Tag: networking

  • HPE Acquires Silver Peak to Gain SD-WAN

    HPE Acquires Silver Peak to Gain SD-WAN

    Hewlett Packard Enterprise (HPE) announced its intent to acquire Silver Peak, a software-defined wide area network (SD-WAN) platform provider, which will be incorporated into its Aruba Networks subsidiary.

    Keerti Melkote, president of Intelligent Edge for HPE, told industry analysts the $925 million acquisition will eventually lead to edge computing devices all being managed via the same cloud framework regardless of physical location.

    Aruba Networks has been making a case for unifying the management of wired and wireless networking in branch offices via a cloud management platform. The acquisition of Silver Peak will extend the reach of that framework to SD-WANs, which are becoming more widely employed to connect both remote offices and end users working at home to applications running both in the cloud and in the local data center.

    In the wake of the COVID-19 pandemic, the number of employees working from home and needing direct access to applications has exploded. Rather than employing virtual private networks (VPNs) to connect all those home offices to a local branch office, it’s more efficient and secure to connect those working at home to applications residing in both the cloud and on-premises IT environments via SD-WANs.

    HPE claims the total addressable market for networking services aimed at various edge computing use cases is north of $32 billion, which includes both SD-WANs and wireless and wired networks deployed in the branch office.

    Silver Peak currently has more than 1,500 customers and in its last fiscal year generated $132 million in revenue. The challenge HPE and its Aruba Networks subsidiary will face is most SD-WANs that have been deployed thus far use appliances that were acquired by internal IT teams. Increasingly, however, SD-WANs are being consumed as a managed service. Aruba provides customers access to a cloud console to manage networks deployed in remote offices. It’s not clear how many internal IT organizations moving forward will want to manage remote networks versus relying on a managed service provider (MSP).

    Of course, HPE and Aruba can opt to provide a managed service. However, they will need to build out the points of presence (PoPs) to deliver a managed SD-WAN service—something many MSPs, especially telecommunications providers, and cloud service providers have already done.

    Longer-term, it’s also not clear to what degree wireless 5G services will eliminate the need for not just wired networks, but also wireless local area networks (LANs) in branch offices. Some IT organizations may conclude the cost of a 5G cellular service is less than the total cost of managing a LAN.

    There is, of course, no absolute when it comes to networking. However, if more employees are working from home for the foreseeable future, the dynamics of networking at the edge will never be the same. Developers especially will need to take into account a whole different level of network latency dynamics when deploying applications. The irony is that as applications become more distributed, the management of the networks on which they depend is becoming more centralized.

  • Bringing NetOps Up to Speed With DevOps

    Bringing NetOps Up to Speed With DevOps

    Automation can be an unwieldy topic for network operations and DevOps teams who have enough challenges working together cohesively. Networks have been traditionally viewed as the long pole in the tent for emerging DevOps practices.

    But for DevOps practitioners and business leaders alike, there’s good news: NetOps are more prepared than ever to embrace automation and programmability—increasing the likelihood of on-time service delivery, with far less friction between IT teams.

    According to Enterprise Management Associates (EMA), a strong majority (77%) of organizations deem network automation a high priority, and 58% have already implemented or are planning to implement, approved solutions. This is an important and promising shift.

    Traditionally, network leaders have favored an operating model that emphasizes stability and resiliency over agility. Understandably so, as any network interruption can have a cascading impact on the business’ operations and profitability.

    While ensuring five 9s of availability remains a top priority for NetOps, the growing need to support DevOps, containerized infrastructure for applications and cutting-edge digital services—among other initiatives—continues to highlight some of the glaring inefficiencies of traditional network management tools that are too error-prone and bound by scalability issues.

    With the right automation framework, NetOps can play an equal part in enabling DevOps practices by becoming more adaptable to evolving business and application requirements in the cloud and locally.

    Centralizing Management With Cloud-Based Service Delivery

    For decades, improving agility has been a dyed-in-the-wool practice for network teams. Organizations worldwide have now realized enormous benefits by implementing new software-defined management tactics that allow the network to become more centralized, programmatic and dynamic in nature. By disaggregating software from hardware, networking teams now can manage many more services and devices with less effort and resources.

    Among NetOps’ new arsenal of tools and best practices, centralized management has become one of the key ingredients driving toward greater efficiencies. Utilizing a cloud-based approach for provisioning, deploying and managing network services closely mirrors the way IT has spun up cloud storage and compute over the last decade. Now, DevOps teams no longer have to wait days or weeks for the NetOps team to provision the right networking resources so that they can begin designing, testing and deploying new applications.

    Along with the added efficiencies, NetOps teams have greater and more uniform control over device configurations and policies, where security vulnerabilities lie in wait if these do not establish a zero-trust environment. Orchestrating these elements centrally, rather than device by device, places far less burden on individual network operators for protecting high-value corporate assets. Rock-solid network access control also reduces the risk of security or performance degradation that commonly arise from using an ad hoc patchwork of scripts, templates and CLI commands.

    Advancing Network Automation Frameworks

    Because creating a cloud-native network infrastructure does not all happen with the press of a button, network operations won’t become fully automated overnight. Other factors come into play that inhibit broader adoption of automation frameworks, including budget constraints, difficult technology implementations that lack integration with legacy systems and skill gaps for existing staff.

