Video: Map Apps To Critical Infrastructure: How IP Fabric Automates Troubleshooting, Change Management, and Security Validation | Duration: 2168s | Summary: Map Apps To Critical Infrastructure: How IP Fabric Automates Troubleshooting, Change Management, and Security Validation

Transcript for "Map Apps To Critical Infrastructure: How IP Fabric Automates Troubleshooting, Change Management, and Security Validation": And that looks like us. We are now live. Awesome. Alright. So we'll, we'll just give it a little little while just to make sure that people are here. You recognize some of the names on the chat already, so it's all good. This will be something of interest to people. It's certainly something new and interesting for me. So Just give people... Where are we? Yeah. We're just giving giving thirty more seconds or so, and then we'll look at making a start. It's, it's funny with with, webinars, isn't it? They think... Never start bang on time because you know that people are just getting off a call or coming and joining. So I'm I'm exactly the same. Lots of friendly faces on the chat already. It's all good. Okay. Are you ready, Mike? If you... If so, we might just make a start. Yeah. Let's go. K. Cool. Well, thank you everybody for for coming and joining us, this afternoon in Europe. I think it's it's bright and early in the morning where where Mike is over the other side of the pond. So this this webinar where we're gonna talk a bit about, a new capability in IP Fabric. We call it application infrastructure mapping. And, I mean, this this kind of slide kinda gives it away what it's all about. We could probably just go home, to be honest with you. But what we wanted to do was dig a little into, what it is, why it is, how it works, and, and to give you a flavor of how you can use it, I suppose. I wanted to start with the the motivation, really, why it is that we we chose to do this. For those of you who know IP Fabric already, you'll know what we are and what we do. It's... We we talk the game about network assurance. This is all about understanding what a network does and being able to measure that and then and then compare that with the way that you wanted it to be. But what we wanna dig into a little is what we mean by intent in that sense. What what is it that's the intent for the network? As as a network practitioner, you know, what we do is we look at our network in terms of devices and cables, in terms of protocols and addresses, but every VLAN, every subnet, every firewall rule is there for a reason. It's almost like a fossil record of all of the changes that have happened through the network, and and they've been put there for a purpose. Sometimes we lose sight of what that purpose actually is. Now for me, it was always about making sure that the the the network was available. But what again does that mean? To a user, they do not care about things like VRFs or things like BGP. What they care about is something completely different. That the applications that they use are delivered. They're delivered securely, reliably, and fast because they have to service customers. And the customers are who give a business the money for the services that they're buying. Right? And it... And and, fundamentally, that's the the tension we're trying to address. The challenge is, of course, how do you map all of those network constructs, all of those things to the applications that service customers? Now in real network environments, what you have is a bunch of different teams looking after a bunch of different capabilities, across the IT stack. You've got the network people. You've got the server people. You've got the application people, the the load balancer people, the security people, all with different systems, all with different knowledge, and all with different documentation, trying to to to grasp how the whole, infrastructure hangs together to deliver these application services. Great example is security. Security is not just one thing. As you can see here, we talk about security in the network, which might be firewall rules and ACLs. You talk about security in the cloud, which is the security groups that will be applied to, to to groups of of workloads. And, of course, now you've got this this newer capability of of host security managed with these microsegmentation platforms. And it could be that an application sits on the network, and network's configured fine, and the cloud is configured just fine, but the host microsegmentation policy is not, configured correctly. How would you track that down? Well, you'd have to walk through every step, look at every different platform, and pull together all that information to know. What you need is one tool to bring all of that data together to correlate it, to reconcile that, and give you the whole truth. So that's what application infrastructure mapping is doing today to to IP Fabric. Again, if you know the platform, you know that we have the reality of the network in our data model already. We have the topology. We have the understanding of what it takes to to to trace a path through that topology. We know what security looks like in the network. We already have that discovered and in our snapshots. But what we're introducing is this ability to to add application context. So which workloads make up an application, how they interact, and what that... What those interactions look like, how many of... You know, if they're in parallel, if they're sequenced, whatever it is to understand how an application functions, and then to look at the the policy that's enforced as part of the application build right down to the host itself so we can, appreciate whether the host, firewalls themselves are allowing the traffic to pass. All of that, just to answer the one question, can this application work? And if not, why and what is stopping it? We wanna be able to