Lobo, Umesh. Lakshman, Andy. Schutz, Raymond. Zhang, and Alex. Raj, MPLS configuration on Cisco IOS software. Cisco Press, 2006.

The impact of MPLS VPN solutions on networks

Networking

Imagine one day you connect to your company&#8217;s network and discover that sensitive data has been compromised. It all started with a single unsecured file that slipped through the network&#8217;s &#8220;shields&#8221;. This is a daily reality for many organizations. However, with a well-configured firewall, such scenarios can be prevented.



Your shield in the digital world The firewall is an essential concept in the field of cybersecurity. Its necessity arose with the growing use of computer networks and the Internet, along with the increasing dangers to which users were exposed. Highly sensitive transmitted data was easily compromised. The CIA triad (Confidentiality, Integrity, Availability) describes the ways attackers can endanger information transmitted between users. Data must be confidential, meaning accessible only to the intended users, intact without being altered by third parties, and always available when needed. The firewall is one of the solutions used to protect the attributes described by CIA, in combination with other technologies. How does a firewall work? A firewall is a network device that acts between a company&#8217;s local network and the Internet. It functions as a &#8220;barrier,&#8221; monitoring and controlling network traffic based on predefined rules set by the network administrator. The firewall examines incoming packets to the local network and decides whether they meet the criteria to be transmitted further. The rules can be simple, such as blocking access to certain geographic locations, or very complex, analyzing traffic types, ports, applications, and their behavior.



<figure class="wp-block-image aligncenter size-full is-resized"><img loading="lazy" decoding="async" width="934" height="525" src="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Firewall_eng.png" alt="" class="wp-image-1243" style="width:934px;height:auto" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Firewall_eng.png 934w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/Firewall_eng-300x169.png 300w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/Firewall_eng-768x432.png 768w" sizes="auto, (max-width: 934px) 100vw, 934px" /></figure>



In addition to basic functions, a firewall can detect unusual traffic patterns, such as a&nbsp;large volume of data transmitted in a short period. It can recognize attack types, the most&nbsp;common being DoS (Denial-of-Service) or DDoS (Distributed Denial-of-Service), which&nbsp;compromise network equipment with false traffic, or Man-in-the-Middle attacks, where the attacker intercepts and even alters communication. After identifying abnormal behavior, the&nbsp;firewall can block suspicious data packets or restrict access to certain IP addresses, ports,&nbsp;and/or applications.&nbsp; Types of firewalls and uses&nbsp; The firewall has evolved significantly over the decades. In the &#8217;90s, it started as a&nbsp; simplistic device that only filtered transmitted packets based on rudimentary rules and&nbsp;monitored network traffic. Today, it offers many more functionalities and implementation&nbsp;possibilities, as described below.&nbsp; The Next Generation Firewall operates at the application level, having evolved to face complex threats. Documentation highlights its most important capabilities: standard firewall features like Stateful Inspection, intrusion prevention (IPS &#8211; Intrusion Prevention System),&nbsp;Application Awareness and Control, and integration with intelligent sources updated with&nbsp;information on potential new attacks. These allow the firewall to detect and block cyberattacks in&nbsp;real-time and adapt to new threats through future upgrades. This device can be implemented in&nbsp;the following ways:&nbsp; &nbsp;



<ul class="wp-block-list">
<li>Hardware Firewalls: usually installed at the boundary between the local network and the Internet, thus protecting the entire network from external attacks;</li>



<li>Virtual Firewalls: can be implemented in Data Centers as virtualized containers on network equipment, in Cloud infrastructures, and provide protection similar to hardware firewalls.</li>
</ul>



An important advantage is the segmentation of traffic zones, allowing the firewall to protect different parts of a network according to needs. The most common zones are:



<ul class="wp-block-list">
<li>External zone: the Internet; </li>



<li>Internal zone: the local network of an organization, where internal devices and resources are located;</li>



<li>Demilitarized zone (DMZ): a buffer zone between the internal and external networks, where servers accessible both from inside and outside the network are placed.</li>
</ul>



Traffic between these zones is usually controlled by a set of rules specifying the types of allowed or denied traffic, translating private IP addresses into public IP addresses, and permitting secure connections through a virtual private network (VPN). In terms of implementation, the most common modes are Transparent and Routed. A firewall in Routed mode is responsible for separating network segments, routing traffic between them, and granular traffic control. In Transparent mode, the device does not modify the routing scheme, only handling traffic filtering. This method is widely used since it does not require modifying the existing infrastructure—securing the network can be achieved by simply adding the firewall device, functioning as a &#8220;bump in the wire.&#8221; To ensure optimal protection against cyber threats, security policies must be periodically updated during maintenance processes. These updates are necessary to improve existing security measures to meet the latest market requirements. Despite the emergence of other security solutions, the firewall remains a fundamental element that must exist in clients&#8217; networks. It acts as the first line of defense, much like walls were built around fortresses in the past. For a higher level of protection, besides using a firewall, it is recommended to use security solutions at the Endpoint, Web, E-mail levels etc. Firewall in the current context Cyberattacks are becoming increasingly sophisticated and harder to detect, making them implicitly harder to stop. In this context, the firewall plays a crucial role in protecting personal data, sensitive information, and critical resources. It is an active component that helps safeguard the integrity and confidentiality of data while ensuring controlled access for authorized users. For example, the latest Secure Firewall Threat Defense 7.6 version from Cisco brings new features to keep pace with emerging threats. In terms of Cloud integration, new capabilities such as Cisco Security Cloud Integration and AI Assistant have been added. The Threat and Malware category benefits from the introduction of SnortML for detecting known attacks as well as zero-day threats (exploiting unknown vulnerabilities), while Simplified Do-Not-Decrypt allows users to choose which connections outside the local network should not be decrypted. The SD-WAN solution also benefits from expanded capabilities with SD-WAN Wizard, which introduces a simplified and automated way to create, configure, and manage topology in FMC (Firewall Management Center). In an ever evolving and increasingly connected digital world, using a firewall in a local network is no longer optional but a necessity. Firewall solutions can be customized to meet client needs and implementation possibilities. Arctic Stream positions itself as a trusted partner in this process, with a team of specialists ready to provide consultancy and support. For more information or to discuss your network&#8217;s specific needs, contact us at <a href="mailto:office@arcticstream.ro" target="_blank" rel="noreferrer noopener">office@arcticstream.ro</a> and consult a specialist to ensure you are protected against the latest threats.

The Firewall: The first line of defense in cybersecurity

Security

This text is not written with AI nor inspired by what others have said on the Internet. It is a personal and imperfect story.



The idea for this series of articles emerged one day while I was sharing with Anca, our new Marketing Manager, how I came to do what I do, and generally what unites all of us colleagues in the same place, enabling us to perform so well as a team. Maybe clients would like to know as well, Anca said later. Maybe there&#8217;s something to learn from all this collective experience.



Career in IT



When I started my career in IT, engineers entered the field out of curiosity and passion. It was this passion, along with the context, that led each person down a different path, as if the Sorting Hat from Harry Potter had spoken. In an IT company, some sought the adrenaline of troubleshooting, others the structure of planning and designing—or simply the ambition of sales. Some were made managers by the corporation. I had the chance to wear multiple hats, allowing me to develop laterally. Thus, I formed a consultant mindset rather than a line management one.



A significant aspect was that neither I nor most of my current colleagues ever worked directly for the end-user of the technology, allowing us to frequently see different technology stacks and ways of doing things. Similarly, like most of my colleagues, I went through a telecommunications company, seeing technology applied on a large scale. In short: a path with exposure, frequent context changes, and structure and large-scale thinking.



On the other hand, our clients are the end users of technology. A competent IT architect or expert wouldn&#8217;t constantly work at full capacity, and for the client, it wouldn&#8217;t make economic sense. In other words, while it makes sense for a systems integrator to have experts at all stages of the IT lifecycle, it doesn&#8217;t make sense for clients.



System lifecycle



To understand the various roles an IT integrator needs, one must consider the system lifecycle perspective. Cisco views it as: prepare (identify objectives), plan (assess initial state versus requirements), design (based on business objectives and technical requirements), implement, operate, and optimize. An architect is involved throughout the lifecycle (plan, build, manage). Although the general perception is that an architect only designs, their role is to eliminate assumptions and bring focus and clarity to the project throughout its duration (what is important and right to do and how feasible it is), both for the business and technical sides. Moreover, an architect must know their options and have experience with them.



An architect works with a temporary project organization but considers the long-term evolution of the infrastructure, ensuring that deviations are kept in check (positioning themselves as a trusted advisor to the client). However, not every project needs an architect. Often, where the project is based on a single technology and requirements are clear, an expert engineer can take on this role. The architect was and still is an expert in one or more areas (otherwise, they couldn&#8217;t argue their technical opinions). Where they are not, they rely on the work of other experts, both among colleagues and partners, but still need to evaluate the options.



Architect interaction with other roles



Throughout the system lifecycle, the architect interacts with colleagues in other roles, the longest being with the project manager. Although roles can sometimes overlap, this is a different person from the architect. The architect is the project&#8217;s technical leader, while the manager tracks time, budget, and resources (keeping the pace). However, it is the architect&#8217;s responsibility to foresee risks, initially estimate costs and resources, and be clear about the order of operations and dependencies so that the project manager knows how to track them. In the operation phase, a service delivery manager will take over the project manager&#8217;s role, as the project will be transformed into a process.