    It’s essential that NetOps teams embrace a network automation framework that aligns to current and future operating models. Through proactive collaboration, NetOps folks can extend the value of automation platforms already used by their DevOps or application counterparts.

    Fortunately for NetOps teams, myriad networking vendors today readily offer pre-built, certified solutions for DevOps platforms, making it easier to get started on a cloud-native journey by automating activities such as device onboarding and configuration changes. This way, network administrators can leverage existing vendor partnerships, in-house knowledge and technology that is already proven within the larger IT environment.

    Additionally, network engineers shouldn’t need—and won’t have the extra time—to become top-notch developers to take advantage of programmability during their cloud-native journey. Developing basic programming skills is advantageous, but network management systems that offer Python scripting, a consistent set of APIs and webhooks can perform the “heavy lifting” when it comes to enabling extensibility with third-party IT platforms.

    Today, this level of extensibility includes being able to integrate with third-party IT service management tools. A common use case that can realize significant time savings and greater network and application availability is to auto-trigger and assign an incident ticket when a performance SLA is breached. It’s very easy to collect and use machine learning-based tools to correlate all of the relevant diagnostics data in order for a network operator to immediately begin a root cause analysis and quickly resolve the issue.

    On the Horizon: AI-Driven Operations

    Another core aspect of DevOps is continuous improvement—both in terms of elevating service levels, as well as enhancing user experiences. But faster rates of change resulting from continuous improvement processes can negatively impact application performance, and the network is often the first to be blamed.

    But there is a huge silver lining within this cloud created by faster rates of change, which also highlights another growth area for NetOps teams to learn and master. That is, the use of AIOps.

    Today’s networks are bound by human scale. When things break, it takes a human to realize it broke, research the issue and then apply the fix. While traditional management and monitoring tools can alleviate some of the burden, alert fatigue often becomes a huge problem—in other words, too many false alarms, false positives or, worse yet, drawing attention away from more critical issues.

    AIOps tools and technologies mitigate these issues and limitations by combining artificial intelligence, machine learning, and advanced network analytics to automate many aspects of traditional monitoring and troubleshooting. Once deployed, IT organizations have the ability to predict and preempt failures,\ or quickly recover from issues when they do occur. This includes being able to:

    • Leverage ML-trained data sets to continuously monitor network performance and detect anomalies.
    • Eliminate guesswork by prioritizing fixes or improvement efforts and validating that those efforts have the desired business impact.
    • Continuously optimize network performance based on benchmarks.

    Put another way, AIOps systems are worth their weight in gold by helping networks move toward a self-healing, self-securing and self-optimizing model. Even in the interim, during the early phases of deployment, such AI-assisted operations can help IT identify and resolve network- or user-impacting issues faster and easier. The results are that dramatic.

    Next Steps: Bring a DevOps Mentality to NetOps

    Contrary to popular belief, the goals of NetOps are not diametrically opposed to DevOps. Both groups want to deliver more value and help the business innovate.

    Equipping NetOps teams to build on existing DevOps-based automation frameworks, paired with AI-driven insights and modern management tools, will go a long way in ensuring frictionless delivery of new services.

    Now is the time for network operations teams to get to know your DevOps team, learn how they operate and come together to create new methods for advancing the organization’s IT mission. The investment in time and effort should be a creative win-win for both groups and produce a big payoff in IT’s strategic position and importance to the organization.

  • Can NetOps and SecOps Finally Get Along?

    Can NetOps and SecOps Finally Get Along?

    For years, the very definition of NetOps and SecOps has involved friction and even contentious relationships that make their respective jobs more difficult and lessen their efficiency and effectiveness. Much of this conflict originates from having charters that are seemingly in opposition to each other. At the surface, NetOps stands for connectivity, openness, speed and capacity. In contrast, SecOps comes across as binary opponents, posting for far too many regulations with segmented connectivity and a more or less closed or impaired environment.

    The truth is, however, both groups have the same goals:

    • Ensuring business operations and agility.
    • Protecting resources.

    The network is only important in its ability to connect users, systems, applications, information or data and other resources, ensuring effective business operations and agility. The network is means to an end, and not necessarily an end to itself. In a somewhat similar way, security is also not an end, but, rather, the means to an end. Security exists to protect these same users and resources. It’s all about the users and resources being able to run business operations effectively and with the agility and flexibility necessary to give it strategic advantages. Reflecting on this perspective may help NetOps and SecOps realize that they are not so far apart from each other.

    Both NetOps and SecOps struggle with many of the same issues. Both are usually overworked and understaffed, responsible for critical components or aspects of business, face constantly changing environments and challenges and slowed by cumbersome processes and a lack of agility. Because of these things, NetOps and SecOps are largely in the same boat, sharing the same storm.

    netops secopsThe lack of agility is a particularly important issue, as new technologies and techniques are constantly being developed that enable security teams to stay ahead of—or at least keep pace with—attackers. Motivated attackers tend to be far more innovative that defenders and can use anything at their disposal to accomplish their goals. Entire cybercriminal supply chains exist to provide attackers with applications, utilities, routines and even services to conduct their campaigns. These things can and will be used against defenders.

