arista.com

arista.com

Solution Brief

Solution Brief

Arista MSS provides four core services to successfully plan, deploy and operate microsegmentation at scale with a consistent operational

model from data center to campus and branch:

1. Endpoint identity and microperimeter tags

The first step in planning a microsegmentation strategy consists of binding endpoints, workloads, and even networks to specific

microperimeter tags. CloudVision MSS powered by Arista NetDL automates the management of microperimeters by connecting

to external sources and dynamically identifying and then tagging the endpoints and workloads. Arista MSS can connect to various

external sources like NAC systems, CMDBs, IPAMs and virtualization infrastructure management solutions.

2. “Zero Trust” policy planning with traffic map

Zero trust architecture principles require that all traffic on the network must be explicitly allowed by security policies. To create zero

trust policies, it is vital to have complete visibility into existing traffic flows on the network. This ensures that policies protect the right

resources while at the same time not impeding legitimate business-justified flows.

Arista MSS maps all the communications within and across different parts of the network and provides a set of recommended policies

to only permit trusted communications based on the observed traffic map.

3. Microperimeter enforcement in the network or redirect to Firewall

Arista MSS then distributes the zero trust policies to EOS-powered network switches. In turn, the switches can perform wire-speed

distributed enforcement themselves or redirect the traffic to a third-party firewall for stateful L4-7 inspection. Importantly, Arista’s

switch-based enforcement overcomes the challenges associated with traditional ACL-based segmentation such as TCAM exhaustion,

by leveraging an advanced tagging engine that optimizes hardware utilization and maximizes scalability. Furthermore, because the

tags are internal to a switch and are not shared across the network infrastructure, Arista MSS can seamlessly insert into any multi-

vendor network. This approach also avoids any proprietary protocols that force organizations into single-vendor networks.

4. Continuous Traffic monitoring and visibility of policy violations

Once the zero trust policies are deployed, MSS can monitor for policy violations and report on the specific flows dropped in the

network. This provides vital intelligence to the administrator to update the zero trust policies when valid, yet new, services are denied

as well as monitor specific endpoints that are attempting to violate traffic rules.