The architect interacts with project sponsors to understand objectives and economic constraints, especially in the planning phase. A sponsor is a management person (both from the executor and the client) most interested in the project&#8217;s successful execution and who makes important business decisions related to money and risks. Then, starting with the design phase, the architect interacts with technical experts. In the implementation phase, the architect coordinates technical work, understands logistics, and may participate in execution with their expertise. Lastly, they guide necessary corrections in the operation and optimization phase based on feedback from the client and colleagues. Importantly, the feedback loop exists not only in the operation phase but starts from planning! A successful project will involve many discussions before implementation, and documentation should also begin before.



<figure class="wp-block-image aligncenter size-full"><img loading="lazy" decoding="async" width="441" height="316" src="https://wp.arcticstream.ro/wp-content/uploads/2024/10/IT-Architect-AST-system-lifecycle.gif" alt="" class="wp-image-1235"/></figure>



An architect should be able to ask relevant questions, test, synthesize, present, and write. In this capacity, they can assist pre-sales, marketing, or sales activities as needed.



An architect is not an operational manager. The technical team is part of a permanent organization that lends experts or implementation engineers to the project, unlike the project team, which is a temporary organization. Therefore, there is a separate management role for the implementation team. Project managers also have their permanent organization (PMO), just as architects can have (AMO), depending on the organization&#8217;s size, the diversity of covered technologies, and the balance between design versus implementation and operational activities. The pre-sales organization doesn&#8217;t fully cover architecture either, as it doesn&#8217;t follow the entire system lifecycle and focuses more on delivering equipment without being part of a project.



On a final note



If I were to give some advice based on my gained experience, here are a few important ones:



<ul class="wp-block-list">
<li>Don&#8217;t assume, ask.</li>



<li>Be open, don&#8217;t ignore information that doesn&#8217;t fit or contradicts what you know.</li>



<li>Always keep the context in mind while looking at details, otherwise, you get lost in the details. Every generation of engineers loves context.</li>



<li>Ask questions candidly, not worrying about what others might think.</li>



<li>Don&#8217;t set your own limits.</li>



<li>Theory (courses on how technology works), testing, structured thinking, and order of operations are important.</li>



<li>Imagine the project in its dynamics and think it through to the end.</li>



<li>Plan a lot and gather feedback.</li>



<li>Don&#8217;t complicate things (KISS*), know your options, follow best practices. Primarily, the infrastructure should be easy to troubleshoot and extend. If it&#8217;s something exotic (corner case), you&#8217;ll likely open a long-term case at TAC**.</li>



<li>Delegate! You won&#8217;t be able to do everything yourself and need to keep your mind free for important matters, not micro-management.</li>



<li>Rely on the team&#8217;s experience but continue to be an expert in your area. This applies to juniors too: focus on excelling in one thing before adding the next layer of knowledge.</li>



<li>Don&#8217;t ignore juniors, keep the door open, and invest time to know them. It will keep your thinking fresh.</li>
</ul>



* Acronym for Keep It Simple, Stupid&nbsp;



** Technical Assistance Center

Sorting Hat: The role of an IT Architect in complex projects

Uncategorized

<h2 class="wp-block-heading">About the National Meteorological Administration</h2>



 The National Meteorological Administration (Administraţia Naţională de Meteorologie) has the primary responsibility of safeguarding human lives and material goods through the dissemination of weather forecasts and meteorological warnings. It also provides forecasts for atmospheric pollutant dispersion in situations involving hazardous weather phenomena and accidental pollution, as well as agrometeorological forecasts for relevant users. The scope of the National Meteorological Administration&#8217;s competence encompasses understanding, monitoring, and anticipating atmospheric processes and associated phenomena. Its main activity focuses on meteorology and climatology, vital for the socio-economic development of Romania and its integration into international conventions and relationships.



<h2 class="wp-block-heading"> Project Objective</h2>



 The overall objective of the project was to modernize the telecommunications infrastructure to enhance the performance of the National Meteorological Administration&#8217;s information system and the operational data and meteorological product transmission to government institutions, the public, and beneficiaries. This project aimed to align with communication and IT security standards. Following the latest technological trends, the National Meteorological Administration opted for a software-defined solution to benefit from automation, centralized management, increased network visibility, reduced operating costs, and enhanced scalability.



<div class="wp-block-columns is-layout-flex wp-container-core-columns-is-layout-1 wp-block-columns-is-layout-flex">
<div class="wp-block-column is-layout-flow wp-block-column-is-layout-flow" style="flex-basis:66.66%">
<h2 class="wp-block-heading">Technical Solution Description</h2>



 For the WAN infrastructure, the National Meteorological Administration selected the Cisco SD-WAN solution, enabling the utilization of both links with service providers to balance traffic based on link quality and application requirements. The entire solution is managed from the centralized vManage platform, where equipment configurations and traffic policies are defined based on application requirements (e.g., delay, jitter, and packet loss). The platform also monitors network status and performs troubleshooting in case of issues. The existence of a centralized controller simplifies future equipment installation and deployment through a plug-and-play (PnP) functionality, ensuring solution scalability.
</div>



<div class="wp-block-column is-layout-flow wp-block-column-is-layout-flow" style="flex-basis:33.33%">
<figure class="wp-block-image size-large"><img loading="lazy" decoding="async" width="1024" height="574" src="https://wp.arcticstream.ro/wp-content/uploads/2024/10/image004-1024x574.png" alt="" class="wp-image-1222" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/10/image004-1024x574.png 1024w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/image004-300x168.png 300w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/image004-768x431.png 768w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/image004-1536x862.png 1536w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/image004.png 1920w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /></figure>
</div>
</div>



<div class="wp-block-columns is-layout-flex wp-container-core-columns-is-layout-2 wp-block-columns-is-layout-flex">
<div class="wp-block-column is-layout-flow wp-block-column-is-layout-flow" style="flex-basis:33.33%">
<figure class="wp-block-image aligncenter size-full is-resized"><img loading="lazy" decoding="async" width="767" height="813" src="https://wp.arcticstream.ro/wp-content/uploads/2024/10/image001.png" alt="" class="wp-image-1224" style="width:259px;height:auto" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/10/image001.png 767w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/image001-283x300.png 283w" sizes="auto, (max-width: 767px) 100vw, 767px" /></figure>
</div>



<div class="wp-block-column is-layout-flow wp-block-column-is-layout-flow" style="flex-basis:66.66%">
In the LAN area, the Cisco Catalyst 9000 switch family was implemented, centrally managed from the DNA Center platform. Similar to the WAN solution, Cisco DNA Center provides a single point of configuration and monitoring for switches and allows for automated configuration provisioning through flexible templates. Additionally, the configuration auditing functionality enhances infrastructure security by identifying software vulnerabilities and configuration changes.



The security solution comprises Cisco Firepower devices from the 2100 series, configured in pairs for high availability, along with the centralized Cisco Firepower Management Center for firewall policy enforcement.
</div>
</div>



<h2 class="wp-block-heading">Benefits</h2>



<ol class="wp-block-list">
<li>Improved operational communication between the central office and regional meteorological centers: SD-WAN architecture allows both connections with providers to be used simultaneously, providing the best routes for operational systems and applications based on their needs.</li>



<li>Streamlined network equipment administration procedures: Implementing new traffic policies or access rules is simplified, reducing the time required for network changes.</li>



<li>Enhanced network visibility: Troubleshooting procedures are significantly simplified in terms of time and complexity, thanks to feedback provided by equipment to management platforms.</li>
</ol>



<h2 class="wp-block-heading">Conclusions</h2>



The provision of equipment and centralized management platforms (SD-WAN, DNA Center, and FMC) enables the National Meteorological Administration to meet the reliability, security, and performance requirements for data transfer across LAN and WAN networks. The equipment monitoring platform within the information system ensures real-time incident monitoring, reporting, and visualization, facilitating a rapid response to operational incidents.



The modernization of the communication system has contributed to enhancing the capacity to inform the population in real-time regarding severe and extreme weather events and climate changes.



Last but not least, the implementation of these solutions provides specialized personnel in the Department of Computing and Telecommunications with opportunities to learn and develop professionally on next-generation technologies.



Quote from Cătălin Ostroveanu, Technical Director, National Meteorological Administration: &#8220;Migrating to new technologies and the network paradigm is not easy. It takes time and patience to master them, and the partner you embark on such an initiative with is as important as the chosen technology. Our collaboration with Arctic Stream was exceptional throughout the project, from planning and delivery to installation and the final knowledge transfer training. We fully understand why their motto is &#8216;Going the Extra Mile&#8217;.&#8221;







<div data-wp-interactive="core/file" class="wp-block-file"><object data-wp-bind--hidden="!state.hasPdfPreview" hidden class="wp-block-file__embed" data="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Case_study_ANM_1_63fe84bd7f.pdf" type="application/pdf" style="width:100%;height:600px" aria-label="Embed of Click to download PDF."></object><a id="wp-block-file--media-19da240c-e811-4868-b397-24f0ae1a9fcc" href="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Case_study_ANM_1_63fe84bd7f.pdf">Click to download PDF</a><a href="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Case_study_ANM_1_63fe84bd7f.pdf" class="wp-block-file__button wp-element-button" download aria-describedby="wp-block-file--media-19da240c-e811-4868-b397-24f0ae1a9fcc">Download</a></div>

Case Study: National Meteorological Administration

In a constantly changing and globalized world, effective collaboration has become essential to the success of modern businesses. This involves transparent communication, sharing of ideas and knowledge, as well as decision-making in teams, which can boost innovation and productivity.