bring all of that that knowledge together to give you the answer to that question. So what we're gonna do is we're gonna ingest application data into IP fabric, into this this, this AIM layer that that sits on top of the the, the network model. Right now, as of eight dot one, which was released, in the last couple of weeks, Illumio is our our first supported integration. This is a micro segmentation platform that has information about your application flows and about your workloads. So we're gonna pull the information through from Illumio natively. Point us at your Illumio instance, and we'll gather that for you. But as well as doing that, we've opened up an API, endpoint so you can script, your own import from any platform into IP fabric, and we have an... A manual import through the UI where you can literally import CSVs if you want to to to bring that application data, those flows, and those workloads into IP fabric to overlay over to... Over the network. We do have some more native integrations under development as you can see. The next will actually be Dynatrace. It's an APM tool, but they'll... Guardicore and Datadog are on their way, and others will follow as they become, apparent that we we need to do them for our customers. And once we've done that and we've overlaid that onto IP fabric's data, we can then start to answer those three questions we talked about. Is my network working as intended? Well, what that means is, are my applications secured? And the way we answer that is simple. We walk every hop of every path for every application, and we can check that that enforcement that you expect to be there is there, whether that's in the network, whether that's across the cloud, or whether that's in host microsegmentation policy. The the second question we wanted to ask was is the app resilient? Well, we can already do that from the network. We already show the the... Where the single points of failure. We already show information about topology. Now what we can do is look at individual paths and say, well, actually, if I've got a if I've got a multiple... A a set of paths, do those paths share any common pieces of infrastructure? And if they do, what would happen if I were to lose that? Will it affect, the behavior of the application or or not? So it gives us an answer to that question about resilience. And we can even start to address the performance piece as well. While we don't watch live traffic, what we do know is where those... That traffic is gonna flow. So we know which devices carry the application. And so if you've got your telemetry in place for your your application performance monitoring, we can tell you where and how to configure that. And that kinda shows up in in three main areas as we've identified here. You can answer these kinds of questions. What infrastructure does this application depend on? Where where am I gonna see those application flows? And then what will break if I changed any of those components? You know? You can see what two sides of the same question there. Because you know and understand those dependencies, you can understand the risk of making change and, the the... Understand when you come to troubleshoot a problem, where to look. So if this application is failing right now, where do I go to try and identify what's going on there? Especially if I've got multiple applications failing, I can go and look at the common points in the network that they touch. And then from a compliance perspective, I can start to answer questions like, actually, this application, is it properly separated? Does my PCI, infrastructure live behind the correct firewalls and live behind correct firewall policy? These are the kinds of questions that we're gonna be able to answer. So, really, what we're doing is we're stopping you from having to guess. We can... And... Or or having to go and and collaborate with your teammates in order to understand what's going on here. We're giving you the the network facts, and then we're laying this application view on top, which allows you to... And it mentions here your AI. That could be your UI. It could be you sitting in front of the product. It could be that you script an automation that uses this data. But also, once you get to AI and correlation, you're able to bring this application data into a wider conversation about the behavior of the network. I'm gonna hand you over at this point to my colleague, Mike. Mike, has a very particular perspective that's really, really useful to to understand here. So, Mike, I'm gonna stop sharing, and if you want to to, pick up from there, I'd appreciate it. Thanks for everyone for listening so far. Alright. Thanks, Darren, so much. Get my slides shared out here. So, again, hello everyone. My name is Mike Aragon. I'm a solutions architect with, IP fabric with a background in network tooling and observability. And I'm gonna talk a little bit about my background because application visibility to me always meant flow in packets, with application metadata. So if you wanted to know what an application was doing on the network, you enabled flow and it provided a lot of useful information. And with NetFlow, you can understand what applications were on your network, how much traffic, you know, where the traffic was going in a general sense, but there are some fundamental challenges with this approach. It's not because the tools were bad, but the data itself is challenging to work with and even more challenging in today's, you know, multi vendor landscape. So I've created a few illustrations and to kinda show what this data inconsistency looks like. And and this... You can see the core router exports, you know, NetFlow version nine with MBAR two app IDs, but the egress interface comes back as zero. The access switch gives you s flow. That's a sampled frame and not a flow, you know. Bytes are an estimate. There's