![\"Retail](\"https:\/\/dmsretail.com\/RetailNews\/wp-content\/uploads\/2022\/05\/RETAIL-ONLINE-TRAINING-728-X-90.png\")
<\/a><\/p>\n<\/p>\n
In today\u2019s modern IT environment, most organizations leverage both the public cloud and private data center to house critical business applications. In many cases, these applications require communication with other applications to execute a particular need for the business. A common challenge among the customers I have spoken with is that they have applications in one environment that need to talk to applications in another environment, but they don\u2019t want to send that data directly over the internet.<\/p>\n
I don\u2019t blame them\u2014 enterprises want to minimize their internet exposure as much as possible, hiding internal apps away from the internet.<\/p>\n
Traditionally, organizations have leaned on dedicated connection (or cloud-native) services like AWS Direct Connect or Azure ExpressRoute to connect applications in the public cloud to the private data center. While these methods are high-speed options that facilitate connections between the public cloud and private data center, these connections are costly at scale, are not encrypted using IPsec, do not facilitate cloud-to-cloud connectivity, and require different configuration depending on the cloud environment.<\/p>\n
To solve these challenges, Cisco has released new multicloud networking capabilities enabling scalable, secure site-to-cloud<\/strong>\u00a0and cloud-to-cloud<\/strong> connectivity. These features use Cisco VPN code on the Multicloud Defense Egress Gateway and BGP routing for better connectivity across your cloud environment.<\/p>\n Customers can leverage multicloud networking from Cisco to build highly secure connections between applications and environments using a simplified architecture and workflow. This means organizations can easily connect applications from one environment to another at scale while also keeping operations in house to reduce cost. Our multicloud networking capabilities use widely adopted route-based VPN and BGP routing for secure connections and automated network advertisements. These multicloud networking capabilities can be described as:<\/p>\n To build site-to-cloud and cloud-to-cloud connections, customers would leverage Cisco Defense Orchestrator for establishing fully orchestrated and automated IPsec tunnels between environments. The platform uses BGP for optimized, resilient routing, allowing for the secure connection between the data center and the cloud (site-to-cloud) and between clouds (cloud-to-cloud).<\/p>\n When building a site-to-cloud connection, customers would use Cisco Secure Firewall (either physical or virtual appliance) at the data center edge and a Multicloud Defense Gateway at the cloud edge for the beginning and the end of the connection. For multicloud deployments that require cloud-to-cloud connectivity, multiple Multicloud Defense Gateways would be used. Site-to-cloud and cloud-to-cloud networking capabilities can be supported in both centralized<\/strong> and distributed<\/strong> security models.<\/p>\n The Multicloud Defense Gateway is based on a single-pass architecture and includes VPN code embedded in the data path pipeline. This enables direct termination of route-based IPsec VPN on the egress gateway. Route-based VPN is used with BGP routing for an automated CIDR advertisement. As soon as the IPsec tunnel is terminated on the egress gateway it advertises and learns all the networks using BGP, enabling automated traffic steering.<\/p>\n Cisco Multicloud Defense and Cisco Defense Orchestrator provide an automated way to build highly secure, full-automated VPN tunnels between data centers and cloud environments.<\/p>\n Figure 3<\/em> shows that on-premises Secure Firewall appliances (physical or virtual) are managed by Cisco Defense Orchestrator and the Multicloud Defense egress gateways are managed by the Multicloud Defense Controller.<\/p>\n Cisco Defense Orchestrator orchestrates VPN configuration on the on-premises firewalls as well as talks to the Cisco Multicloud Defense Controller using APIs. This API communication between Cisco Defense Orchestrator and the Multicloud Defense Controller enables the orchestration of VPN configuration on the Multicloud Defense egress gateway(s). This approach provides customers with fully orchestrated secure IPsec connections, enabling secure connectivity between the data center and the cloud.<\/p>\n Figure 4<\/em> shows how Cisco also supports site-to-cloud networking in a distributed security model using Cisco Defense Orchestrator, Secure Firewall, the Multicloud Defense Controller, and the Multicloud Defense egress gateway.<\/p>\n Cisco Multicloud Defense provides an automated way to build highly secure, full-automated VPN tunnels between cloud environments. IPsec tunnels are terminated on the Multicloud Defense egress gateways.