    On the other hand, deploying a new security solution on the network is generally a long, involved, cumbersome process. Even changing solutions involves considerable effort. Sometimes the rules or process gets invented along the way, compounding the difficulties. Additions or changes to the network involve tedious review processes mostly dictated by NetOps. The NetOps team also faces some of these same difficulties in adding or changing network management or monitoring solutions.

    While a careful review is warranted, current processes are too time-consuming and involved. One significant improvement can come from NetOps and SecOps coming together with an established and codified approach for network changes or additions. Getting issues out on the table for discussion is a great start. This means more collaboration and a joint learning cycle on short- and long-term organizational objectives. Both groups need to understand and appreciate the concerns of the other and realize their common ground. Prioritizing issues and agreeing on a fundamental set will ease the overall process, reduce unwarranted fear and antagonism, and eliminate much of the inventing the process on the fly.

    An emerging approach seeks to establish a centralized deployment point for both networking and security solutions with pre-established rules agreed upon by both teams. Ideally, many of the concerns can be addressed or mitigated by hardware and software designed to enforce policies or rules, provide failover as necessary, prevent performance degradation or add to the attack surface. These can allow solutions to drop into the network while offering guarantees of performance or availability.

    Streamlining deployment of shared management will result in much-needed agility and also boost efficiency and overall effectiveness. It will also lessen the typical tensions or outright opposition.

    NetOps and SecOps are much closer to each other than either realizes. Their shared guardianship of users and resources can benefit from joint discussions, plans, tools and policies. Not only can they better accomplish their own charters of connecting and protecting while providing agility and flexibility, but they also can become far more efficient with their operations. They need each other, and their organizations need the vital contributions from both. As typically said in security jargon, “A chain is only as strong as its weakest link.” The new paradigm of security-driven networking is about preventing weak links through the collaboration and synergy between NetOps and SecOps.

  • How to Minimize Latency and Its Impact on UX

    How to Minimize Latency and Its Impact on UX

    Latency can have an enormous impact on user experience. Here’s what you need to know to mitigate latency before it impacts your customer experience

    Businesses have been digitizing for decades, but recent events have accelerated the process beyond all expectations. Customers are now using more digital services than ever, and their switching costs are often extremely low. That puts enormous pressure on businesses to deliver not just online services but also consistently high performance. Businesses that once measured performance in seconds now measure it down to the millisecond and even the microsecond. For that reason, they’re eager to minimize latency and its impact on their bottom line.

    Latency can be defined as the delay before a transfer of data begins following an instruction for its transfer. However we define it, its effects are clear: A study by Amazon found that 100 milliseconds (ms) of latency cost 1% in sales. A similar study by Google found that a half-second (500 ms) lag in returning search results reduced traffic by 20%. A study by Loadstorm shows that latency can have similar effects on any business’s conversion rates. Long latencies lead to abandonment of shopping carts and frustrated users leaving your site to find the same information, product or service elsewhere.

    The moral: As businesses try to convert users and move them through their pipeline, latency can be the greatest enemy. But how do you measure it, and what can you do about it?

    Measuring Latency

    Given the impact of latency on the user experience, it’s surprising how many businesses don’t give it enough attention—or even measure it properly. A common mistake is to focus on average performance, which is ultimately a theoretical measurement that might not reflect actual end user experience.

    A better, more meaningful, way to measure real-world latency is with percentiles.

    Latency is typically calculated in the 50th, 90th, 95th, and 99th percentiles, commonly referred to as p50, p90, p95, and p99. Imagine 10 latency measurements: 1, 2, 5, 5, 18, 25, 33, 36, 122, and 1000 milliseconds (ms). A p50 measurement represents the median performance of the system. In this case, the p50 measurement is 18 ms, meaning 50% of users experienced that latency or less. The p90 measurement is 122, meaning that 9 of the 10 latencies measured less than 122.

    Each measurement within a given percentile reflects a real latency that actually impacted the experience of at least one, but likely many more end users.

    By contrast, the mean of our 10 measurements comes to roughly 125 ms, not even close to the midpoint in the observed data–in fact, slightly above the 90th percentile.

    It is vital to keep in mind the outliers, what are called “long-tail latencies.” Under real-world conditions, p99 (and higher) latencies are often the ones you need to worry about most.

    Gil Tene, the CTO of Azul Systems, addresses this problem in his presentation, “How NOT to Measure Latency.” He notes that p99 latencies can easily impact a far larger than expected proportion of users. If a typical user session involves five page-loads, averaging 40 resources per page, about 18% of users will experience at least one response longer than even the p99.9. He also points out that the average response percentile is experienced by more than 95% of users will be the p99.97 latency.

    As Google engineer Luiz André Barroso put it:

    “When a request is implemented by work done in parallel, as is common with today’s service-oriented systems, the overall response time is dominated by the long tail distribution of the parallel operations. Every response must have a consistent and low latency or the overall operation response time will be tragically slow.”

    In other words, the slowest operation in a set of parallel operations usually defines the user experience. It doesn’t matter that 99% of the operations finish quickly if the other 1% holds everything up. This explains why it’s not enough to keep p95 latencies blazing fast. You have to keep long-tail latencies (p99 and up) consistently low as well.