no application field at all. The firewall, it speaks IPFIX with its own vendor specific nuances, byte and packet counts, you know, land in reverse direction fields. So the forward fields read zero. Interface indexes are zero because the firewall doesn't model them. So you have three records. The field names drift, the field meaning drifts. And if you look at where the gaps are, they're not nulls, they're they're zeros. So a collector can't really always tell none from zero, so it maps them as real values. You know, so every router switch and firewall family does this a little differently and and so does every model even within the same vendor. So your Cisco firewall, your Cisco router, your Cisco switch are going to export this information, differently. So then you have the DPIs. Right? So how do you detect applications? You have Cisco. I I just listed three here, but Cisco, MBAR, you know, Cosmos, and Hypo. These these labels are are illustrated, but the pattern isn't. So you have short tokens on one engine and protocol fallbacks on another engine, maybe even marketing names on an engine, and there's, maybe even a little... Literal zero if something doesn't get classified. So even with a handful of applications, there's really no shared taxonomy. So your normalization efforts become guessing, and the next application signature update when you update your DPI could break and and you'll change everything. And I'm gonna switch to my browser here to show you a little bit of what the IP fabric data looks like here. So, here's really why it matters, you know, a lot more today, than it did, you know, five years ago. When you hand inconsistent data to an AI model, you don't get a slightly worse answer. You get a really confident answer built on fields that that meant, you know, three different things, you know. And the common term everyone uses is it's a hallucination. But it's a real challenge when you're working with AI models and our experiences that, you know, it starts with the data, not the model. So IP fabric's approach is kind of the opposite of the collector problem. We give you one normalized model, device inventory, a clean connectivity matrix. So in this particular view, you can see how everything is connected. We show you routing and forwarding behavior and security enforcement, from a firewall policy. I've got some different policies here, and we bring all the security policies into a normalized view. So this is a, zone firewall policy. This is a... An access list to standard ACL. This is a a cloud security policy. So three very different animals, in a very normalized data model, which makes it great for, feeding this into AI. So, you know, a clean contextual data means you get deterministic output. And that's what makes it, you know, really great for for AI. So backing up to application infrastructure mapping. So in our MVP, this is what we're giving you guys out of the box. This kind of our first launch. We're gonna show you applications, flows, workloads, and devices, and how all these things are interconnected and and interdependent on each other. So, for example, I can ingest the applications from external data sources such as Illumio. And as Darren mentioned, we're gonna be adding others. But you can also, through automation or manually ingest, application information. We're gonna show you the flows, associated to a given application. And these flows are actually not, calculated at snapshot times. So in our digital twin model, we run snapshots. We capture all the data, in the state of the network at a given point in time, but we're not calculating these flows. We do understand how many they are. But if I were to click on this button here, this is going to calculate the flows in real time, and it's gonna calculate all the flows for the HR system application. And it runs really fast. You can see that didn't take very long. And that now gives me the ability to determine the number of devices and and workloads associated to that flow. So I can drill into these different views and understand, you know, for a specific application, what network devices are affected. I can look at the specific workloads for those. And if I wanna look at the individual conversations, I now have all those flows that I can run our our standard, you know, end to end hop by hop analysis on this to see the full the full path. So these are really interesting views to see within our tool. Of course, we make this, data very accessible through our API, and and most commonly nowadays, it's it's being used very heavily through our MCP server integration. So this is kind of the the the key deliverables for the MVP. Just a little bit about what's under the hood. If we go into our discovery settings, once you have, AIM enabled, you'll have this application mapping menu within the discovery settings. And that allows you to plug in your integrations with your micro segmentation and APM providers. You can manually insert applications. You can do it via CSV. All these things can also be done via the API like we mentioned. You can build the workloads. Workload in IP fabric is is a kind of a a unique term compared to how we normally operate. Try to think compute when you see the workloads. And then, of course, we can ingest flows as well. So your five two full source destination, source port, fem... You know, ephemeral port, and destination port protocol so that we can run those path lookups. So, you know, the easiest way is obviously to integrate with your your providers to understand this information really quickly, and that enables these views. So I'm gonna segue and do some live prompts with you guys and show you what this would look like using cloud desktop. So you should be able to see my anthropic clogged view now. And the first prompt I gave it was just to check the time stamp of the most recent snapshot. I like to