<\/p>\n Figure 5 <\/em>shows the application VPC in AWS and the application VNet in Azure are protected using an egress gateway in the centralized deployment model. The Cisco Multicloud Defense Controller orchestrates IPsec VPN between egress gateways in Azure and AWS.<\/p>\n Figure 6<\/em> shows how Cisco also supports cloud-to-cloud networking in a distributed security model using Cisco Defense Orchestrator, the Multicloud Defense Controller, and multiple Multicloud Defense egress gateways.<\/p>\n The new multicloud networking capabilities add fully orchestrated VPN tunnels where IPsec tunnels are formed between networks advertised in the BGP domain. In addition to secure connectivity, customers need a way to enable threat-centric policies between source and destination subnets. To solve this challenge, Cisco is enabling common security objects across on-premises Cisco firewalls and Multicloud Defense Gateways with the new Hybrid Segmentation<\/strong> feature.<\/p>\n For the site-to-cloud connectivity use case, sharing network objects between Secure Firewall, Multicloud Defense, and Cisco Defense Orchestrator simplifies the hybrid segmentation policy creation process for administrators by pooling objects across into one centralized location. This reduces complexity, minimizes human error when creating new objects, and removes duplicative processes.<\/p>\n Now static network objects can be shared between Cisco Multicloud Defense and the Cisco Defense Orchestrator.<\/p>\n Figure 7 shows objects being shared between CDO and Multicloud Defense controller. Object \u201cdb\u201d <\/strong>is imported from the CDO and objects \u201capp1-aws\u201d & \u201capp2-aws\u201d are automatically synchronized from the Cisco Multicloud Cloud Defense Controller.<\/p>\n Now administrator can configure the following policies in CDO and the Multicloud Defense Controller:<\/p>\n In addition, to secure VPN connectivity features advanced threat security features can also be enabled on Multicloud Defense Egress Gateway.<\/p>\n Modern enterprises are becoming an increasingly complex spiderweb of connections between on-premises datacenters, branch locations, cloud VPCs, cloud regions, and cloud accounts. The traditional approach of doing direct connections between all the networks, or manually managing IPsec connectivity adds a lot of complexity. Cisco has brought together Cisco Defense Orchestrator, Secure Firewall, and Multicloud Defense to manage creating the connectivity across all the environments\u2014ensuring applications can reach the destinations they require. Through these capabilities, customers achieve greater control while reducing cost by bringing operations in-house. In addition to building secure connections, these solutions together also simplify policy creation for customers by way of network object sharing between environments\u2014reducing risk of human error when building policy and minimizing complexity across environments.<\/p>\n If you would like to learn more about how Cisco is driving further innovation across Cisco Defense Orchestrator, Secure Firewall, and Multicloud Defense, be sure to stop by the Innovation Zone at Cisco Live US 2024 or reach out to your Cisco sales representative!<\/p>\n Cisco Blog on Multicloud Defense Architecture<\/p>\n Cisco Multicloud Webinar<\/p>\n Cisco Multicloud Defense Whitepaper<\/p>\n Cisco Multicloud Defense Website<\/p>\n See how Cisco is leveraging Cisco Defense Orchestrator, Multicloud Defense, and Secure Firewall to securely connect apps from site to cloud and between clouds.<\/p>\n We\u2019d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Security on social!<\/em><\/p>\n Cisco Security Social Channels<\/strong><\/p>\n Instagram<\/strong> Share:<\/p>\n \n \t<\/div>\n![\"\"](\"https:\/\/storage.googleapis.com\/blogs-images\/ciscoblogs\/1\/2024\/05\/ctfyvguybtycrtxer.png\")
Why Multicloud Networking?<\/span><\/strong><\/h2>\n
\n
A Closer Look<\/span><\/strong><\/h2>\n
![\"\"](\"https:\/\/storage.googleapis.com\/blogs-images\/ciscoblogs\/1\/2024\/05\/fcghgvhjbxrte-1024x394.png\")
Site-to-cloud Networking<\/span><\/strong><\/h2>\n
![\"\"](\"https:\/\/storage.googleapis.com\/blogs-images\/ciscoblogs\/1\/2024\/05\/cfyvgubhivucyrtx-1024x446.png\")
![\"\"](\"https:\/\/storage.googleapis.com\/blogs-images\/ciscoblogs\/1\/2024\/05\/dfhgvjbhvgcfxd-1024x291.png\")
Cloud-to-cloud Networking<\/span><\/strong><\/h2>\n
![\"\"](\"https:\/\/storage.googleapis.com\/blogs-images\/ciscoblogs\/1\/2024\/05\/dxcgfhgvjfd-1024x428.png\")
![\"\"](\"https:\/\/storage.googleapis.com\/blogs-images\/ciscoblogs\/1\/2024\/05\/cfvgbhvcyrxt-1024x236.png\")
Hybrid Segmentation<\/span><\/strong><\/h2>\n
Static object sharing<\/span><\/strong><\/h2>\n
![\"\"](\"https:\/\/storage.googleapis.com\/blogs-images\/ciscoblogs\/1\/2024\/05\/dcfgvjhbgvfxdz-1024x518.png\")
\n
Conclusion<\/span><\/strong><\/h2>\n
Additional resources:<\/span><\/strong><\/h2>\n
Facebook<\/strong>
Twitter<\/a><\/strong>
LinkedIn<\/strong><\/p>\n