Secure Cloud Hub - Cato Networks

Challenge

Organizations interconnecting their cloud service provider (CSP) resources are faced with the challenge of securing private cloud connectivity and also securely accessing SaaS providers. There are many approaches to securing one CSP to another and also securing accounts within the same CSP as well as connecting to SaaS providers. The following provides one solution to solve this challenge.

Scenario

Your organization has a number of AWS VPCs in separate accounts and located in two different regions, plus Azure VNETs located in the same regions as AWS. You have a requirement to provide secure communication between the resources in each AWS account and also between AWS and Azure. In addition your organisation has plans to move to Office 365 and Salesforce. You are looking to minimize any co-location requirements and are therefore considering cloud services where possible.

Solution Components

• Cato Networks Converged Platform

• AWS VPCs and VGWs

• Azure VNET and VPN gateway

• Office 365

• Salesforce

Extended solution component

• Megaport VXC

Solution Overview

Cato Networks provide a global platform that comprises of points of presence (POP) located at the "front door" of cloud service providers and SaaS providers. These POPs are integrated with a service level backed global private WAN comprising multiple tier 1 providers. For more detailed information on the Cato platform please review my article SDWAN Vendor Series 2019 - Cato Networks .

The following diagram provides a high level view of the Cato platform architecture and the security and optimized connectivity capability.

Cato Platform Components

The platform is a multi-tenanted platform and organisations are provided with their own management environment to configure, monitor and analyze network, application and service performance. Connectivity is provided globally and access to resources from the Cato POP is provided by the POP that is geographical closest to the user and resource.

An organisation can connect to their cloud VPCs and VNETs from the likes of AWS and Azure using IPsec. This is a local connection due to the proximity of the POP to cloud provider. Each VPC and VNET is treated just like a site connecting to the Cato platform and with that connection comes a security profile and routing policy. VPC to VPC communication within a region routes to the Cato POP in that region and a security policy is applied between the VPCs based on organisational requirement. For a VPC in one region communicating to a VPC in another region, traffic is routed to the local POP and then carried over the Cato global private SLA backed WAN and exits at the POP closest to the destination VPC. Traversing a private WAN rather than the public cloud, for the global communications, provides predictable traffic transport performance compared to the Internet.

Secure Global VPC Connectivity

This approach can be expanded to Azure and SaaS providers such as Microsoft O365 and Salesforce. The Cato platform will route to the closest O365 or Salesforce POP providing a performance optimized solution to SaaS providers. Azure is treated exactly the same as AWS. VPCs and Azure VNET is connected to the closest Cato POP and based on security and routing policy communication between AWS both locally or globally is provided.

Secure SaaS Access

Cato can extend connectivity to a customers data centre using a Cato Socketh, however, for the expanded solution this example uses a Megaport to AWS direct connect and a Megaport virtual connection back to the data centre. This includes Megaport for direct connect and utilizing a detached AWS VGW. IPsec is configured from the Cato platform to the detached VGW and virtual connections are provided from Megaport to on-premise router/switch and detached VGW.

Data Centre Integration

The benefits of this solution include:

• Quick access to a global backbone

• Simple integration with cloud service providers such as AWS, Azure and Google

• Secure Optimized access to SaaS providers

• Predictable global traffic performance

• Reliable and highly available connectivity locally and globally

• Secure cloud VPC and VNET communications

• Secure access to data centre/on-premise resources

• No requirement for addition co-locations facilities (rack space, cross connects, network hardware)

Resources

Cato Networks

Megaport

AWS

Azure