make sure I understand when the data was collected for the queries. I'm gonna run a few really basic things to inquire about application infrastructure mapping, and I'm gonna start with just asking it to show me the applications. So show me the applications in IP fabric. I'm using the basic SONNET model. Not... Nothing complex here. So now we have a a list of the applications and the details, and I can query from here. Maybe I wanna understand the network devices associated to a specific application. So I'm gonna prompt it to list the network devices handling the... Use the instant payments. Fix my typo. So now we can understand what devices are handling the traffic for this particular application with a single prompt. And now I have the list of devices. Maybe I need to do an upgrade on the software for a specific device. I can ask the reverse question. What applications depend on this hardware device? And with the flow information, we can run path simulations in AI as well and get really detailed information quickly. So I'm gonna give it another prompt asking it about the, a specific, end to end path simulation. So I'm gonna ask it to show me the, I'll ask it about the flows first. The TCP, four four three will focus on HTTPS flows for the instant payments application. So we can pull all the same information out. This allows you to enfranchise all the data and your network data model really easily in a natural language to your entire organization. So now that I can see the flows, I may want to understand the path and the connectivity for specific flows. I'm gonna give it another prompt just to show me the path. Let's do run and end to end path analysis. Source source IP, destination IP, it'll say using four four three for the instant payment application. I didn't typo anything there. Let's let it go. So these path simulations are probably one of my favorite features in IP fabric. When you're using NetFlow tools, they're very dependent on the instrumentation. So how you bolted everything together, IP fabric discovers your network as it's actually connected. So you don't have to guess, you know, what interface is connected to what and worry about your flow records actually showing the correct in interface and out interface and switch path. We already know all that information, and now we can run these simulations and build, diagrams over top of this data. So really quickly giving you an accurate, view of how from source to destination a packet travels through the network. So now you can see the full path, the interface details, the device names, and everything in your standard LLM interface. So, I could even ask it about the workloads. But, yeah, as you can see here, this is really easy to to really get information from IP fabric using our MCP server. The sky is really the limit there. I'm gonna switch to... Back to my browser and just show you a few cool artifacts that I've made with AI using application infrastructure mapping data. So because our data is very clean and contextual, AI does a phenomenal job at building, rendering the data in in very interesting ways. So I've built this, just with some standard prompts, to to render this in a three d fashion so I can understand how devices are interconnected. This is kind of a cool, you know, three d version. I can see, you know, the application, what devices it actually traverses. These bars are actually devices. So this this is really powerful output using our clean data model. I did another simulation for the end to end path. So I had the the model load all the paths. So I have every single path for a specific applications loaded. I can switch back and forth between these different paths and and view, you know, all the network devices. And it even it even gives me a cool hop by hop simulation, so I can see the packet as it traverses each device. So that really allows us to answer those questions, you know, which which apps depend on this device or path, you know, what's reachable if the work... Workload is breached, what controls does my app rely on, you know, can we prove isolation is actually enforced. You can always get there through the UI workflows, but it's really cool to use our MCP server too. So that's kind of the AIM MVP. It's the foundation where applications become, you know, first class objects and IP fabric built on a clean contextual model. You know, this milestone kinda sets the stage for a lot more to come with intent validation to segmentation drift as we adopt more micro segmentation and APM integrations, for application infrastructure mapping. So definitely check out the resources in Goldcast, and and let us know if you have any any feedback or questions. And thank you all so much for your time today. Thanks for that, Mike. We have already got a couple of questions, and and one of them we we should look at straight away, actually. George, has asked, can you just go back and have a look at your instant payment flows and see where where... Whether you got those through, the manual edition of the flows or whether they were from, from Illumio. George, to to to the point here, I suppose the the the... What you're able to do is bring, this this flow information from wherever you have it. So if you have it in a a manual source, in a CSV, or a spreadsheet, if you have it in another tool, we'll accept it from from wherever, and we'll combine those flows as well. So if we've got, for example, Illumio with some application flows, you can bring those in from there. But we'll also add more flows if you have them manually, stored as well. So it it... We we combine the two. Hope that answers your question, but, we'll we'll dig out the specific on that one for you. You should be able to begin recording. Just looking at any other questions. We've got a few come through. So so the first one I wanted to pick up, Renata was asking, whether we