The Fat Pipe - All Packet Pushers Pods

More enterprises are moving application to or developing applications in the cloud, whether on premises or in public clouds such as AWS, Azure, and Google.

One problem is that each cloud has its own approach to networking, so trying to build a consistent networking strategy across multiple clouds becomes very difficult.

Today’s sponsor, Avi Networks, offers a next-generation ADC, load balancer, and Web application firewall, entirely delivered in software, that can run in a multi-cloud environment.

The software has two key components: a controller for global configuration and management, and service engines that are deployed in private and public cloud instances. Avi Networks can work across clouds while being managed from a central console.

On today’s show we talk about why enterprises are adopting a multi-cloud strategy, and how Avi Networks can help customers ensure application delivery, provide security, and enable automation at scale across multiple cloud environments.

Our guest is Steve Allie, Director of Systems Engineering for North America at Avi Networks.

Show Links:

Avi Networks

Multi-Cloud Load Balancing: Separating Fact from Fiction – Avi Networks Blog

The following text is a transcript of the audio you can listen to in your podcatcher or the web player.

Welcome to Briefings In Brief, an audio digest of IT news and information from the Packet Pushers, including vendor briefings, industry research, and commentary. I’m Ethan Banks, it’s September 13, 2018, and here’s what’s happening. I had a briefing with Amy Ariel, CMO and Etay Bogner, CEO of Meta Networks today.

Who’s Meta Networks?

Meta Networks is a remote access network provider. If you currently manage your own VPN concentrators or firewalls so that your remote workers can access the network, Meta Networks is a Network-as-a-Service alternative to that traditional VPN architecture familiar to many of us.

In this briefing, Meta Networks discussed their…

New Partnership With Talari

Talari is an SD-WAN provider for enterprises. Meta is providing remote access. Therefore, what you’ve got with the Talari/Meta partnership is a full-featured WAN solution. Talari provides the SD-WAN part, and Meta provides the software defined perimeter part. (That’s right, folks…software defined perimeter is a category now.)

How Does All Of This Work?

First, I’m going to assume you have a sense of what SD-WAN is all about. Your wide area network, multiple circuits terminated on a forwarding device at each of your sites, optimizing traffic in accordance with a policy you’ve defined. That includes forwarding traffic between branch offices and headquarters, as well as traffic to and from the cloud and cloud-based services.

SD-WAN, such as what Talari has, doesn’t usually give you remote access capability. You still need a VPN service for that. Enter Meta Networks.

Meta’s got a Network-as-a-Service. As a Meta Networks customers, you get a virtual network that assumes zero-trust. That is, a Meta network isn’t just about access. It’s also about strict policy control. That means that endpoints don’t get access to something on the network just because they connected and authenticated successfully. Rather, a network administrator sets a policy defining exactly what resources endpoints have access to. Meta tracks user identity of each remote endpoint based on the IPSEC overlay tunnel connecting it to your virtual Meta network.

Meta describe their network as a “sun” architecture. Think of that big bright thing in the sky that you sometimes see when leaving a data center to get coffee or go out for lunch. Meta imagines the sun as a ring connecting all of their global POPs together. Endpoints connect to the sun, like rays of light. Endpoints could be laptops or a device at your headquarters office. Or a Talari SD-WAN box.

Meta Described The Partnership As At Stage One

The integration is not very tight as yet. You’ll be managing a security policy for remote access users on the Meta side, and a network policy for your wide area network on the Talari side.

The magic here is the connection between your Talari appliances and your Meta Networks virtual network, giving you some traffic optimization to cloud for your remote access users, as well as secure access everywhere. A good way to think about what you end up with is an interconnected, remote access, wide area network that caters to security-conscious shops spread out over a large geographic area.

You’ll work with channel partners to bring the combined solution to life.

For More Information

…about these solutions, go to metanetworks.com and talari.com. You can also do a search on packetpushers.net for Meta Networks as well as Talari, where you can find more podcasts and articles we’ve created about these companies.

The following text is a transcript of the audio you can listen to in your podcatcher or the web player.

Welcome to Briefings In Brief, an audio digest of IT news and information from the Packet Pushers, including vendor briefings, industry research, and commentary. I’m Ethan Banks, it’s September 13, 2018, and here’s what’s happening. I had a briefing with Amy Ariel, CMO and Etay Bogner, CEO of Meta Networks today.

Who’s Meta Networks?

Meta Networks is a remote access network provider. If you currently manage your own VPN concentrators or firewalls so that your remote workers can access the network, Meta Networks is a Network-as-a-Service alternative to that traditional VPN architecture familiar to many of us.

In this briefing, Meta Networks discussed their…

New Partnership With Talari

Talari is an SD-WAN provider for enterprises. Meta is providing remote access. Therefore, what you’ve got with the Talari/Meta partnership is a full-featured WAN solution. Talari provides the SD-WAN part, and Meta provides the software defined perimeter part. (That’s right, folks…software defined perimeter is a category now.)

