Extreme Fabric Connect: An invisible network

Customers often say that one of their greatest security concern is vulnerability to breaches. They admit that the major problem with their conventional network topology is that it can be easily mapped. Yes, it simplifies network management for them, but at the same time creates an easy attack platform for potential hackers.

This stems from the fact that most enterprise networks have evolved into a collapsed, routed backbone with multiple virtual interfaces providing connectivity to a variety of user segments. In practice, this is configured as multiple Virtual LANs (VLANs) servicing groups of users, each with a routed interface. The Layer 3 engines at the heart of the network populate tables with all known routes, creating a situation where any-to-any connectivity is the default behavior.

IoT devices are particularly vulnerable, since these devices lack the necessary built-in security to counter threats and they are not protected by firewalls. If you are using a flat IP network and someone breaches it, they can easily make their way to sensitive data like patient records, customer payment information or video surveillance servers, using some very common IP scanning mechanisms. Attacks can be launched from basically any point within or external to the network.

So the question is: how to defend against unauthorized lateral movement?

Extreme Fabric Connect handles traffic forwarding in a fundamentally different way than the traditional networks. Because fabric network is Ethernet-centric, its topology is completely invisible from an IP perspective. There are no inherent hop-by-hop IP paths to trace, therefore anyone running an IP hacking technique will only see a single hop to the egress of the network. Even if the Ethernet Switched Paths are breached, the end-to-end network topology always remains hidden.

Therefore, rather than conventional any-to-any, the entire basis of connectivity becomes one-to-one or a series of multiple ones-to-ones. In its simplest form – two devices communicating with each other over the backbone – connectivity is established by both being configured, only at the Fabric Edge, as members of the same VSN. Services, Layer 2 and Layer 3 VSNs, are a function of explicit provisioning, and communication between different services is blocked unless specifically enabled.

What’s more, Virtual Service Networks (or VSNs), which we talked about in the previous ‘Exploring the Fantastic Fabric’ entry, extend and retract dynamically only for the duration of a specific session – as assets, devices and users connect and disconnect from the network. When a user disconnects, residual service configuration is automatically removed from access edge switches, reducing back door entry points and potential network vulnerabilities. We call this “Service Elasticity”.

There's an old saying: "The best defense is a good offense". But in terms of network security, maybe we could rephrase it a little bit: the best defense is preventing the attack from happening in the first place!

On the most fundamental level, the concealment of network topology makes it almost impossible for hackers to move to sensitive areas of the network. Critical data and assets are not only protected from common IP scanning techniques or DoS attacks – potential breaches are contained, and the damage is minimized.

This is important for many organizations, especially from the public sector, who are required to comply with specific data protection standards like GDPR. The great thing about stealth networking is that it’s complementary to specialized service overlays, like PCI for financial transactions, or for data protection in healthcare, legal, and financial sectors.

                
Moreover, Service Elasticity simplifies provisioning, so it’s easier to protect IoT devices. IoT devices are often unattended and need to be deployed in real-time, without requiring an IT intervention. Extreme Fabric Connect removes the risk of a back-door entry point to the network, which can happen in a manually configured network.

But don’t just take our word for it – take Université libre de Bruxelles, for example. This major research university in Belgium once needed to solve a problem where all workstations had a public IP address. Thanks to hyper-segmentation (discussed in the previous entry) and stealth networking, the University managed to place surveillance cameras and IP telephony in a secure segment, separated from the users' internet traffic.

Has Extreme Fabric Connect caught your attention? Would you like to explore the solution in more technical detail?

Consider checking out our compact e-book ‘Fabric Connect Key Capabilities’ which provides an overview of the technology as well as breaks down useful features in the area of OA&M, infrastructure, services, routing, Data Center, Campus Edge and branch. Just click the button below! 👇

And in our next and final ‘Exploring the Fantastic Fabric’ article we will show you how to add more automation to your network security posture. Stay tuned!