    Causes of Long-tail Latency

    To fix the problem of long-tail latency, we need to understand why it occurs. Long-tail latency has many causes, but, significantly, it is not usually caused by application-specific problems or normal network lag. Instead, long-tail latency has systemic causes, usually related to problems in the underlying infrastructure. These can include pauses due to Java Virtual Machine (JVM) “garbage collection,” context switches, database repair, cache flushes and so on. This makes long-tail latency very tricky to diagnose and fix, as it’s often a “whack-a-mole” exercise.

    Disk I/O and Network Bottlenecks

    The main causes of long-tail latency are network and system bottlenecks. IT commonly invests heavily in the best components available: great solid-state drives (SSDs, and associated NVMes), CPUs and memory. But it often shoots itself in the foot by configuring a “narrow” network that bottlenecks all that highly performant hardware.

    SSD settings are also commonly misconfigured. Cloud SSDs have two associated throttles: burst and sustained. Background operations such as streaming and compaction can chew up the sustained throughput, which may be 1/10 of burst. While the backend process hogs I/O, there is no capacity left for frontend, user-induced operations. While some transactions will be able to use the burst capacity,  the steady-state frontend traffic will start backlogging and eventually time out.

    Speed Mismatch

    Database performance is strongly influenced by the combined speed of CPU and memory on the one hand and disk speed on the other. CPU tends to be faster, while disk tends to be slower. SSDs are catching up with CPUs, but the rule still generally holds.

    Speed mismatch is a more common problem with write workloads bounded by disk speed. This can happen either because the disk is slow or because the payloads are large. Large payloads shift the bottleneck to the disk. When the time comes to write to disk, any relative disk slowness will cause queries to back up in the buffer. This will result in outlier p99 latencies.

    Exceeding Your Latency Budget

    Every system is designed with a “latency” budget, which is the ratio of latency to throughput. p95 and p99 latency are a function of the throughput a given system is designed to support. You can think of this ratio in terms of highway traffic and throughput as the number of lanes on the highway. More lanes mean that the highway can support more vehicles, and hence more trips. That’s throughput. Latency is defined by the speed limit. Having many lanes combined with a slow top-speed reduces the overall number of trips. The ratio between the two defines the latency budget.

    Ideally, if you just add more throughput you should be able to reduce latencies, right? Well, not necessarily. Just like traffic on freeways can expand to fill an extra lane, still leaving you stuck in a traffic jam, you can easily overwhelm systems that weren’t designed well to begin with, even if you try to add more throughput. In fact, trying to add more throughput can degrade all of your latencies. In the routing world, that sort of poor architectural consideration is called bufferbloat.

    If a system is trying to add too much throughput while other bottlenecks still exist in a system, then you only end up with longer latencies, even to the point of transactions timing out. That can exacerbate a bad situation since all failed transactions will attempt one or more retries.

    Systems that handle big data have several considerations. These include the most obvious hardware-oriented factors; storage (the reason why NVMe SSDs are widely prevalent these days, for example), CPU cores, memory (RAM) and network interfaces.

    Modern servers running on Intel Xeon Scalable Processor Platinum chips are common across AWS, Azure and Google Cloud. Server needs are based upon how much throughput each of these multicore chips can support.

    Additional considerations get into how your database system was designed to handle data distribution and replication for high availability, peer-to-peer versus leader/follower designs, how it minimizes hops and redirects between servers, effective use of caching, how it efficiently it utilizes all the hardware available to it and so on.

    These are all components that define a system’s latency budget. It’s important to understand and stay within those limitations. When they are exceeded, outlier latencies are virtually assured to occur.

    Latency and the Database

    So far we’ve treated long-tail latency as a systemwide phenomenon. Now let’s consider the role of the database. Most HTTP and API requests result in at least one, if not more, database calls, often a mix of reads and writes. Hence, the database plays a central role in the end user experience of latency.

    NoSQL databases were invented specifically to address the need for low-latency, globally distributed data stores. The basic premise of the NoSQL database is the ability to “scale out” on cheap, commodity hardware. When more capacity is needed, administrators simply add servers to database clusters. This simplicity, however, has morphed into a vulnerability. Clusters often grow out of control, resulting in a phenomenon called “node sprawl.” The architecture of the first-gen NoSQL databases actively encourages larger clusters of less powerful machines. From the perspective of latency, this architecture virtually ensures inconsistent p99 performance due to more internode traffic, context switches, disk failures and network hiccups, all of which create latency outliers.

    One database that is particularly susceptible to this problem is Apache Cassandra. First, Cassandra is implemented in Java, making it vulnerable to pauses caused by garbage collection (GC). Some monitoring teams even have a dedicated metric devoted to GC stall percentage. Compaction and repair operations, which become more onerous in larger clusters, add to the outliers that plague Cassandra deployments.

    Second, Cassandra has limited ability to utilize modern hardware for compaction and streaming. Since Cassandra is an “append-only’ system, keeping data coherent for reads requires a compaction process. Servers with a large number of cores are readily available on public clouds, IaaS and for on-prem deployment. However, Cassandra can’t scale compaction linearly with the increased number of available cores, so it cannot effectively utilize those larger servers. This limitation results in higher read latency due to the need to deploy many more smaller servers in the clusters.

    Since Cassandra exposes settings for storage media, JVM heap cache and concurrency on read and writes, the burden is placed on administrators to properly configure the system for specific workloads. When workloads are unpredictable and spiky, administrators must constantly tune the Cassandra cluster to optimize read and write latencies.