The post-pandemic situation brought new challenges and has radically changed the way companies operate. Remote work, which was widely adopted during the pandemic, has become an important component of the hybrid workplace, in which employees work both from home and from the office. This new context has further accentuated the need for efficient collaboration solutions that allow for effective communication between employees in different locations.



In recent years, Cisco has continued to innovate in the field of collaboration, launching new devices and solutions that integrate advanced technologies, such as artificial intelligence and data analytics.



Cisco&#8217;s current portfolio of collaboration devices is very large and varied, from devices and accessories for individual use (IP phones, headsets, complete video conferencing systems) to devices and accessories for large conference rooms (complete all-in-one video conferencing systems or video conferencing codecs that can form complete systems with displays of various sizes).



An overview with a part of the Cisco collaboration equipment portfolio:



<figure class="wp-block-image aligncenter size-full"><img loading="lazy" decoding="async" width="624" height="236" src="https://wp.arcticstream.ro/wp-content/uploads/2024/10/WebexComputer.png" alt="" class="wp-image-1202" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/10/WebexComputer.png 624w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/WebexComputer-300x113.png 300w" sizes="auto, (max-width: 624px) 100vw, 624px" /></figure>



Among the new features in the Cisco collaboration portfolio are equipment for conference rooms from the Cisco Board and Room series, as well as devices for individual use from the Cisco Desk and IP Phone series.



In today&#8217;s article, we will tell you about the latest news for conference room equipment, and in a future article, we will continue with the news for devices designed for individual use.



The latest equipment for conference rooms is represented by the &#8220;all-in-one&#8221; equipment from the Cisco Board Pro family (Board Pro 55 and Board Pro 75) as well as the new Cisco Room Kit EQ, Cisco Room Bar and Cisco Room Bar Pro codecs. These integrate the latest technologies and innovations in the field of collaboration.







<figure class="wp-block-image aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="663" src="https://wp.arcticstream.ro/wp-content/uploads/2024/10/image-4-1024x663.png" alt="" class="wp-image-1204" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/10/image-4-1024x663.png 1024w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/image-4-300x194.png 300w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/image-4-768x497.png 768w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/image-4.png 1124w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /></figure>



 The new Cisco Board Pro series allows you to participate in video-based meetings, use a digital whiteboard (whiteboard), add notes to shared content, use common web applications, and present wirelessly (through Cisco Proximity, Miracast, and AirPlay). These intuitive devices include everything you need for effective teamwork in collaboration spaces of various sizes (boardrooms, conference rooms, training rooms, etc.).



<figure class="wp-block-image aligncenter size-full"><img loading="lazy" decoding="async" width="499" height="257" src="https://wp.arcticstream.ro/wp-content/uploads/2024/10/webex3.png" alt="" class="wp-image-1206" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/10/webex3.png 499w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/webex3-300x155.png 300w" sizes="auto, (max-width: 499px) 100vw, 499px" /></figure>



Cisco Board Pro are complete video conferencing systems (&#8220;all-in-one&#8221;), including in the same system: video conferencing codec, display, cameras, microphones, speakers. Additionally, you can include: table or ceiling microphones and a Cisco Webex Room Navigator tablet (which can be mounted on a table or on a wall).



Main features of Cisco Board Pro devices:



<ul class="wp-block-list">
<li>Models of 55-inch or 75-inch</li>



<li>UltraHD interactive touchscreen</li>



<li>Intelligent 4K video system with auto-framing, people focus, and speaker tracking features.</li>



<li>Integrated speaker system</li>



<li>Microphone array consisting of 12 elements</li>



<li>Flexible mounting options (wall-mounted, floor stand, or stand with wheels)</li>



<li>USB-C passthrough: allows computer devices (laptop/PC) to use Cisco Board Pro with any video conferencing client installed on the computer, while also benefiting from the camera intelligence and audio system provided by Cisco Board Pro</li>



<li>Certified for Microsoft Teams Rooms: provides a native Microsoft Teams experience on Cisco Board Pro collaboration devices</li>



<li>Products recognized at &#8220;Red Dot Design Awards 2022&#8221; as &#8220;Best of the Best&#8221; as a product design and at &#8220;UC Awards 2022&#8221; as &#8220;Best Meeting Room Product&#8221; of the year.</li>
</ul>



The new Cisco Room Kit EQ, Cisco Room Bar, and Cisco Room Bar Pro video conferencing codecs include the latest collaboration technologies and are designed for efficient teamwork, being designed for use in medium and large conference rooms (in the case of Cisco Room Kit EQ), for medium (in the case of Cisco Room Bar Pro) or for small conference rooms (in the case of Cisco Room Bar).



These devices are video conferencing systems consisting of codec, cameras, microphones, and speakers. You just need to connect them to a display (the size of which can be chosen depending on the size of the room) and you will have a complete video collaboration system.



<figure class="wp-block-image aligncenter size-full"><img loading="lazy" decoding="async" width="624" height="243" src="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Webex.png" alt="" class="wp-image-1200" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Webex.png 624w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/Webex-300x117.png 300w" sizes="auto, (max-width: 624px) 100vw, 624px" /></figure>



Cisco Room Kit EQ is one of the latest Cisco video conferencing devices and is an AI-based codec that includes an intelligent 4-camera Cisco QuadCam system, an AI-based audio system, as well as various accessories for efficient collaboration. It can be integrated with up to three external displays, providing a complete experience for large conference rooms, boardrooms, training rooms, or performance venues.  



<figure class="wp-block-image size-full"><img loading="lazy" decoding="async" width="624" height="227" src="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Webex4.png" alt="" class="wp-image-1208" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Webex4.png 624w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/Webex4-300x109.png 300w" sizes="auto, (max-width: 624px) 100vw, 624px" /></figure>



Main features of the Cisco Room Kit EQ device:



<ul class="wp-block-list">
<li>Modular codec that can be combined with the Cisco QuadCam 4-camera system or the Cisco PTZ 4K camera, or both.</li>



<li>The intelligent 4-camera video system with 80 MP offers a single 1080p video stream based on simultaneous frames from the sensors of the 4 cameras</li>



<li>The 4K PTZ video camera is an AI-powered video camera with pan, tilt, and zoom functions. It offers a 4K resolution with a total zoom of 240x (20x optical + 12x digital)</li>



<li>Integrated speaker system</li>



<li>Microphone array consisting of 8 elements</li>



<li>The Kit EQ codec offers multiple I/O options for external microphones and speakers; It also supports connecting up to 8 digital microphones using audio over IP technology.</li>



<li>Flexible mounting options: The codec can be mounted on the wall, in a rack, or placed on any flat surface; The Cisco QuadCam camera can be mounted on the wall, on the display, or under the display; The Cisco PTZ4K camera can be mounted on the wall or on the ceiling).</li>



<li>Offers speaker tracking, automatic group framing, and intelligent people framing</li>



<li>Supports 4K content sharing via cable or wirelessly via Apple AirPlay, Miracast, Webex, or via USB-C and HDMI Passthrough</li>



<li>Can be configured to run natively on the Webex operating system &#8211; RoomOS or can be configured to run natively on the Microsoft Teams Rooms system.</li>



<li>Video interoperability in Webex RoomOS mode with Zoom, Microsoft Teams, and Google Meet</li>
</ul>



Cisco Room Bar is one of the most compact Cisco video conferencing systems and is dedicated to small conference rooms. It is an all-in-one video conferencing terminal that includes a video conferencing codec with an Nvidia chipset, a video camera, stereo speakers, and a microphone array. It also includes Webex Room Navigator.



It can be integrated with up to two external displays, providing a complete experience for meeting participants.



<figure class="wp-block-image aligncenter size-full"><img loading="lazy" decoding="async" width="468" height="247" src="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture5.png" alt="" class="wp-image-1210" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture5.png 468w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture5-300x158.png 300w" sizes="auto, (max-width: 468px) 100vw, 468px" /></figure>



Main features of the Cisco Room Bar equipment:



<ul class="wp-block-list">
<li>12 MP video camera with 5x zoom and 120-degree horizontal field of view</li>



<li>Microphone array with four elements with AI-powered noise cancellation</li>



<li>Offers the option to connect an external desktop microphone or an external speaker via USB-A</li>



<li>Flexible mounting options: wall-mounted, display-mounted, or under-display</li>



<li>Offers speaker tracking, automatic group framing, and intelligent people framing features</li>



<li>Supports 4K content sharing via cable or wirelessly via Apple AirPlay, Miracast, Webex, or via USB-C and HDMI Passthrough</li>



<li>Can be configured to run natively on the Webex operating system &#8211; RoomOS or can be configured to run natively on the Microsoft Teams Rooms system.</li>



<li>Video interoperability in Webex RoomOS mode with Zoom, Microsoft Teams, and Google Meet</li>
</ul>



Cisco Room Bar Pro is the latest Cisco video conferencing terminal and is dedicated to medium-sized conference rooms. It is an all-in-one video conferencing terminal that includes a video conferencing codec, video camera, stereo speakers, and a microphone array. It also includes Webex Room Navigator.