plan to integrate with Cisco Secure Workload AppDynamics or other Cisco solutions here. And that's a a really great question, Renata. We're we're working quite closely with Cisco as a a development partner, on a number of things, including the cloud control, studio. But, certainly, the plan is to is to be able to pull this application data from wherever you find it. So, yes, secure workload was was next on our list of of micro segmentation platforms. Yes. AppDynamics very much, on on our list of APMs. Prioritization is what it is, but but, ultimately, once we've, built the capability, bringing new vendors in in on that integration is, hopefully relatively straightforward. So we should be able to do that fairly quickly. Expect... We... We've got integrations planned into the beginning of next year, but but beyond that, we would expect to start seeing, others. So I would I would hope that we'd be addressing those sort of, midterm next year. I'm not making any, any commitment on that, of course, but... Hey. We've got another message, from from Christopher asking if Claude, is the only AI that this integrates with. No. In in short, Christopher, is your answer. If you... And if you want to, feel free to go back and look at our previous webinars on on our MCP server capability. But, essentially, any, agent that can consume data over MCP, we can integrate with. So, we use Claude by default. It's our, in in... Internal tool, but we do test against others. And and we use all models as well. Right? So we'll we'll use, obviously, against chat g... GPT and the like, but also, local models as well. Obviously, your mileage varies depending on what... What's powering the conversation, but as Mike showed you before, I mean, you used a fairly fairly simple, low key model, and yet it was able to generate some really good good answers. Main thing really being because the quality of the data is good, you're gonna get, you know, good answers to your questions. Just looking to see. The... We've got a couple of questions asking things like, does IP Fabric replace the a... APM tool? The short answer is is no on that one, I guess. Mike, having worked in the APM space, I'm sure is is... Sees a a big difference between what IP Fabric is doing here and and what APM does. But, yeah, I don't know if you want to speak to that at all, Mike. Yeah. No. Very different, very very different animals there. We're we're ingesting the data from these these systems. We're definitely not not replacing it. If you if you leverage an APM or even a... You could use a net flow analyzer to to extrapolate flows from your network and and run these simulations through IP fabric using our application infrastructure mapping feature. Yeah. Excellent. And and, Per, just just your... To your question, Per was asking the question of how trustworthy the AI agent answers hallucination shortcuts question. Okay. I guess we've kind of touched on that. But the point here, Per, is that that the MCP is really only providing the deterministic data that sits on on top of the model, from the model, that lives in IP fabric. And so it's only, it's only when that data is missing that things are going to potentially... That agent will start hallucinating. I guess the point being here that we are, we will tell you if the data is missing. And so the intention being that the guidance is in place. But if there's no data, don't don't try and guess. Just use the, use the data you have to hand, which is what comes from Open Fabric. Yeah. That's one of the big advantages, you know, having very clean tables and very well modeled data and normalized data. You know, being able to actually just do security intent through all the different firewall vendors that we support and being able to see that in a normalized fashion, whether you're using our tool or using the API or you go through MCP, you you get the same output. And the the the models work really well with IP fabric for that reason, you know, because it's very clean and organized. And just to to follow-up as well and and and following up on Christopher's point before, you know, those models don't have to be the Frontier Cloud models either. Right? They they works quite happily and well with a a local LLM. We've we've got, a lot of internal experimentation is around using using those local models. So, for example, if you don't want your data to leave your your, environment, you can do that all, on prem with a with a local model quite quite comfortably. So now you're showing off, Mike. I really like this one. You know, just showing the the blast radius of the of the workload and what it's what it's connected to. Yeah. And I guess that's the point, isn't it? The the data is, there to to get all of these kind of visualizations. While these visualizations aren't in the UI of the product, this is the the the joy of AI tooling. Right? It's given us this this capability to to create new ways to look at at data. So... Of this. Awesome. Just wanna see if we've got any more questions. Yeah. No. I think we're good. So thanks ever so much for your time, everybody, for for joining us. It's been really great to have so many questions and, and hopefully, been insightful to see what it is that that, the MVP. So this is the first release of of application infrastructure mapping brings. There will be more. There's a lot more capability once you bring all these things together. Some of those things we touched on at the beginning in terms of, the the way you can analyze your network from a whole different perspective with a different lens. This is only gonna bring more and more use cases. So, watch this space. There will be definitely follow-up webinars to this, hopefully, with more visualizations like this. So, Mike, we'll definitely be inviting you along for that one. Thank you very much for your time, my friend. Thanks, guys. Thanks, guys.