Your Firewall to the Internet: Recommendations & Updates

Tech Talks are a weekly opportunity to learn how to do more with your cloud software and services. Each week, we feature a short talk from a subject matter expert, followed by a community driven Q&A where Agile IT customers can ask engineers any of their most pressing questions. This is a free service for our managed service clients. July 26th’s Tech Talk featured Conrad Agramont , Robin Chow, Chris D’Arcy and Adam D’Arcy from XBase who shared a deep dive into things to consider when upgrading your network hardware.

 

Your Firewall to the Internet and Cloud?

When using cloud services, your internet connection is critical. Underpowered equipment or outdated features can reduce the effectiveness of your cloud technologies while outages can completely shut you down. Your network hardware should be able to support redundancy while also being able to manage the protocols to give you the best connection possible to your cloud services.

What are some of the things you need to look for, plan for, and consider when you connect to the cloud?

With greater movement to the cloud, we see there is a greater emphasis that is often overlooked regarding network connectivity on the LAN side and assuring that there is reliability and resilience. Since you are putting your infrastructure in the hands of providers like Microsoft, Google or AWS you business is in the hands of the carriers to assure access to your resources. Making sure there is redundancy as well as the core connectivity capabilities is important.

What Features do modern network hardware devices need?

Route Based VPN: Depending on the manufacturer this can have different names, like VTI Interface From Cisco. With Route based VPN you have additional features such as redundancy, route from multiple subnets

IKEV2: (Internet Key Exchange Version 2) The Latest standards for VPN connectivity. Providers that support VPI and IKEV2: Cisco, Juniper, Sonicwall, Palo Alto.

Policy Based VPNs (your traditional IPSec VPNs) are not advised. They will give connectivity into Azure, but you will not have the same capabilities for redundancy, or having multiple sub-nets reachable through that VPN.

Things to plan before deploying a router

• Bandwidth Requirements
• Realistic assessment of what the actual throughput is for the device. IKEV2 overhead will reduce throughput
• Look at the manufacturers data sheets to get real information.
  • Cisco Router Data Sheets (Cisco also has the Cisco Router Selection Tool)
  • Paloalto Networks Data Sheets
  • Juniper Networks Data Sheets
  • SonicWall Datasheets

Comparison of IKEV1 and IKEV2

• Both offer security
• IKEV 1 only allows a single tunnel
• IKEV2 allows multi-tunneling
• VPI allows you to connect multiple sites and to provision for redundancy.

Summary

In this short talk, our partners at Xbase gave a quick walk through on how to select the right hardware for your cloud connected infrastructure.