    Many IT organizations turn to external caches as an aid to insulate end users from the poor long-tail performance of their databases. Caches are often used to enhance read performance but write latencies derive little or no benefit. Transactional systems, which depend on real-time performance, cannot drop mutations, so caches offer no help. Transactional systems depend on low long-tail latency for writes as well as reads. If spikes are too frequent, the client experience deteriorates, becoming very sluggish.

    Still, front-end cache for reads is often a necessary evil, to the point where it is treated as obligatory. However, maintaining coherence between cache and persistent storage is a well-documented hassle that can easily bog down operations and negatively impact customers. The best approach is to identify a system that intrinsically combines cache and persistent storage in a way that optimizes performance and data integrity.

    Winning the Battle for Consistently Low Long-Tail Latency

    With these issues in mind, there are a number of guidelines your organization can follow to minimize long-tail latency.

    • Design a system that ensures the lowest p99 latency based on your organization’s current and future throughput targets.
    • Don’t ignore performance outliers. Embrace them and use them to optimize system performance.
    • Reduce the number of components in your architecture, from redundant cache systems to bloated hardware infrastructure. Shrink database clusters by scaling vertically on more powerful hardware.
    • Adopt database infrastructure that scales linearly with your resources: CPU, memory, storage, network and number of nodes in the cluster.
    • When using database-as-a-service (DBaaS) offerings, look out for “scaling bloopers”—points at which you can’t scale linearly and have to increase spending beyond the marginal benefit you get from the system.
    • Make sure your DBaaS vendor can offer multi-region deployments, so you can utilize the offering near your application, eliminating long-haul data traffic. While this will not reduce latency within a database, it will reduce end-to-end database latency between the database and the client application.

    Latency often gets short-shrift in IT calculations because it’s so poorly understood and so badly measured. But you can’t ignore it. It does its damage whether it’s recognized or not (and the less you recognize it, the worse damage it does). Luckily, as we’ve seen, there are good ways to measure latency and squash it down to size. With the right metrics and an informed strategy, businesses can turn what used to be a fearsome adversary into a customer-experience advantage.

  • Report: SD-WAN Shift to the Cloud Accelerates

    Report: SD-WAN Shift to the Cloud Accelerates

    The rate at which software-defined wide area networks (SD-WANs) are being consumed as a cloud service appears to be accelerating in the wake of the COVID-19 pandemic.

    A global survey of 750 IT professionals conducted by the market research firm Vanson Bourne on behalf of Barracuda Networks finds over half of respondents (52%) are looking to acquire an SD-WAN solution via a cloud provider, with Microsoft Azure being cited as the most preferred option.

    Only 16% said they prefer an SD-WAN from an independent vendor, while 15% would opt for a telecommunications provider. Another 12% said they would rely on a reseller.

    Klaus Gheri, vice president of network security for Barracuda Networks, said the survey suggests that as application workloads move into the cloud, more IT organizations want to centralize acquisition of networking services alongside compute and storage. As such, he said, providers of SD-WAN appliances such as Barracuda Networks will need to evolve to extend the basic SD-WAN capabilities provided by cloud service providers.

    At the same time, Gheri noted that way applications are being accessed is also evolving as more employees are working from home. Rather than directly accessing applications running in a local data center or office, many organizations are routing access requests to those applications through their cloud service provider. That approach reduces costs by using a public internet connection to access to cloud service, which then routes that request over a virtual private network (VPN) to a local data center.

    Given the egress charges a cloud service provider requires, that approach may not reduce costs in the case of every workload. However, it may reduce costs by reducing the amount of network traffic moving across a leased MPLS line, he noted.

    Gheri said the rise of the cloud as a networking conduit illustrates how varied SD-WAN implementations have become. Organizations increasingly need some capability at the client level to automatically determine which network path makes the most sense for any request based on cost and latency requirements.

    In the meantime, frustrations with VPN clients continue to mount. Most VPN implementations were designed to support a small percentage of employees for occasional access. With more employees working from home more frequently, many organizations are reconsidering their SD-WAN strategies. In addition to being able to scale services more easily, Gheri noted SD-WANs also afford organizations the opportunity to implement zero-trust networking services to better isolate application environments in the event of a security breach.

    Over the last few years, SD-WANs have been one of the fastest-growing categories in IT. The Barracuda survey found 23% of respondents have already deployed SD-WAN, with another 51% either in the process of deploying or expecting to deploy one within the next 12 months.

    Clearly, competition between cloud service providers, telecommunication carriers and independent providers of SD-WAN services will intensify in the months ahead. The challenge facing IT teams now is determining to what degree they want to be directly involved in managing SD-WAN networks versus simply consuming SD-WAN services on an as-needed basis.

  • F5 Networks Surfaces Application Insights

    F5 Networks Surfaces Application Insights

    F5 Networks, at its Agility 2020 online event today, unfurled Beacon, a software-as-a-service (SaaS) platform that enables IT teams to better monitor and troubleshoot applications using telemetry data collected from networking equipment from both F5 and third-party sources.

    In addition, the company announced an update to NGINX Controller that enhances application analytics along with improvements to the declarative application programming interfaces (APIs) that NGINX Controller provides.