It can be integrated with up to three external displays, providing a complete experience for meeting participants.



<figure class="wp-block-image aligncenter size-full"><img loading="lazy" decoding="async" width="624" height="214" src="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture6.png" alt="" class="wp-image-1212" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture6.png 624w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture6-300x103.png 300w" sizes="auto, (max-width: 624px) 100vw, 624px" /></figure>



Main features of the Cisco Room Bar Pro equipment:



<ul class="wp-block-list">
<li>Intelligent video codec based on Nvidia chipset based on AI</li>



<li>Intelligent system of 2 96 MP video cameras with 5x zoom, 112-degree horizontal field of view and motorized tilt function between -2 and 20 degrees</li>



<li>Microphone array consisting of 16 elements with AI-powered noise cancellation</li>



<li>Offers the option to connect two analog microphones or 3 digital microphones using audio over IP technology or multiple 3rd party microphones using the AES67 standard</li>



<li>Includes 3-channel stereo speaker system with spatial audio function</li>



<li>Flexible mounting options: wall-mounted, display-mounted, or under-display</li>



<li>Offers speaker tracking, automatic group-framing, and intelligent people framing features</li>



<li>Supports 4K content sharing via cable or wirelessly via Apple AirPlay, Miracast, Webex, or via USB-C and HDMI Passthrough</li>



<li>Can be configured to run natively on the Webex operating system &#8211; RoomOS or can be configured to run natively on the Microsoft Teams Rooms system</li>



<li>Video interoperability in Webex RoomOS mode with Zoom, Microsoft Teams, and Google Meet</li>
</ul>



Common smart features of Cisco Board Pro/Room Kit EQ/Room Bar/Room Bar Pro equipment:



<ul class="wp-block-list">
<li>Webex Assistant: Users can join meetings using voice commands taken by an AI-powered virtual assistant.</li>



<li>AI-Powered Noise Removal: Noise cancellation using AI.</li>



<li>People Focus: Provides an intelligent video framing option that removes excess space from the floor and ceiling.</li>



<li>People Count: The system can count the people in the room, allowing for analysis for better resource planning.</li>



<li>Sensors: Temperature, humidity, noise, and light can be measured in rooms when the terminals are associated with a control tablet &#8211; Cisco Room Navigator.</li>



<li>Digital signage: Allows you to display personalized content for the purpose of providing important information for employees and/or guests.</li>



<li>Peripherals of the camera can be controlled, such as lights, room dividers, and curtains, using the control tablet &#8211; Cisco Room Navigator (requires integration with an external 3rd party module through customizable APIs).</li>
</ul>



These features are designed to improve the quality and productivity of meetings.

Discover the latest Cisco videoconference and collaboration endpoints

Collaboration

Not long ago, networking pioneers were sketching the &#8220;Stone Age&#8221; features of networking, defining concepts such as Spanning Tree Protocol and VLAN. As the world is in a continuous evolution, it didn&#8217;t take long to transition to the &#8220;Bronze Age,&#8221; with skilled engineers earning the title of &#8220;IP Magicians&#8221; because they mastered routing protocols and designed networks over long geographic distances (WAN). Networks became larger and made Internet and Intranet services within companies increasingly sought after. This raises the issue of scalability in terms of network management operations and, of course, the security of these networks.



Networking is transitioning along with these needs towards the &#8220;Renaissance and Programmability&#8221; eras. Concepts such as centralized controllers, plan separation, programmability, and underlay versus overlay emerge. Nowadays, we find ourselves at the boundary between these two eras, and from the perspective of WAN networks, this translates into incorporating software mechanisms into the networking realm. This is where we discuss Software Defined Wide Area Network (SDWAN) solutions.



Cisco&#8217;s solution for SDWAN was born in 2017 with the acquisition of the company Viptela. Viptela&#8217;s technology was integrated into the state-of-the-art routing solutions already existing in Cisco&#8217;s portfolio, shaping a new generation of WAN networks based on the concept of &#8220;intuitive networks,&#8221; networks that constantly adapt to traffic conditions, provide automation capabilities, and natively incorporate the necessary security mechanisms in the current cyber climate.



Historically, the most scalable WAN architecture was represented by the implementation of DMVPN technology. The management mechanisms required connecting to each device individually and tying administrators to the command line, highlighting the need for centralization, a process that enables managing the entire infrastructure. In SDWAN, management is achieved through a so-called &#8220;Single Pane of Glass,&#8221; a centralized console where new features can be configured and all data about the managed devices can be viewed, enhancing the troubleshooting process.



In troubleshooting, engineers often face application functionality issues. In the transport area, which is usually provided by a service provider, parameters such as delay, jitter (variation in delay), and packet loss (latency, jitter, and loss) may change. Cisco&#8217;s solution takes these parameters into account to dynamically alter packet routing. For applications sensitive to delays (e.g., VoIP, Video), if one of the WAN links fails to meet the required parameters, the traffic for that application will be automatically rerouted through another WAN connection. In the ideal scenario where all WAN connections meet the required parameters, traffic will be load balanced across all circuits, also done automatically without administrator intervention.



If one of the WAN circuits is an Internet circuit, SDWAN offers the possibility of connecting users locally from that location directly to the public network, eliminating the need to route traffic through SDWAN tunnels to a centralized Internet exit. This preserves the bandwidth of the circuit, and the network user experience is generally more satisfactory. Of course, the Internet circuit is also used for the SDWAN area, but it only routes private IP classes to other locations. Local Internet traffic can be secured by incorporating Cloud Security solutions, which provide various protection mechanisms such as Web Proxy or DNS Filtering. When the SDWAN area with local Internet access intersects with traffic security solutions delivered from the cloud, the concept known as Secure Access Service Edge (SASE) is formed, aiding in accelerating digital transformation through service convergence.



The scalability of SDWAN network configurations comes from leveraging the concept of Plug-and-Play, which translates to centralized configuration that is distributed to routers when they connect to the network. In fact, the configuration present at the central level is segregated into templates, allowing the reuse of a single configuration on multiple devices, improving traceability and troubleshooting processes.



From an architectural perspective, the SDWAN solution can be seen as a &#8220;fabric&#8221; within which there are multiple separate roles for each type of device. These functions are mapped to the planes within a router that is part of a classic network &#8211; management, control, and data. In SDWAN, the only plane under the jurisdiction of the router is the data plane. Thus, the interesting traffic between two locations served by different routers will traverse the data planes of the two devices. In terms of routing, the routing tables of the devices are populated using the control plane through the vSmart controller. It aggregates routing updates from all devices in the network and transmits them to the other routers. vSmart can be seen as the counterpart of a route reflector in the BGP protocol. Infrastructure management is carried out through the vManage controller, achieving the third plane, namely the management plane within the fabric. The last plane is the orchestration plane, which ensures the initial onboarding of routers into the fabric and is provided by the vBond controller.



<figure class="wp-block-image aligncenter size-full"><img loading="lazy" decoding="async" width="988" height="700" src="https://wp.arcticstream.ro/wp-content/uploads/2023/07/sdwan_1_e2aa21218e.png" alt="" class="wp-image-1787" srcset="https://wp.arcticstream.ro/wp-content/uploads/2023/07/sdwan_1_e2aa21218e.png 988w, https://wp.arcticstream.ro/wp-content/uploads/2023/07/sdwan_1_e2aa21218e-300x213.png 300w, https://wp.arcticstream.ro/wp-content/uploads/2023/07/sdwan_1_e2aa21218e-768x544.png 768w" sizes="auto, (max-width: 988px) 100vw, 988px" /></figure>



Security is generally a subject that must be treated with utmost responsibility. The principle of &#8220;layered security&#8221; is successfully applied in SDWAN, outlining three directions of interest within the fabric. In the initial phase, as mentioned earlier, the enrollment of routers into the SDWAN fabric is done through vBond, using a whitelisting model that enrolls only devices whose serial numbers and digital certificates correspond to the preloaded list provided by the administrator. The connection is initiated from the routers to vBond, which verifies the serial number and data from the certificate presented by the router, and then validates the equipment&#8217;s request to enter the fabric. In the data plane, the traffic between routers is natively secured using the IPSEC protocol, protecting the useful data transmitted through the fabric. The third layer of security is represented by securing the traffic in the management and control planes using protocols such as DTLS or TLS.



Considering the architectural and operational complexity of today&#8217;s networks, as well as the need to secure data and communication infrastructure, Cisco&#8217;s SDWAN solution manages to provide simplicity in configuration and management while adhering to industry best practices in terms of cybersecurity.

Cisco SDWAN- a new paradigm in the world of WAN networks

<h2 class="wp-block-heading">Extending the Cisco SD-WAN to AWS</h2>



The Cisco SD-WAN provides a secure cloud scale architecture designed to meet the complex needs of modern WANs through three key areas: advanced application optimization, multi-layered security, and cloud integration.



