Lately, I’ve been requested a number of instances about what extra income alternatives might be unlocked with VMware vDefend, past its well-known and nicely adopted core Distributed Firewall (micro-segmentation) capabilities. This impressed me to write down this weblog — to discover the superior options and value-added providers that vDefend provides, and the way these might be leveraged by Cloud Service Suppliers (CSPs) to increase their cloud safety portfolio and drive new monetization fashions.
VMware vDefend Core base Functionality
- The basic providing is the Distributed Firewall (DFW) (typically additionally “Gateway Firewall”) — i.e. east–west plus north–south firewalling at a software program/hypervisor layer.
- It helps Layer 2-7 stateful firewalling, identity- and application-aware insurance policies, dynamic grouping of workloads, and so on.
- It’s tightly built-in with VMware Cloud Basis (VCF).
New Income Streams with VMware vDefend Superior Capabilities:
These are the extra options/capabilities past primary micro-segmentation that it’s best to take a look at so as to add to the safety providers providing portfolio:
- Gateway Firewall
- Along with DFW, there’s a “gateway” part for perimeter or segmented zone management (L2/3/4 firewalling at edge factors) as a part of vDefend
- Helpful for CSPs while you’re providing tenant isolation, controlling ingress/egress site visitors, and so on.
- Superior Risk Prevention (ATP) / IDS/IPS / NDR / Sandbox / Site visitors Evaluation
- The “vDefend Firewall’s Superior Risk Prevention” tier provides: IDS/IPS, community site visitors evaluation (NTA), sandboxing, community detection & response (NDR) capabilities.
- It is a key worth add for CSPs – you’ll be able to supply extra than simply segmentation, you’re providing risk detection, prevention and response.
- Safety Intelligence / Segmentation Evaluation / Analytics
- Options just like the “Safety Segmentation Report” that analyze flows to determine segmentation gaps, generate a segmentation rating, present rule suggestions.
- The “Safety Companies Platform (SSP)” – scale-out structure for safety intelligence and visibility throughout massive environments.
- That is notably helpful for CSPs since you’ve multi-tenant, massive scale, probably complicated workloads and wish to supply visibility dashboards and analytics as a part of the service.
- Container / Multi-workload Assist
- vDefend helps workloads not simply VMs, however containers, naked metallic, and so on.
- For CSPs that is vital should you’re supporting Kubernetes/containers, hybrid or multi-cloud workloads for patrons.
- Multi-tenant / Delegated Administration Capabilities
- Latest enhancements enable for “VPC-Conscious Lateral Safety” — capacity to use per-tenant or per-VPC insurance policies, with delegated administration for tenants/app homeowners.
- Self-Service Micro-segmentation: app homeowners can outline fine-grained insurance policies inside zones outlined by infra.
- For a CSP that is important: you wish to supply tenants self-service whereas sustaining central management/oversight.
- Geo-IP / Edge Controls
- Instance: Geo-IP filtering on the gateway firewall (enable/block by nation) for site visitors flows
- Helpful for compliance/regulatory or international CSP situations.
- Air-gapped / remoted atmosphere help
- The NDR functionality now helps environments that don’t hook up with public web for risk intelligence updates (vital for regulated/non-public CSPs).
What this implies for a CSP Choices
In case you are a CSP & evaluating functionality and contemplating vDefend as a part of your safety stack/service providing, it’s best to take into consideration:
- Which tier you wish to supply primary segmentation (DFW) vs full risk prevention (ATP/IDS/IPS/NDR).
- Tenant / multi-tenant wants: Do you want per-tenant segmentation, delegated admin, self-service, and so on. vDefend helps that.
- Scale & visibility: The analytics & intelligence modules are key for giant scale operations.
- Workload varieties: VMs, containers, naked metallic — should you help them, you’ll want the broader options.
- Compliance/regulatory: Insurance policies like geo-IP, offline risk intelligence updates, totally remoted operations.
- Automation/DevOps integration: Micro-segmentation as code, API-driven coverage creation, combine into CI/CD and so on.
- Gateway/Edge controls: Should you’re providing ingress/egress firewall or edge segmentation for patrons, be sure that the gateway firewall functionality is included.
Key Licensing Issues
- VMware vDefend single SKU, is bought as an add-on to VMware Cloud Basis (VCF) & contains all options.
Abstract
To maximise income, a CSP ought to concentrate on packaging these superior capabilities into differentiated service bundles & concentrate on promoting enterprise outcomes in the case of safety of the atmosphere with extra intgrated cloud working mannequin, past IaaS into managed safety providers.