    Finally, F5 Networks unveiled an update to BIG-IQ, a set of tools for managing application services delivered via its network operating system. Version 7.1 of BIG-IQ adds visibility into legacy application services, streamlines management workflows and adds security management functionality.

    Hitesh Patel, senior director of product management for automation, orchestration and ecosystems at F5 Networks, said all three offerings are part of an ongoing effort to make it easier for IT organizations to meld network operations (NetOps) and best DevOps practices. Beacon, for example, ingests telemetry data streams from multiple sources to provide visibility and surface actionable insights via an application-centric view of the IT environment, he said, adding that approach makes it easier for NetOps and DevOps teams to collaborate.

    A companion Beacon Insights tool can be employed to detect anomalies and run analytics to determine the root cause of an issue, he said.

    Patel noted as IT environments become more complex, the need to eliminate silos that make managing IT holistically has become more pressing. For example, modern applications based on microservices are especially difficult to manage across an increasingly distributed computing environment.

    Less clear currently is how much or even whether DevOps and NetOps teams will merge. Network resources increasingly are being exposed via APIs that developers can programmatically invoke to provision resources. However, many IT teams are trying to control how much network bandwidth is allocated to any given application. As a result, many NetOps teams are setting up portals through which DevOps teams are given access to a maximum amount of bandwidth for specific sets of applications.

    On the plus side, Patel noted that as applications become more instrumented, thanks in part to the rise of DevOps, it’s becoming easier to apply analytics. That capability makes it easier for developers and NetOps teams to troubleshoot issues using a common set of metrics and dashboards that can feed data back to a continuous integration/continuous delivery (CI/CD) platform, he said.

    It may be a while before each IT organization finds the optimal level of convergence between their respective DevOps and NetOps teams. However, as applications become more distributed in the age of the cloud, networking will have a greater impact on application performance. The trouble is, most DevOps teams aren’t sure whether application performance issues are the result of the code written by developers or the latency being introduced by the network. Whatever the root cause, many IT teams are spending an inordinate amount of time trying to determine the root cause of application performance issues.

  • LF Edge Moves Open Networking Push Forward

    LF Edge Moves Open Networking Push Forward

    A vendor-neutral initiative dubbed the State of the Edge was acquired this week by LF Edge, an arm of The Linux Foundation focused on defining an open source stack of software for edge computing applications.

    The State of the Edge project will be merged with the existing Open Glossary of Edge Computing initiative that LF Edge already had in place. That combined initiative will now be known as the State of the Edge project within the larger umbrella of LF Edge projects.

    State of the Edge was launched by Vapor IO, Arm, Rafay Systems, Packet by Equinix and Edge Gravity by Ericsson to provide free research reports. Arpit Joshipura, general manager for networking, edge and Internet of Things (IoT) for The Linux Foundation, said that mission will continue as part of a larger effort to advance open software-defined networking software.

    The goal is to define stacks of software and implementation blueprints that will make it simpler for both telecommunications carriers and enterprise IT organizations to implement open source networking software both at the edge and in the cloud, said Joshipura.

    That’s critical because as IoT continues to evolve it’s apparent that IT and operations technology (OT) teams will converge, he added, noting the challenge is enabling organizations to achieve that goal around using a suite of programmable open source platforms that are truly interoperable with one another.

    Existing LF Edge projects include Akraino Edge Stack, an edge computing platform; Baetyl, a cloud-based management platform; EdgeX Foundry; a framework for sharing data between devices; Fledge, a set of application programming interfaces (APIs) for common administrative tasks; Home Edge, a platform for deploying consumer applications; and Project EVE, a virtualization engine.

    Interest in building and deploying applications at the network edge is on the rise in anticipation of 5G wireless networking services becoming widely available. Most of the organizations building those applications will be relying on best DevOps practices to achieve that goal. Less clear for now is the degree to which traditional network operations will be rolled up into those DevOps practices. The more programmable the networking environment becomes the more control each developer theoretically can have over the network services being accessed by their applications. However, network bandwidth is often a finite resource; there most likely will need to be some governing mechanism that determines how much network bandwidth any one application would be allowed to access at any given time.

    Of course, the open source community is not the only entity eyeing the rise of edge computing. Providers of commercial networking platforms ranging from Cisco Systems to VMware are all focused on enabling edge computing applications. Historically, open source platforms such as OpenStack have been embraced by carriers. However, within enterprise IT environments open source networking platforms have not gained much traction. The open source community will need to galvanize around a set of platforms and blueprints for edge computing platforms quickly. Otherwise, many organizations will most likely turn once again to commercial networking platforms to provide services to edge computing applications.

    — Mike Vizard

  • Cato Networks Offers Instant SD-WAN Service

    Cato Networks Offers Instant SD-WAN Service

    Cato Networks has added an instant-on capability to its software-defined wide area network service (SD-WAN) service to make it easier for IT teams to provide employees with remote access to applications.

    Dave Greenfield, technology evangelist for Cato Networks, said rather than having to configure and install a virtual private network (VPN) client on every device to access applications, IT teams can simply share a URL to provide network access via a single sign-on protocol without requiring client software. At a time when many IT teams are scrambling to allow every employee to work at home to help combat the spread of the COVID-19 coronavirus, the Cato Software Defined Perimeter (SDP) service provides an alternative approach to achieve that goal at scale, he said.

