8) Modern Network Environments

Software-Defined Networking (SDN) Fundamentals

• Definition: Software-defined networking (SDN) is an innovative networking paradigm that decouples the network control and forwarding functions. This decoupling enables network management through software applications rather than hardware-specific configurations.

• SDN Planes of Architecture:

  • Data Plane: This plane is responsible for the actual forwarding of packets through the network.

  • Control Plane: This plane manages network traffic and establishes policies across the infrastructure.

  • Application Plane: This plane hosts network applications and services. it leverages the control plane to execute high-level tasks and functionalities.

SD-WAN (Software-Defined Wide Area Network)

• Definition: SD-WAN is a specific application of software-defined networking (SDN) technology applied to WAN connections. It is used to connect enterprise networks, including branch offices and data centers, over large geographic distances.

• Business Efficiency: This technology enhances efficiency by dynamically routing traffic across the optimal path using a centralized control function. This ensures high performance and reliability for critical business applications.

• Application Aware Capabilities: SD-WAN technology intelligently identifies applications. It can prioritize traffic based on specific business requirements to ensure critical applications have the necessary bandwidth and path reliability.

• Zero-Touch Provisioning (ZTP): This feature allows for the remote deployment of network devices with minimal manual intervention. Network devices can automatically download configuration settings from a central location, significantly simplifying deployments at branch locations.

• Transport Agnostic Nature: SDN is flexible regarding the types of connectivity it utilizes. It can use MPLS, broadband, LTE, or a combination of these. This allows for cost-effective and reliable internet access from a variety of different service providers.

• Central Policy Management: Centralized management allows network administrators to set policies that manage and configure all SDN devices across the network from a single interface. This centralized approach enhances both security and operational efficiency.

VXLAN (Virtual Extensible Local Area Network)

• Definition and Scalability: VXLAN is a network virtualization technology designed to enhance the scalability of large-scale cloud computing environments.

  • VLAN Limits: Traditional VLANs are limited to $4096$ ($12$ bits) identifiers.

  • VXLAN Limits: VXLAN provides scalability up to $16.78 \text{ million}$ ($24$ bits) virtualized LANs.

• Layer 2 Over Layer 3: VXLAN extends Layer 2 segments over an underlying Layer 3 network. This enables the creation of a large number of virtualized LANs across a physical infrastructure.

• Data Center Interconnect (DCI): VXLAN is particularly effective for DCI by enabling the stretching of Layer 2 networks across geographically dispersed data centers. This allows for the seamless mobility of virtual machines (VMs) between data centers without requiring changes to the underlying network configurations.

• Layer 2 Encapsulation: VXLAN uses Layer 2 encapsulation to wrap Ethernet frames within UDP packets. This encapsulation creates a logical network for VMs even when they reside on different physical networks.

Zero Trust Security Model

• Core Principle: The security model is based on the principle of "never trust, always verify."

• Identity Verification: Zero Trust requires strict identity verification for every person and device attempting to access resources on a private network, regardless of whether the user is located inside or outside the network perimeter.

• Attack Vector Minimization: By treating all users as potential threats and enforcing strict access controls, Zero Trust minimizes potential attack vectors. It does not assume trust based on network location.

• Policy-Based Authentication: Within a Zero Trust framework, all users (internal and external) must be authenticated and continuously validated for security configuration and posture before being granted access to data and applications. Policies may include:

  • Multifactor authentication (MFA).

  • Biometrics.

  • Behavioral analytics.

• Authorization in Zero Trust Architecture (ZTA):

  • Dynamic Enforcement: Authorization is dynamic and strictly enforced before resource access is allowed.

  • Context-Awareness: The process takes into account the user's identity, location, device health, service or workload, data classification, and any detected anomalies.

  • Per-Session Basis: Access to resources is granted on a per-session basis, ensuring access rights are constantly evaluated and adjusted based on the latest security intelligence.

• The Principle of Least Privilege: This principle requires that users, systems, and programs are granted only the minimum levels of access or permissions needed to perform necessary tasks. This minimizes potential damage from accidental or malicious actions.

SASE and SSE Frameworks

• Overview: SASE (Secure Access Service Edge) and SSE (Security Service Edge) are emerging frameworks that combine network security functions with WAN capabilities to support distributed workforces and cloud-first strategies.

• Secure Access Service Edge (SASE): SASE integrates comprehensive WAN services and security functions directly into the network fabric. This provides secure network connectivity and access to resources regardless of the user's location.

• Security Service Edge (SSE): SSE focuses specifically on security aspects. It centralizes various security services provided in the cloud to ensure data protection across all environments, including:

  • Secure Web Gateways (SWG).

  • Cloud Access Security Brokers (CASB).

  • Zero Trust Network Access (ZTNA).

Infrastructure as Code (IaC)

• Definition: IaC is a key practice in cloud computing and DevOps involving the management and provisioning of computing infrastructure through machine-readable definition files, rather than through physical hardware configuration or interactive tools.

• Automation Strategy: Automation is at the core of IaC, enabling rapid and consistent environment setups. This reduces human error and increases deployment efficiency.

• Orchestration Elements: IaC utilizes several elements to define and orchestrate infrastructure setup, modification, and management, including:

  • Playbooks.

  • Templates.

  • Reusable Tasks.

• Configuration Drift and Compliance: IaC helps prevent configuration drift, which occurs when an environment's current state deviates from its intended state due to manual updates. It also automates configurations to maintain compliance with defined standards and policies.

• Infrastructure Upgrades: Upgrades are managed systematically through code revisions. This method ensures upgrades are less disruptive, version-controlled, and reversible.

• Dynamic Inventories: Infrastructure resources are automatically discovered and managed based on real-time data, allowing environments to adjust quickly to changing demands.

Source Control in IaC

• Definition: Source control is integral to the IaC paradigm, providing a system for tracking changes, collaborating, and maintaining the integrity of the code defining the infrastructure.

• Version Control Systems: These systems track every modification to the code in a specialized database. Developers can revert to earlier versions to fix mistakes while minimizing team disruption.

• Central Repository: Acts as the single source of truth for all code changes. It allows team members to collaborate by accessing and updating code securely.

• Conflict Identification: Source control systems automatically detect conflicts when multiple team members attempt to change the same part of the code. This prevents overwrites and ensures reconciliations occur before merging.

• Branching: This feature allows developers to diverge from the main line of development to work independently on new features, bug fixes, or experiments in a controlled environment without affecting others' work.

IPv6 Addressing and Transition

• Overview: IPv6 is the most recent version of the Internet Protocol designed to replace IPv4. It uses $128$-bit addresses to support a virtually unlimited number of devices, addressing the exhaustion of IPv4 addresses.

• Mitigating Address Exhaustion: IPv6 provides an almost limitless pool of IP addresses to ensure the scalable growth of the internet and accommodate global increases in users and devices.

• Compatibility Strategies: Because the internet will operate in a mixed environment for many years, transition strategies are required to ensure IPv4 and IPv6 systems can operate concurrently.

• Tunneling: A method used to transmit IPv6 packets over existing IPv4 network infrastructure. It works by encapsulating IPv6 packets within IPv4 packets, allowing them to be transported across IPv4 networks as if they were IPv4 packets.

• Dual Stack: A network configuration where devices run both IPv4 and IPv6 protocols simultaneously. Network services and applications can operate over either protocol depending on the destination address and network conditions.

• NAT64: A network address translation technology that facilitates communication between IPv6 and IPv4 devices by translating IPv6 addresses into IPv4 addresses and vice versa.