How Does All Of This Work?

First, I’m going to assume you have a sense of what SD-WAN is all about. Your wide area network, multiple circuits terminated on a forwarding device at each of your sites, optimizing traffic in accordance with a policy you’ve defined. That includes forwarding traffic between branch offices and headquarters, as well as traffic to and from the cloud and cloud-based services.

SD-WAN, such as what Talari has, doesn’t usually give you remote access capability. You still need a VPN service for that. Enter Meta Networks.

Meta’s got a Network-as-a-Service. As a Meta Networks customers, you get a virtual network that assumes zero-trust. That is, a Meta network isn’t just about access. It’s also about strict policy control. That means that endpoints don’t get access to something on the network just because they connected and authenticated successfully. Rather, a network administrator sets a policy defining exactly what resources endpoints have access to. Meta tracks user identity of each remote endpoint based on the IPSEC overlay tunnel connecting it to your virtual Meta network.

Meta describe their network as a “sun” architecture. Think of that big bright thing in the sky that you sometimes see when leaving a data center to get coffee or go out for lunch. Meta imagines the sun as a ring connecting all of their global POPs together. Endpoints connect to the sun, like rays of light. Endpoints could be laptops or a device at your headquarters office. Or a Talari SD-WAN box.

Meta Described The Partnership As At Stage One

The integration is not very tight as yet. You’ll be managing a security policy for remote access users on the Meta side, and a network policy for your wide area network on the Talari side.

The magic here is the connection between your Talari appliances and your Meta Networks virtual network, giving you some traffic optimization to cloud for your remote access users, as well as secure access everywhere. A good way to think about what you end up with is an interconnected, remote access, wide area network that caters to security-conscious shops spread out over a large geographic area.

You’ll work with channel partners to bring the combined solution to life.

For More Information

…about these solutions, go to metanetworks.com and talari.com. You can also do a search on packetpushers.net for Meta Networks as well as Talari, where you can find more podcasts and articles we’ve created about these companies.

Today’s Priority Queue was recorded live in August 2018 at the Future:Net conference at VMworld 2018.

Greg Ferro and Ethan Banks interview Bruce Davie, VMware’s VP & CTO, VMware Asia Pacific & Japan; and Guido Appenzeller, VMware’s CTO, Cloud and Networking.

The Packet Pushers and their guests discuss:

* Whether blockchain has legitimate enterprise uses

* Key differences between multi-cloud and hybrid cloud deployments

* The difficulty of day-2 operations in cloud deployments

* The bifurcation of networking into the underlay and overlay

* What needs to happen to bring intent-based networking from vision to reality

* VMware’s notion of the self-driving data center

* Why security needs to be a feature, not a product

This episode peeks at the promises of new and emerging ideas in networking, but with a practical eye for the realities of real-world operations, and a bit of push-back on grand visions.

This Priority Queue was recorded live at the Future:Net conference at VMworld 2018. Guests Bruce Davie and Guido Appenzeller discuss service meshes, differences between hybrid and multicloud, intrinsic security, intent-based networking and more.

Today's fully caffeinated Network Break episode examines an Azure outage, a NIST specification for BGP security, eBay's open-source server design, and more tech news. Then stay tuned for a sponsored Coffee Talk with 128 Technology on session-oriented routing.

The following is a transcript of the audio you can listen to in your podcatcher or the player above.

I had a briefing with Ian Eyberg, CEO of NanoVMs today.

Who is NanoVMs?

NanoVMs makes software to help you create and deploy unikernels. In this briefing, Ian discussed with me the state of the unikernel ecosystem and how NanoVMs fits into things.

Quick context for you if you don’t know what a unikernel is. Quoting from unikernel.org, “Unikernels are specialised, single-address-space machine images constructed by using library operating systems. They are built by compiling high-level languages directly into specialised machine images that run directly on a hypervisor, such as Xen, or on bare metal.”

A big point with unikernels is that of security. Since unikernels are single process with a minimal attack surface, they aren’t interesting targets for hackers. A hacker can’t do anything with a unikernel, even if they were to find a vulnerability.

If that context didn’t help, search for datanauts + unikernels for several podcasts we’ve recorded on the subject.

Let’s jump back to the conversation I had with Ian.

One point Ian made was that unikernels, even though you haven’t been hearing much about them lately, are seeing a lot of interest and adoption. Unikernels are in production in shops both large and small, and there are several startups in the space.

That said, there are some barriers to unikernel adoption, the main one being that they are a challenge to work with if you come from a typical operations background. You gotta create the unikernel before you can deploy it, and making a unikernel isn’t like firing up apt-get and installing all the stuff you need into an base operating system until you get to a golden image.

Instead, unikernel creation requires working with source code and binaries, compiling everything required for the machine image to run. That’s a knowledge gap for many operators, as most of us aren’t really systems-level people. We work above that layer.

This is at the core of what NanoVMs helps with–handling that system level work that’s required to make a unikernel so that anyone could do it using their GUI.