Interconnection of Cisco SD-WAN and AWS Transit Gateway brings the following benefits:



<ul class="wp-block-list">
<li>Automated and easy connectivity provisioning to the most optimal AWS entry point for the customer’s data center, branch, and hub locations.</li>



<li>Application and data telemetry in and out of AWS for reporting/chargeback.</li>



<li>Dynamic routing, multiple path selection, and deterministic failover behavior through the use of Cisco’s proprietary Overlay Management Protocol (OMP) and SD-WAN Secure Extensible Network (SEN) policies.</li>



<li>Regional hubs interconnecting multiple AWS Transit Gateways and AWS regions via SEN.</li>



<li>Scaling virtual private network (VPN) bandwidth from 1.2Gbps up to 50Gbps using Equal Cost Multi Path (ECMP).</li>
</ul>



With AWS Transit Gateway, there’s no need for a transit VPC to terminate multiple VPN connections from vEdge cloud virtual routers in SD-WAN VPC to VGW in each spoke VPC.



In doing so, branches connect through the AWS backbone, as well as connect with AWS workloads.



<h2 class="wp-block-heading">Connecting Branch to AWS – SD-WAN VPC, TGW, and VPN Attachment</h2>



In the reference architecture, branch vEdge cloud virtual routers terminate proprietary secure Cisco SD-WAN tunnels from the branch over the internet or via AWS Direct Connect from the data center to a pair of vEdge cloud routers in an SD-WAN VPC on AWS. The vEdge cloud routers terminate standard IPSec VPN tunnels from SD-WAN routers to AWS Transit Gateway as VPN attachments.



The diagram below shows an example. In this example, there are two additional application VPCs attached to AWS Transit Gateway. The branch/data center can talk to the application VPC workloads, but VPC workloads should not talk to each other. This is a segmentation use case.



To achieve the desired connectivity, three different route tables have been configured on the AWS Transit Gateway. Route table1 is associated with one application VPC; route table2 is associated with the other VPC, and route table3 is associated as a VPN attachment with the SD-WAN VPC.



The IP routes in the AWS Transit Gateway route tables associated with the application VPCs are learned from the SD-WAN VPC using route propagation. The routes in the route table associated with the SD-WAN VPC are propagated statically.



Additionally, a static route is configured on the VPC route table for each application VPC with tgw-xxxx as the next hop for non-local routes. Similarly, a static default route is configured on the SD-WAN VPC route table that points to igw-xxxx.



The routes between the SD-WAN VPC and the branch are learned via Cisco’s SD-WAN OMP. By redistributing BGP routes into OMP, the SD-WAN network becomes aware of the AWS infrastructure. Traditional route filtering options like route maps can be used in order to make redistribution more granular.



<figure class="wp-block-image aligncenter size-full"><img loading="lazy" decoding="async" width="624" height="695" src="https://wp.arcticstream.ro/wp-content/uploads/2024/10/resize-1687782340465960823Picture8.png" alt="" class="wp-image-1181" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/10/resize-1687782340465960823Picture8.png 624w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/resize-1687782340465960823Picture8-269x300.png 269w" sizes="auto, (max-width: 624px) 100vw, 624px" /></figure>



<h2 class="wp-block-heading">Putting Them All Together</h2>



The diagram below summarizes the above-mentioned architecture concepts, as they were put in production.



The AWS Transit Gateway, the AWS Transit VPC and the entire SD-WAN network have been deployed automatically with the Cisco vManage. From there, the AWS Transit Gateway has been extended to the pre-existing AWS Spoke (application) VPCs. An additional Security VPC, hosting Cisco FTDv firewalls, has been added manually for E-W and N-S inspection. Yet another VPC has been created for various network security appliances (especially firewall management).



At the same time, the Cisco SD-WAN has been also extended to Azure, where the AD resides.



<figure class="wp-block-image aligncenter size-full"><img loading="lazy" decoding="async" width="624" height="524" src="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture9.gif" alt="" class="wp-image-1183"/></figure>



Sources:



<ul class="wp-block-list">
<li><a href="https://aws.amazon.com/blogs/networking-and-content-delivery/design-your-firewall-deployment-for-internet-ingress-traffic-flows/">https://aws.amazon.com/blogs/networking-and-content-delivery/design-your-firewall-deployment-for-internet-ingress-traffic-flows/</a></li>



<li><a href="https://aws.amazon.com/blogs/networking-and-content-delivery/scaling-network-traffic-inspection-using-aws-gateway-load-balancer/">https://aws.amazon.com/blogs/networking-and-content-delivery/scaling-network-traffic-inspection-using-aws-gateway-load-balancer/</a></li>



<li><a href="https://aws.amazon.com/blogs/networking-and-content-delivery/integrate-your-custom-logic-or-appliance-with-aws-gateway-load-balancer/">https://aws.amazon.com/blogs/networking-and-content-delivery/integrate-your-custom-logic-or-appliance-with-aws-gateway-load-balancer/</a></li>



<li><a href="https://aws.amazon.com/blogs/networking-and-content-delivery/best-practices-for-deploying-gateway-load-balancer/">https://aws.amazon.com/blogs/networking-and-content-delivery/best-practices-for-deploying-gateway-load-balancer/</a></li>



<li><a href="https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-gateway-load-balancer-supported-architecture-patterns/">https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-gateway-load-balancer-supported-architecture-patterns/</a></li>



<li><a href="https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-inspection-architecture-with-aws-gateway-load-balancer-and-aws-transit-gateway/">https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-inspection-architecture-with-aws-gateway-load-balancer-and-aws-transit-gateway/</a></li>



<li><a href="https://aws.amazon.com/blogs/apn/centralized-traffic-inspection-with-gateway-load-balancer-on-aws/">https://aws.amazon.com/blogs/apn/centralized-traffic-inspection-with-gateway-load-balancer-on-aws/</a></li>
</ul>

Multi-Cloud Network Architecture-2

<h2 class="wp-block-heading">High Level Design</h2>



<h3 class="wp-block-heading">Requirements</h3>



The IT infrastructure outlined in this blog post has been built from scratch with a few goals in mind:



<ul class="wp-block-list">
<li>Take advantage of the newest and best available technologies, since there were no constraints arising from legacy stuff</li>



<li>Rely on tried and proved security principles and technologies</li>



<li>Make it as flexible as possible (add and delete new stuff as needed, scale up and down without significant design changes)</li>



<li>Have it highly available, but without wasting resources</li>
</ul>



The business goals, however, become colliding design constraints when we start to look at details. Let’s rephrase the needs:



<ul class="wp-block-list">
<li>Integration of multiple clouds (AWS because of features, Cisco SD-WAN because of secure and flexible branch networks, Azure because of endpoint management, security and productivity tools)</li>



<li>Logical segmentation, i.e., the separation of the application environments in the AWS cloud, because of security concerns</li>



<li>Inspection of traffic between the AWS application environments themselves (named E-W traffic), and between the application environments and the Internet (named N-S traffic), also because of security concerns</li>



<li>Preservation of more capable security appliances (vs. the cloud native appliances)</li>



<li>Scalability without significant design changes</li>



<li>High availability and load balancing</li>
</ul>



The most difficult problem at hand is the security and high availability&nbsp;of the application environments by using third party security appliances for segmentation and traffic inspection. Centralized Inspection with AWS Gateway Load Balancer (GWLB) and Transit Gateway (TG) is aimed at resolving this problem.



The other problem is a scalable and resilient WAN network that has access to both AWS and Azure clous, and also offers and alternative path between the AWS and Azure resources, for the sake of routing simplicity. The Cisco SD-WAN solution integrates well with both the AWS TG and the Azure Virtual WAN.



<h2 class="wp-block-heading">Centralized Inspection with AWS Gateway Load Balancer and Transit Gateway</h2>



<h3 class="wp-block-heading">The Basic Concepts</h3>



Just one year back, there was no easy way to deploy, scale, and provide high-availability for third-party virtual network appliances in AWS. Amazon had released VPC ingress routing, making it easier to route traffic to specific EC2 instances within a VPC, but it still missed the ability to target a load balancer and Interface VPC endpoints in a VPC route table. By combining a transparent network gateway and a load balancer, the new AWS Gateway Load Balancer (GWLB) meets this requirement.



Virtual network appliances sit in line with network traffic and inspect incoming and outbound traffic flows. This type of transparent insertion has many names, such as service chaining, bump in the wire, or network functions virtualization (NFV).



A Gateway Load Balancer (GWLB)&nbsp;is a managed service (or control plane) that makes it easy for customers to deploy and manage a fleet of horizontally scalable inline network virtual appliances in a transparent manner for purposes such as security inspection, compliance, policy controls, and other networking services.



A Gateway Load Balancer Endpoint (GWLBE)&nbsp;is a data plane component of the GWLB and provides a way for customers to flexibly place interface VPC endpoints in both centralized and distributed deployments. A GWLBE is similar to AWS PrivateLink, which allows you to place your service across many accounts and VPC’s without losing centralized control and administration.



