Definitive Guide to Hybrid Clouds, Chapter 7: Selecting the Right Cloud VAF and NDR Vendor

Originally published by Gigamon.

Written by Stephen Goudreault.

Editor’s note: This final post of this series explores Chapter 7 of the “Definitive Guide™ to Network Visibility and Analytics in the Hybrid Cloud.” Read Chapter 1, Chapter 2, Chapter 3, Chapter 5, and Chapter 6.

If you haven’t started investigating cloud visibility and analytics fabric (VAF) vendors, now is the time. A VAF, which centralizes and coordinates monitoring efforts through a single platform, can decrease complexity and eliminate tool sprawl, providing these benefits:

• Unified monitoring and control
• Integration with cloud provider APIs, enabling smooth automation
• Orchestration and DevOps integration, which empowers organizations to continuously monitor and keep up with changes in the operating environment
• Decreased complexity and cost, even as IT environments grow more diverse and complex
• Reduced application downtime with in-depth insight into traffic patterns and behaviors that can help improve planning and troubleshooting

That said, not all VAF vendors are equal, and there is a wide range of solutions to choose from. Dig in to Chapter 7 for a comprehensive analysis to help you make the best possible investment for your organization.

In the meantime, here is a quick checklist to jumpstart your research.

What to Look for When Selecting a VAF and Network Detection and Response (NDR) Solution

As you investigate the many solutions out there, here are some must-have capabilities to look for:

• Ability to acquire network traffic from a wide variety of sources and support a range of acquisition types, both physical and virtual
• Ability to accommodate physical networks that range in speed and traffic capacity
• Compatibility and integration with numerous on-prem and cloud-based environments
• Flexible cloud traffic acquisition strategy that includes workload agents, traffic mirroring, and centralized management and control of all tools and policies
• Partnerships and compatibility with other leading solutions and services, including network firewalls, software-defined networking infrastructure, network intrusion detection, SIEM solutions, SOAR systems, observability solutions, and network performance management tools
• Compatible with all major IaaS/PaaS cloud platforms (i.e., AWS, Google Cloud Platform, and Microsoft Azure)
• Coverage to private cloud environments built on all major platforms (i.e., Kubernetes, AWS Outpost, Azure Stack, Nutanix, OpenStack, and VMware)

Core Features Every Mature VAF and NDR Solution Should Have

Enterprises with rapidly changing infrastructure, applications, and operational practices should look for mature network monitoring platforms that offer these core features:

• Decryption of traffic, including SSL/TLS, and specifically TLS 1.3, which is rapidly gaining adoption
• De-duplication of packets before sending the remainder of data to analysis tools
• Flow slicing to improve monitoring efficiency
• Traffic filtering and forwarding based on configured policies to send relevant sessions to relevant tools
• Layer 7 intelligence built in to provide granular operational and security filtering and control
• Masking data within packets to protect data and meet compliance requirements
• Flow and meta-data (NetFlow/IPFIX/CEF) generation for any traffic flow
• Subscriber-aware visibility that offers 5G CUPS correlation, GTP correlation, SIP/RTP correlation and FlowVUE™ Flow Sampling capabilities

Figure 1: Enabling visibility across hybrid cloud infrastructures.