    The Cato SDP network is an instance of a global SD-WAN service co-managed by Cato Networks. IT teams still control who gains access to what applications using multifactor authentication, while Cato Networks manages the underlying network and security infrastructure, including all the firewalls and endpoint protection software. As such, Greenfield said, Cato SDP is one of the first instances of a service based on what Gartner is now describing as a secure access service edge (SASE) architecture.

    Greenfield said trying to scale access using legacy VPN software is problematic because it requires IT teams to acquire more software licenses and bandwidth, while end users are provided with passwords to access the corporate network, which can be easily hacked. And, perhaps most problematic, most VPNs limit the number of simultaneous users allowed on the network.

    Cato SDP provides access to a zero trust network environment that only provides access to applications that end users have been specifically authorized to use, said Greenfield, noting all of that can be accomplished in as little as 10 minutes.

    Cato SD-WAN

    Since the beginning of the COVID-19 outbreak, Greenfield said Cato Networks has seen a sharp increase in usage of its global network, which consists of points-of-presence residing in third-party data centers distributed around the world. This setup makes it possible to optimize application experiences based on where end users are physically accessing the internet.

    It may be a few months to as long as two years before the COVID-19 pandemic subsides. What today may be viewed as a singular disruptive event could very well be a harbinger for how organizations will need to work from now on. Even once IT teams get everyone in their organization up and running from home, many of them will have to ask themselves how long they are prepared to manage IT as a remote service. The emergence of SASE-based services provides an alternative co-managed approach that allows IT teams to rely on an external service provider without having to give up control over their applications to a managed service provider (MSP).

    Naturally, it may be a while before the current crisis subsides enough for organizations to realize they may need to fundamentally change the way they consume IT. The only thing that is for certain right now is that conversation is all but inevitable.

    — Mike Vizard

  • Best of 2019: Critical Skills Developers Need to Avoid Getting Left Behind

    Best of 2019: Critical Skills Developers Need to Avoid Getting Left Behind

    As we close out 2019, we at devopsy.kinsta.cloud wanted to highlight the five most popular articles of the year. Following is the second in our weeklong series of the Best of 2019.

    Burnout is a recurring theme at DevOpsDays events around the world. The modern developer faces constantly and rapidly-evolving challenges: the agile movement reducing the development lifespan, the DevOps movement shifting production operational responsibilities into development processes and the complexity of cloud offering new architectures from SaaS through to FaaS, as well as microservices.

    As these shifts occur, often ignored are the operational skills needed to support an application running in production. Developers expect to support production and be on call 24/7, but are IT leaders giving them the necessary tools and training? More and more, we need developers to be prepared and able to seamlessly oscillate between focused specialist and broad generalist. This article highlights a few key areas where software engineers need to bolster their skill sets to remain agile and effective in building applications.

    DevOps and SRE Assume Broader Skills

    Non-developers may interpret agile computing as developers creating a world where they get to code rather than document, follow process or deliver to plan. In reality, agile took the lengthy cycle of waterfall releases and replaced it with the frenetic continuous delivery of valuable software. DevOps was born from the need to deliver application updates rapidly and regularly.

    The monitor phase of the DevOps infinite loop originally focused on ensuring application problem detection and diagnosis was possible. Moving from detection to prevention, DevOps practitioners had to shift their testing and quality processes. Developers were asked to code the application, while also creating the testing systems to validate their code and building the production executables. Progress here led to additional responsibilities. As development moved to agile and DevOps, infrastructure transformed into software defined infrastructure (SDI).

    The separation of the operating system from the server hardware through virtual machines started the journey to SDI. Application containers removed the OS requirement and added cross-server mobility. Kubernetes and Docker Swarm allowed developers to encode application requirements in the recursively titled YAML. After containers, microservices is a further refinement that isolates an action into a separate piece of code—which is well suited for workload-based pricing of cloud environments. SDI’s capabilities bring us to where infrastructure definitions require a software development lifecycle (SDLC) of their own.

    The outcome of all this is a massive increase in complexity that developers must consider as they code components of an application. It requires additional considerations of the infrastructure and business environment the application will run in. Developers can define the best YAML definition of needs for their new application, but does not mean the production infrastructure will be able to provide a matching environment.

    Skills Developers Must Enhance

    Here are some key areas where developers would benefit from honing their skills in order to stay relevant amid growing complexities mentioned above.

    Networking

    The single purpose of computer networking is to move data from the memory of one computer into the memory of a different computer. With TCP/IP protocols as the default network stack, the flexibility needed to survive a nuclear attack comes with a lot of variability in configuration. At the basic level, network components must be configured to identify how many bits of an address to use when searching for another network entity via Classless Inter Domain Routing (CIDR).

    Software engineers need networking skills to understand how their software definitions may conflict with the eventual production network infrastructure. For instance, network definitions in the YAML descriptors for Kubernetes/Docker are generally set with a /nn configuration (e.g. /16). Conflicts arise when you overlap the pod addresses with physical server addresses or have a mismatch between development pods and production pods. If your pods-per-node count differs between pre-prod and prod environments, it is possible the CIDR settings will differ as well—as a colleague regrettably learned when using /8 rather than /16, leading to the largest production outage in their career.