<figure class="wp-block-image aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="513" src="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture1-1024x513.jpg" alt="" class="wp-image-1141" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture1-1024x513.jpg 1024w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture1-300x150.jpg 300w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture1-768x385.jpg 768w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture1.jpg 1430w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /></figure>



An Elastic IP address is a static, public IPv4 address designed for dynamic cloud computing, which is reachable from the Internet. An Elastic IP address is allocated to an AWS account, and can be registered with the public DNS.



<figure class="wp-block-image aligncenter size-full"><img loading="lazy" decoding="async" width="506" height="347" src="https://wp.arcticstream.ro/wp-content/uploads/2023/06/transit_gateway_0642552978.jpeg" alt="" class="wp-image-1176" srcset="https://wp.arcticstream.ro/wp-content/uploads/2023/06/transit_gateway_0642552978.jpeg 506w, https://wp.arcticstream.ro/wp-content/uploads/2023/06/transit_gateway_0642552978-300x206.jpeg 300w" sizes="auto, (max-width: 506px) 100vw, 506px" /></figure>



An AWS Transit Gateway provides a hub and spoke design for connecting VPCs and on-premises networks as a fully managed service. No VPN overlay is required, and AWS manages high availability and scalability. Transit Gateway controls how traffic is routed among all the connected spoke networks using route tables. This hub-and-spoke model simplifies management and reduces operational costs because VPCs only connect to the Transit Gateway instance to gain access to the connected networks. Transit Gateway is a Regional resource and can connect thousands of VPCs within the same AWS Region.



Some network appliances, such as stateful firewalls, require visibility to a network flow’s bidirectional transaction in order to assess valid traffic from potential threats or attacks. For these scenarios asymmetric routing can hinder the effectiveness of stateful solutions. By default, the AWS Transit Gateway attempts to isolate traffic within the availability zone the traffic originated. While this behavior is optimal for most architectures, it is not ideal for centralized stateful firewall implementations that span multiple availability zones. It can introduce asymmetric routing which can result in traffic disruption. To solve this problem the AWS Transit Gateway&nbsp;now supports appliance mode. Appliance mode ensures bidirectional traffic forwarding to the same VPC attachments, also known as symmetric routing. This removes the need for complex workarounds, such as source-NAT, to force traffic to return to the correct appliance.



Patterns for Inline Inspection – N/S and E/W Traffic



Customers that are implementing inline appliances typically fall into one of following architectural patterns:



<ul class="wp-block-list">
<li>Single VPC with north/south connectivity</li>



<li>Many VPC’s with centralized north/south connectivity</li>



<li>Many VPC’s with centralized east/west connectivity</li>



<li>Single VPC with east/west connectivity between subnets in the same VPC</li>
</ul>



The terms north/south and east/west have been used for years in traditional networking and data center environments to help describe the flow of traffic. North/south generally refers to traffic leaving the network or the data center, and is most commonly describing traffic that is coming from or going to the Internet. East/west refers to traffic flowing between resources within the data center or network.



With the model of single VPC with north/south connectivity, one has the flexibility to centralize or distribute the control plane and maintain a distributed data plane. No Transit Gateway is required.



Single VPC, Distributed Control and Data Plane (GWLB and GWLBE)



<figure class="wp-block-image aligncenter size-full"><img loading="lazy" decoding="async" width="684" height="318" src="https://wp.arcticstream.ro/wp-content/uploads/2023/06/Picture1-1.jpg" alt="" class="wp-image-1159" srcset="https://wp.arcticstream.ro/wp-content/uploads/2023/06/Picture1-1.jpg 684w, https://wp.arcticstream.ro/wp-content/uploads/2023/06/Picture1-1-300x139.jpg 300w" sizes="auto, (max-width: 684px) 100vw, 684px" /></figure>



Single VPC, Centralized Control Plane (GWLB), Distributed Data Plane (GWLBE)



<figure class="wp-block-image aligncenter size-full"><img loading="lazy" decoding="async" width="535" height="428" src="https://wp.arcticstream.ro/wp-content/uploads/2023/06/Picture2.jpg" alt="" class="wp-image-1161" srcset="https://wp.arcticstream.ro/wp-content/uploads/2023/06/Picture2.jpg 535w, https://wp.arcticstream.ro/wp-content/uploads/2023/06/Picture2-300x240.jpg 300w" sizes="auto, (max-width: 535px) 100vw, 535px" /></figure>



When many VPC’s require centralized north/south connectivity,&nbsp;the inline bump-in-the-wire functionality is moved in a centralized VPC. This is typically accomplished with the AWS Transit Gateway to help control separation of duties between accounts that are performing the inline functionality, and the spoke VPCs that are hosting applications. In this pattern both control and data plane functionality are centralized.



Many VPC’s, Centralized Control and Data Plane, North/South traffic (GWLB and GWLBE plus TGW)



<figure class="wp-block-image aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="415" src="https://wp.arcticstream.ro/wp-content/uploads/2023/06/Picture3-1024x415.jpg" alt="" class="wp-image-1163" srcset="https://wp.arcticstream.ro/wp-content/uploads/2023/06/Picture3-1024x415.jpg 1024w, https://wp.arcticstream.ro/wp-content/uploads/2023/06/Picture3-300x122.jpg 300w, https://wp.arcticstream.ro/wp-content/uploads/2023/06/Picture3-768x311.jpg 768w, https://wp.arcticstream.ro/wp-content/uploads/2023/06/Picture3.jpg 1430w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /></figure>



The centralized VPC can also be used to addresses connectivity between two or more VPCs and is often times combined with the centralized north/south connectivity model over the AWS Transit Gateway.



Many VPC’s, Centralized Control and Data Plane, East/West traffic (GWLB and GWLBE plus TGW)



<figure class="wp-block-image aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="456" src="https://wp.arcticstream.ro/wp-content/uploads/2023/06/Picture4-1024x456.jpg" alt="" class="wp-image-1165" srcset="https://wp.arcticstream.ro/wp-content/uploads/2023/06/Picture4-1024x456.jpg 1024w, https://wp.arcticstream.ro/wp-content/uploads/2023/06/Picture4-300x134.jpg 300w, https://wp.arcticstream.ro/wp-content/uploads/2023/06/Picture4-768x342.jpg 768w, https://wp.arcticstream.ro/wp-content/uploads/2023/06/Picture4.jpg 1430w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /></figure>



The single VPC that requires east/west functionality between subnets in the same VPC is not a supported configuration, because the VPC does not allow more specific routes than a VPC’s CIDR allocation to be defined within a VPC route table. Because of this, a VPC route table does not allow to redirect traffic through an appliance if the source and destination are in the same VPC. There is one exception to this rule and it applies to edge routing tables. An edge routing table allows traffic to enter a VPC from an Internet Gateway through a Gateway Load Balancer.



For this same reason it is important to consider the placement of inline functions for internet bound workloads as well. If an AWS NAT Gateway or self-managed NAT instances are being used, the GWLBE must reside between the Internet Gateway and the publicly-facing resource directly. For traffic coming&nbsp;in from the internet, the inline functionality or GWLBE cannot be placed after the NAT and in-between the private instances as it would require a more specific route within the VPC route table.



<figure class="wp-block-image aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="510" src="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture5-1024x510.jpg" alt="" class="wp-image-1149" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture5-1024x510.jpg 1024w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture5-300x149.jpg 300w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture5-768x382.jpg 768w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture5.jpg 1430w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /></figure>



Patterns for Inline Inspection – Taking into Account the Firewall State



Asymmetric routing is a term that describes when a client’s request to a server traverses a different network path than the server’s reply. If the asymmetric return path sends the packet through a different firewall, valid traffic could be discarded due to connection tracking–a core component of stateful firewalls. A stateful firewall tracks a connection or network flow for the entire length of a transaction (such as with TCP connections from the initial SYN packet to the final FIN notification). For a firewall to track a connection effectively the network must ensure that packets are sent to the same firewall instance in both directions (client-to-server, and server-to-client). If for any reason an active flow gets routed to a firewall that is not tracking the flow’s state it can lead to unwanted packet drops.



By default, the AWS Transit Gateway applies a very specific routing algorithm that is optimized to maintain availability zone affinity. While this is ideal for performance and availability, it can present problems for the centralized firewall architectures. This is especially true in the centralized east/west architecture pattern where the source and the destination might be in two different availability zones.



With the AWS Transit Gateway appliance mode, it’s possible to specify attachments that should forward network flows out of the same availability zone regardless of the flow’s direction and what availability zone it originated. The AWS Transit Gateway Appliance Mode ensures that network flows will be symmetrically routed to the same availability zone and network appliance. Exactly one AWS Transit Gateway must be connected to the Appliance VPC in order to guarantee stickiness of flows, because AWS Transit Gateways do not share flow state information with each other.