Speaking of their GUI,

I did get a passing glance at it at VMworld in late August. Ian was there at the NanoVMs booth, and I did an on-the-spot interview with him for our YouTube channel, so Google Ian Eyberg and Packet Pushers if you want a distant look at the GUI through the lens of our camera.

In addition to helping you create unikernels,

NanoVMs helps you deploy them.

Maybe you’re equating unikernels with just a different sort of container, and thinking that you’d rather use Kubernetes for unikernel deployment than NanoVMs tooling. Ian pointed out to me that while unikernels have many parallels with containers, they are different beasts.

Kubernetes is very good at container orchestration, but not optimized for unikernel orchestration. You’d actually be incurring a needless performance penalty using K8s to deploy unikernels. So, sure…you COULD integrate NanoVMs with a Kubernetes environment, but Ian is pretty sure you don’t actually want to do that.

Furthermore, the unikernel orchestration process will vary depending on the unikernel use case. Unikernels are finding uses in IoT, embedded systems, NFV, edge computing, and cloud infrastructure. Those use cases differ dramatically, meaning a different sort of orchestrator might be appropriate in each. Kubernetes isn’t a fit everywhere.

Another issue I raised with Ian about the barriers to unikernel adoption ...

The following is a transcript of the audio you can listen to in your podcatcher or the player above.

I had a briefing with Ian Eyberg, CEO of NanoVMs today.

Who is NanoVMs?

NanoVMs makes software to help you create and deploy unikernels. In this briefing, Ian discussed with me the state of the unikernel ecosystem and how NanoVMs fits into things.

Quick context for you if you don’t know what a unikernel is. Quoting from unikernel.org, “Unikernels are specialised, single-address-space machine images constructed by using library operating systems. They are built by compiling high-level languages directly into specialised machine images that run directly on a hypervisor, such as Xen, or on bare metal.”

A big point with unikernels is that of security. Since unikernels are single process with a minimal attack surface, they aren’t interesting targets for hackers. A hacker can’t do anything with a unikernel, even if they were to find a vulnerability.

If that context didn’t help, search for datanauts + unikernels for several podcasts we’ve recorded on the subject.

Let’s jump back to the conversation I had with Ian.

One point Ian made was that unikernels, even though you haven’t been hearing much about them lately, are seeing a lot of interest and adoption. Unikernels are in production in shops both large and small, and there are several startups in the space.

That said, there are some barriers to unikernel adoption, the main one being that they are a challenge to work with if you come from a typical operations background. You gotta create the unikernel before you can deploy it, and making a unikernel isn’t like firing up apt-get and installing all the stuff you need into an base operating system until you get to a golden image.

Instead, unikernel creation requires working with source code and binaries, compiling everything required for the machine image to run. That’s a knowledge gap for many operators, as most of us aren’t really systems-level people. We work above that layer.

This is at the core of what NanoVMs helps with–handling that system level work that’s required to make a unikernel so that anyone could do it using their GUI.

Speaking of their GUI,

I did get a passing glance at it at VMworld in late August. Ian was there at the NanoVMs booth, and I did an on-the-spot interview with him for our YouTube channel, so Google Ian Eyberg and Packet Pushers if you want a distant look at the GUI through the lens of our camera.

In addition to helping you create unikernels,

NanoVMs helps you deploy them.

Maybe you’re equating unikernels with just a different sort of container, and thinking that you’d rather use Kubernetes for unikernel deployment than NanoVMs tooling. Ian pointed out to me that while unikernels have many parallels with containers, they are different beasts.

Kubernetes is very good at container orchestration, but not optimized for unikernel orchestration. You’d actually be incurring a needless performance penalty using K8s to deploy unikernels. So, sure…you COULD integrate NanoVMs with a Kubernetes environment, but Ian is pretty sure you don’t actually want to do that.

Furthermore, the unikernel orchestration process will vary depending on the unikernel use case. Unikernels are finding uses in IoT, embedded systems, NFV, edge computing, and cloud infrastructure. Those use cases differ dramatically, meaning a different sort of orchestrator might be appropriate in each. Kubernetes isn’t a fit everywhere.

Another issue I raised with Ian about the barriers to unikernel adoption ...

On today's Weekly Show the Packet Pushers update you on what's been happening behind the scenes at our Global HQ. That includes a new hosting provider, forthcoming Ignition content, and the launch of the IPv6 podcast. We also take a little time to talk about trying to stay mentally and physically healthy.

Today’s show is just Ethan, Greg and Drew having a chat.

We spend a little time discussing some behind-the-scenes Website activities, including migrating to a new hosting platform, making the transition to SSL, and rolling out Ignition.

We also preview some upcoming content on Ignition, and welcome the IPv6 Buzz podcast to its official channel.

The Packet Pushers crew went onsite at VMworld so we share what we were up to, including experimenting with video and attending VMware’s Future:Net sessions. We also riff on service meshes as the next holy grail in IT.

Last but not least, we talk about our struggles to stay physically and mentally healthy.