    In addition to these basics of network addressing, there are concepts such as micro-segmentation needing definitions of performance and connection requirements that span across containers, virtual machines and bare metal servers.

    Security and Segmentation

    Historically, applications have relied on production infrastructures with their firewalls and DMZs for protection from the outside world. That castle moat approach is insufficient for today’s threat landscape where applications live everywhere. Not only do enterprises need to protect against outside connections and attacks, they also need to prevent accidental connections from production applications to development, QA and testing environments. Crossing the streams can cause exposure of production data in test environments and, even worse, corruption of production data.

    Ensuring that application components only communicate to specific services in specific environments is addressed with micro-segmentation and its ability to manage and monitor secure code-to-code communication. Control with this detail comes with its own challenges as incorrect or insufficient definitions could leave a production application unable to communicate with needed API’s or microservices. Making diagnosis in micro-segmented environments harder is the possibility that traffic for other transactions or applications may be successfully crossing the same environment. This is when you may hear the classic “it is working fine in test” response.

    Micro-segmentation offers significant security benefits yet requires developers to clearly identify the required connections and components of any communication. The best time to note this is while coding, making this an important skill for the modern developer.

    Dev and Ops Synchronicity

    The synchronous arrival of DevOps and SDI provides a mutual opportunity for developer and operations teams. While developers need to learn production on-call skills and operations teams need to learn SDLC skills, both teams also need to remain current in security concepts. Some organizations tackle DevOps by creating merged teams, though members may continue to stay in their lane. Whether merging teams, or maintaining separation, it is beneficial to hold brown bag sessions to share information and help educate each other. Ask your operations peers to talk about their three most common production issues and the three most popular tools they use.

    An important aspect of the application on-call generalist is having the right tool supporting them to effectively diagnose production outages and slowdowns. Whether developed as an in-house solution (with incumbent technical debt) or selected as a product, you will need something that can see from end-to-end and allow the code-centric software engineer to drill into databases, storage, networks and code components from an application point of view without having to learn siloed management and monitoring tools for each aspect of infrastructure.

    While individuals come into a DevOps transformation with I-shaped specialists, they must leave as T-shaped engineers, thus enhancing their value to current employers and helping their career.

    — Marco Coulter

  • Moving Things Around: The Acquisition of Protego

    Moving Things Around: The Acquisition of Protego

    I received a note from Protego Labs’ vice president of marketing about Check Point Software acquiring Protego. We see a fair number of acquisition announcements, and usually don’t write about them–though we read them and stay abreast of industry happenings.

    I used to follow Check Point, and haven’t looked into what they’re doing in a while, so I followed through links to both organizations and looked at their products.

    I found myself becoming the wizard that some call Tim. But instead of “What is your name? What is your quest? What is your favorite color?” I was looking into “Where is your site? What are your products? What value do you add?” My beard is kept trimmed, more along the lines of a knight’s, so it makes sense I would ask different questions. As long as I’m not spouting “It’s just a flesh wound,” I figure I’m doing okay.

    First off, this merger makes sense. Protego does it for serverless and Check Point is doing their best to be where your code is running. Indeed, Protego probably needed a merger of some kind because all they do is serverless. Check Point’s Cloud Guard Dome 9, by contrast, will protect access rights and data for serverless, but doesn’t do what Protego does–keep an eye on the code. So this is a good fit.

    But it once again brings to light an interesting issue as you move things from DC to cloud A to cloud B to serverless. Where are your support functions? Networking, security, storage…These things need to be where the code is, but architectural options are more than they’ve been for decades. And the architectures are largely incompatible. Consider network functions for a physical-server based DC versus a VM DC, versus a Container DC, versus Cloud…You get the idea. The array of functionality and where it runs is different. Different in implementation and different in maintenance.

    This was a problem I (and others) pointed out when cloud started taking off: more work for ops, even if some of it is automated. Turns out ops, storage management and security all have more work, because all of those items are handled differently in the different architectures. And Protego had to focus on one to get it right, meaning they needed some kind of merger in the long run.

    So do you. Adding more and more work to ops–be it DevOps or traditional ops–is not the answer. A plan for standardizing is necessary.

    That is one of the big promises of containers, in my opinion. Not only are they more agile and easier to use in a DevOps environment, they are relatively standardized. Ops will still have more work if you’ve got apps in several of those architectures, but containers obfuscate some of the differences and allow standardized networking within the pod/node/group, for example.

    Some functionality just doesn’t fit into containers–you still need a physical network in the DC, or to configure the virtual network in a VPC to get traffic to/from your containers–but much of it does fit. Once at the pod/group, networking is virtual and the same regardless of where the containers are running. Which reduces overhead while making changes easier. The same is true for security, and increasingly for storage.

    There are great companies out there tackling these issues, and I’ll look at them on occasion. Right now, I know my former employer F5 Networks is working to solve the networking services/performance/security issues, and taking advantage of NGINX to handle some parts the core org traditionally hasn’t addressed. There are other companies, I just hear about that one more because I am still very close to some F5ers.

    It is worth planning for and certainly worth looking into more portable options, anything that lightens the load and keeps your great apps running. Keep kicking rear and spinning up apps.

    And don’t call me Tim.

    — Don Macvittie