<figure class="wp-block-image aligncenter size-large"><img loading="lazy" decoding="async" width="1024" height="555" src="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture7-1024x555.jpg" alt="" class="wp-image-1151" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture7-1024x555.jpg 1024w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture7-300x163.jpg 300w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture7-768x416.jpg 768w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/Picture7.jpg 1430w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /></figure>



Sources:



<ul class="wp-block-list">
<li><a href="https://aws.amazon.com/blogs/networking-and-content-delivery/design-your-firewall-deployment-for-internet-ingress-traffic-flows/">https://aws.amazon.com/blogs/networking-and-content-delivery/design-your-firewall-deployment-for-internet-ingress-traffic-flows/</a></li>



<li><a href="https://aws.amazon.com/blogs/networking-and-content-delivery/scaling-network-traffic-inspection-using-aws-gateway-load-balancer/">https://aws.amazon.com/blogs/networking-and-content-delivery/scaling-network-traffic-inspection-using-aws-gateway-load-balancer/</a></li>



<li><a href="https://aws.amazon.com/blogs/networking-and-content-delivery/integrate-your-custom-logic-or-appliance-with-aws-gateway-load-balancer/">https://aws.amazon.com/blogs/networking-and-content-delivery/integrate-your-custom-logic-or-appliance-with-aws-gateway-load-balancer/</a></li>



<li><a href="https://aws.amazon.com/blogs/networking-and-content-delivery/best-practices-for-deploying-gateway-load-balancer/">https://aws.amazon.com/blogs/networking-and-content-delivery/best-practices-for-deploying-gateway-load-balancer/</a></li>



<li><a href="https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-gateway-load-balancer-supported-architecture-patterns/">https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-gateway-load-balancer-supported-architecture-patterns/</a></li>



<li><a href="https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-inspection-architecture-with-aws-gateway-load-balancer-and-aws-transit-gateway/">https://aws.amazon.com/blogs/networking-and-content-delivery/centralized-inspection-architecture-with-aws-gateway-load-balancer-and-aws-transit-gateway/</a></li>



<li><a href="https://aws.amazon.com/blogs/apn/centralized-traffic-inspection-with-gateway-load-balancer-on-aws/">https://aws.amazon.com/blogs/apn/centralized-traffic-inspection-with-gateway-load-balancer-on-aws/</a></li>
</ul>

Multi-Cloud Network Architecture-1

NIS Directive&nbsp;



The NIS Directive (Network and Information Security) was the first legislative act of the European Union that provided a uniform approach to cybersecurity across all member states. The purpose of this directive was to implement a common high level of cybersecurity in all these countries.



In the context of increasing security threats resulting from digitalization processes and the current geopolitical situation, the implementation of the NIS Directive 1 proved to be difficult and fragmented in each state.



Thus, the NIS Directive 2, which came into effect on January 16 of the current year, aims to expand the scope in terms of sectors and entities and provides new clarifications regarding incident reporting and sanctions. Member states have 21 months to transpose it into national legislation, and companies will be required to comply with the directive&#8217;s provisions starting in the fall of 2024. Although it may seem like there is enough time until then, it is important for companies to prepare in advance with compliance, based on cybersecurity policies and the current level of readiness.



Specifically, what are the changes introduced by NIS Directive 2 compared to NIS Directive 1?



1. Improved monitoring and enforcement methods: A list of sanctions has been introduced, including fines for violating risk management directives and reporting obligations.



2. Establishment of an organization to facilitate the coordination of security incident management at the EU level (EU-CyCLONe): This body will assist in cooperation between member states regarding the discovery of new vulnerabilities.



3. Cybersecurity risk management: Strengthening requirements regarding the measures taken in the event of security incidents, crisis management, procedures and policies in discovering and disclosing vulnerabilities, good practices for cybersecurity awareness and training of employees, the use of encryption, access control policies, and asset management.



Targeted Activity Areas



NIS Directive 2 covers more industries and sectors than the initial one, incorporating those initially included in NIS:



<ul class="wp-block-list">
<li>Healthcare</li>



<li>Digital infrastructure</li>



<li>Transportation</li>



<li>Water</li>



<li>Energy</li>



<li>Banks and financial services</li>



<li>Digital service providers</li>
</ul>



Additionally, the following are added:



<ul class="wp-block-list">
<li>Electronic communications providers, networks, or services</li>



<li>Digital service providers such as social networking platforms and Data Center hosting services</li>



<li>Wastewater and waste management</li>



<li>Food industry</li>



<li>Public Administration</li>



<li>Postal and Courier Services</li>



<li>Space Industry</li>



<li>Manufacturin</li>
</ul>



You can find a detailed list, along with explanations for each sector, in the complete text of the&nbsp;<a href="https://eur-lex.europa.eu/legal-content/RO/TXT/PDF/?uri=CELEX:32022L2555&amp;from=EN">directive in Romanian.</a>&nbsp;



In conclusion,



Arctic Stream experts are available to assess the cybersecurity posture of your company and recommend best practices and suitable solutions for your business objectives. Additionally, our training division can provide specialized courses on risk awareness and incident response procedures.



Other references:&nbsp;



<a href="https://ec.europa.eu/newsroom/dae/redirection/document/72155">Factsheet NIS Infrastructure</a>



<a href="https://www.europarl.europa.eu/RegData/etudes/BRIE/2021/689333/EPRS_BRI(2021)689333_EN.pdf">NIS2 Briefing</a>

NIS2 Directive-What is it and what does it entail for the targeted companies?

In this blog post, we aim to summarize the courses we intend to offer in the first 9 months of 2023. The dates provided are estimates. For details regarding the curriculum and pricing, we invite you to consult the Courses section.



1. Best Practices in Approaching and Implementing Cybersecurity Solutions &#8211; April 3-5



Description: A course focused on understanding cybersecurity, covering concepts such as zero trust, types of attacks, security design, cryptography, cyber kill chain, SOC incident response. In addition to theoretical aspects, the course includes practical examples of configuration on Windows stations, red/blue teams attacks, detection of device vulnerabilities, etc.&nbsp;



Duration: 3 days&nbsp;



Prerequisites: basic understanding of networks&nbsp;



Theoretical course + hands-on lab exercises



2. Cisco Firepower &#8211; Installation, Configuration, and Optimization of the Platform &#8211; May 2023



Description: This course is intended for network administrators or security specialists who configure and operate Cisco Firepower platforms. The course includes practical methodology for installing, configuring, and troubleshooting the Cisco Firepower platform using Cisco Firepower Management Center.&nbsp;



Duration: 3 days&nbsp;



Prerequisites: equivalent CCNA Security knowledge&nbsp;



Theoretical course + hands-on lab exercises &nbsp;



3. Designing and Configuring Cybersecurity for Industrial Networks &#8211; June 2023



Description: The course covers types of attacks in industrial networks, recommended architectures for segmentation, technologies, and platforms for protecting these types of networks (e.g., Cisco Cybervision, ISA 3000).&nbsp;



Duration: 3 days&nbsp;



Prerequisites: Networking basics, elementary understanding of industrial networks&nbsp;



Theoretical course + hands-on lab exercises Cisco Cybervision &nbsp;



4. CCNA Bootcamp &#8211; June 2023 or upon request, minimum of 7 participants



Description: A condensed 5-day course for preparation towards obtaining the CCNA R&amp;S certification.&nbsp;



Duration: 5 days&nbsp;



Prerequisites: basic understanding of networks&nbsp;



Theoretical course + lab exercises &nbsp;



5. Advanced Routing &amp; Switching Concepts &#8211; May 2023



Description: The course covers advanced routing and switching concepts (equivalent to CCNP level). Concepts such as BGP, VRF, MPLS, and best practices for LAN and WAN network design will be discussed.&nbsp;



Duration: 5 days&nbsp;



Prerequisites: equivalent to CCNA R&amp;S, knowledge and experience in operating networks



Theoretical course + lab exercises



6. Network Security &#8211; July 2023



Description: A course covering the topics included in the CCNA Security curriculum (encryption algorithms, IPSEC, types of VPNs, securing network access, GRE).&nbsp;



Duration: 3 days&nbsp;



Prerequisites: basic knowledge of networking and security&nbsp;



Theoretical course + lab exercises



7. Cisco ISE Course: Implementation and Best Practices &#8211; September 2023



Description: The course is intended for network administrators or security specialists who configure and operate the Cisco ISE platform. The course includes practical methodology for operating Cisco ISE in common use cases (AAA, Tacacs, Remote Access VPN, Wireless guest, 802.1x, etc.).&nbsp;



Duration: 3 days&nbsp;



Prerequisites: basic knowledge of networking and security&nbsp;



Theoretical course + lab exercises &nbsp;



8. Cisco Secure Email &amp; Secure Web &#8211; Operation and Administration &#8211; September 2023



Description: The course is intended for network administrators or security specialists who configure and operate Email and Web security platforms (Cisco Secure Email and Cisco Secure Web, formerly ESA/WSA).&nbsp;



Duration: 5 days&nbsp;



Prerequisites: intermediate level of knowledge in networking and security&nbsp;



Theoretical course + lab exercises &nbsp;



9. WLC Catalyst 9800 Cisco &#8211; Installation, Configuration, and Administration &#8211; June/July 2023



Description: The course is intended for network administrators who operate wireless networks based on the Cisco Catalyst 9800 controller. The course covers the configuration elements of a wireless network, including authentication and integration with radius servers such as ISE, optimization for high-density user environments.&nbsp;



Duration: 3 days&nbsp;



Prerequisites: intermediate knowledge of wireless networks, radio frequency elements, basic knowledge of network security&nbsp;



Theoretical course + lab exercises &nbsp;



11. Cisco Application Centric Infrastructure &#8211; Installation, Configuration, and Management of the Solution &#8211; July 2023



