Key Criteria for Evaluating Cloud Networking Solutionsv1.0

1. Summary

Cloud networking software enables data transmission within and between clouds by deploying and orchestrating virtual network functions (VNFs). Cloud networking is entirely software driven, each virtual appliance playing a role in defining how the cloud entities communicate among themselves at a logical level, but also enabling connectivity across different data centers and cloud providers.

The virtualized nature of cloud environments, by which infrastructure is delivered as a service, does not allow cloud tenants the possibility of deploying hardware appliances like they do at on-premises data centers. Therefore, to enable networking in the cloud, providers have offered the virtual equivalent of appliances such as routers, firewalls, and load balancers. Within a cloud environment’s availability zones, these native tools allow users to logically define their virtual infrastructure estate and create policies that enable applications to communicate with each other without traversing the public internet.

While these cloud-native tools work fairly well within one provider’s environment, communicating across multiple availability zones, public clouds, private clouds, colocation, on-premises devices, and edge locations is difficult and hard to secure. Cloud networking providers enhance the capabilities of these native tools with better visibility, multi-cloud awareness, service insertion, granular controls, security, and third-party integrations. The cloud networking software we will be evaluating can be deployed in any one environment and can also enable communication among multiple environments.

Whether native or not, cloud networking software is, in essence, the software version of a traditionally physical appliance. It is a collection of VNFs. However, it must offer additional features as well, beyond network function virtualization (NFV), that make it suitable for cloud workloads. Such features include:

• Cloud awareness: The solution has visibility and control over the cloud providers’ data centers, regions, or availability zones.
• DevOps suitable: To enhance DevOps practices, cloud networking needs to leverage infrastructure-as-code tools, which can help to include networking as part of the CI/CD methodology.
• Application performance: The solution is designed to ensure application performance (and quality of experience) by operating at L7.
• Autoscaling: The solution can allocate and retract networking resources dynamically based on demand.

Additionally, modern solutions provide a centralized management platform that offers control over all of the customer’s cloud environments and on-premises data centers. The solution can either be interacted with via a graphical user interface (GUI), command-line interface (CLI), or application programming interface (API), or it can be integrated with infrastructure as code tools. The management solution can help as well with topological views, troubleshooting, performance monitoring, access controls, and compliance.

Security for cloud networking involves two facets: traffic filtering and secure access. For traffic filtering, we can employ VNFs such as firewalls, either as standalone devices or as part of transit gateways, to create segments and microsegments that isolate applications or databases. For secure access, we use access control lists, zero-trust network access, and multifactor authentication.