Description: The course is intended for network administrators who operate software-defined networks in data centers, specifically Cisco ACI. The course includes both theoretical aspects and practical configuration and operation labs, as well as troubleshooting elements.&nbsp;



Duration: 3 days&nbsp;



Prerequisites: intermediate level of networking knowledge and specific data center elements&nbsp;



Theoretical course + lab exercises



12. Cisco SD-WAN Course &#8211; Installation, Configuration, and Management of the Solution &#8211; May/June 2023



Description: The course is intended for network administrators who operate software-defined WANs, specifically Cisco Viptela SD-WAN. The course covers both theoretical aspects, design best practices, and hands-on labs for configuration, operation, and troubleshooting of the platform.&nbsp;



Duration: 3 days&nbsp;



Prerequisites: intermediate level of networking knowledge&nbsp;



Theoretical course + lab exercises

AST Training 2023 Course Calendar

Types of Traffic and Architectures in Data Centers In a Data Center, network traffic can be characterized as either north-south or east-west. North-south traffic, on one hand, refers to data packets between an endpoint (e.g., a server) and a user that flow between the data center and an external location. This type of traffic was predominant in the early days of the internet. On the other hand, east-west traffic describes data traffic that flows within a data center from one server to another. Hardware virtualization and the Internet of Things (IoT) are two concepts that have led to the increase in this type of traffic in recent times. Currently, approximately 70% of the traffic in a data center flows east-west, from one server to another. &nbsp;



North-south traffic is suitable for a design consisting of three tiers &#8211; core, distribution, and access &#8211; a design commonly found in traditional data centers. In this scenario, a packet traverses the core level, is routed to the distribution switch, and then forwarded to the access switch where the destination server is connected. As a result, most packets traverse three hops, which makes the latency quite predictable. &nbsp;



In recent years, traffic within the same data center, that is, east-west traffic, has become increasingly common and has thus become the new standard. The main issue with the traditional three-tier design is that since the traffic is predominantly from server to server, it no longer traverses only three hops but four, five, or even more hops, adding additional latency to each flow and increasing the risk of bottlenecks or dropped packets. &nbsp;



In a modern data center, the recommendation is to have a two-tier architecture, with a level of spine switches (similar to core switches) and another level of leaf switches (similar to access switches). This architecture is much better suited for server-to-server traffic within the same data center and offers the following advantages: &nbsp;



<ul class="wp-block-list">
<li>Resilience &#8211; each leaf switch connects to each spine switch, eliminating the need for spanning tree protocol (STP), and allowing each link to be utilized.</li>



<li>Low latency &#8211; a maximum of two hops for east-west packets, resulting in predictable latency.</li>



<li>Increased performance &#8211; active-active uplinks enable traffic to be transmitted through the least congested link.</li>



<li>Scalability. </li>
</ul>



It is worth mentioning that this type of architecture can be implemented in both traditional and software-defined networks, and in recent times, more and more companies are migrating their traditional infrastructure, whether it is WAN or Data Center, to Software-Defined Networking (SDN) networks.



But first of all, what are software-defined networks and what are their advantages?



<figure class="wp-block-image aligncenter size-large is-resized"><img loading="lazy" decoding="async" width="1024" height="576" src="https://wp.arcticstream.ro/wp-content/uploads/2024/10/ACI2-1024x576.jpg" alt="" class="wp-image-1127" style="width:633px;height:auto" srcset="https://wp.arcticstream.ro/wp-content/uploads/2024/10/ACI2-1024x576.jpg 1024w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/ACI2-300x169.jpg 300w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/ACI2-768x432.jpg 768w, https://wp.arcticstream.ro/wp-content/uploads/2024/10/ACI2.jpg 1152w" sizes="auto, (max-width: 1024px) 100vw, 1024px" /></figure>



Advantages of Software-Defined Networks



SDN networks have penetrated both the Data Center area (at a rate of 64%) and the WAN area (58%), as well as the LAN and network access area (40%), according to <a href="https://www.cisco.com/c/en/us/solutions/software-defined-networking/overview.html#~what-is-sdn" target="_blank" rel="noreferrer noopener">cisco.com</a>. Regardless of the implementation area, SDN networks deliver a centralized, flexible, and easier-to-manage network, consisting of one or more controllers (the core element of an SDN architecture) and a set of APIs. &nbsp;



The key difference between SDN networks and traditional networks lies in the infrastructure: an SDN network is software-based, while a traditional network is hardware-based. An SDN network is much more flexible than a traditional network because the control plane is software-based, allowing administrators to control the network, perform configurations, provision resources, or monitor it from a centralized graphical interface.



Cisco Application Centric Infrastructure, or Cisco ACI, is an SDN solution for data centers that has been adopted by many companies. It provides a different way of monitoring and operating networks compared to traditional approaches. &nbsp;



What makes this solution so powerful and attractive?



Cisco ACI



Cisco ACI converts all switches into what is called a fabric, which is equivalent to a giant switch. The main purpose of a Data Center fabric is to route traffic on the most optimal path from a server &#8211; whether virtual or physical &#8211; to a destination, while simultaneously providing the following types of services:



<ul class="wp-block-list">
<li>Traffic optimization</li>



<li>Telemetry (which goes beyond traditional port counters)</li>



<li>Application of security rules</li>
</ul>



The brain of an ACI solution is the Application Policy Infrastructure Controller (APIC), through which administrators create and apply policies throughout the network. In the event of connectivity loss with one or all of the controllers, the network remains functional.



One of the advantages of an ACI solution is that management is centralized through the APIC, either through a graphical interface or via REST APIs. The configuration process is intuitive compared to traditional networks where administrators had to log in to each device, managing it box by box. With ACI, the APIC pushes the configuration to the switches, eliminating the need for manual intervention by an administrator, which would otherwise result in reduced operational speed. Additionally, the risk of human errors is eliminated since the APIC does not accept incorrect configuration commands.



In ACI, tasks such as configuring a large number of switches or adding a new switch to the network are much simpler than in a traditional network, requiring only a few clicks without the need to log in to the command line. Therefore, fabric deployment and configuration are done from a single centralized management point. Troubleshooting is much faster, resulting in a significant reduction in diagnosis and issue remediation time, as the system ensures continuous monitoring of the entire infrastructure.



The ACI architecture is highly scalable. If more bandwidth is needed, more spine switches can be added. If a larger number of ports is required, more leaf switches can be added. These switches integrate into the solution automatically, inheriting the existing configuration from the APIC.



Through the APIC, end-to-end visibility of the entire network, including traffic between virtual machines, is achieved in a single graphical application.



Cisco ACI also integrates with security equipment, allowing the insertion of firewalls or IPS (Intrusion Prevention Systems) between logical groups formed by multiple servers. This ensures that east-west traffic between servers and north-south traffic between users and applications is secured. The solution also allows integration with third-party solutions such as VMware, providing the ability to create port groups in vCenter directly from the APIC&#8217;s graphical interface. This extends the network to the virtual machine, not just the hypervisor, reducing configuration time. &nbsp;



Arctic Stream specialists have implemented ACI migrations in data centers of various sizes, observing all the mentioned advantages in terms of automation, scalability, and easy management. If you are interested, please contact us for a discussion at office@arcticstream.ro.

Cisco ACI-advantages of a software-defined architecture in data centers

What is Log4j?



Log4j is one of the most popular logging libraries used online and provides software developers with a method to track activity for various reasons, including troubleshooting, auditing, and data tracking. Being an open-source and free library, it is integrated into many existing Java applications.



Why is the vulnerability dangerous?



Log4Shell is the vulnerability discovered last week, which allows an attacker, if exploited, to execute code on the affected servers, for example, importing malware that could compromise the application entirely or extract data. The vulnerability is exposed when the application saves a set of characters in the log, making it easy to trigger and exploit.



Cloud services, network management platforms, video games are just a few examples of applications and services that use the Log4j library. Apache Software Foundation, the organization that developed Log4j, has released the security patch, but the process of updating all applications will take time, during which attackers are still scanning the internet for applications without the patch applied.



How do we detect if we have affected applications and how can we protect our applications? &nbsp;



There are already developed open-source applications that can scan potentially vulnerable applications and detect the use of the affected version of the Log4j library. Additionally, most firewall vendors have published IPS signatures to detect known malicious behavior.



For more information, we recommend the following articles: &nbsp;[<a href="https://www.linkedin.com/pulse/why-log4j-exploit-so-serious-vinny-parla/">https://www.linkedin.com/pulse/why-log4j-exploit-so-serious-vinny-parla/</a> ](<a href="https://www.linkedin.com/pulse/why-log4j-exploit-so-serious-vinny-parla/">https://www.linkedin.com/pulse/why-log4j-exploit-so-serious-vinny-parla/</a> ) si [<a href="https://blog.talosintelligence.com/2021/12/apache-log4j-rce-vulnerability.html">https://blog.talosintelligence.com/2021/12/apache-log4j-rce-vulnerability.html</a>](<a href="https://blog.talosintelligence.com/2021/12/apache-log4j-rce-vulnerability.html">https://blog.talosintelligence.com/2021/12/apache-log4j-rce-vulnerability.html</a>)