No Brainer!
Networking and Security Complexity is Exploding with Point Solutions
Cato SASE Cloud is the World’s First True SASE Platform!
Converged. Cloud-Native. Global. All Edges.
Cato Global Private Backbone
The Largest Independent Global Backbone
99.999%
Uptime SLA
75+
PoPs
1,500+
Global Customers
24-7-365
Global NoC and SoC
Secure Access Service Edge (SASE)
What is SASE?
Secure Access Service Edge, or SASE, is an enterprise networking and security category introduced by Gartner. SASE converges SD-WAN and Security Service Edge (SSE) functions, including FWaaS, CASB, DLP, SWG, and ZTNA, into a unified, cloud-native service.
With SASE, enterprises can eliminate the effort and costs required to maintain complex and fragmented infrastructure made of point solutions, reduce the risk for breach and data loss with optimal security posture, enable secure work from anywhere, and improve access to global applications on premises and in the cloud.
*Only verified account holders can view this file. Create an account here.
Gartner Report
Market Guide for Single-Vendor SASE
Why is SASE Necessary?
Gartner Predictions
The transition to remote work and the emergence of a cloud-first culture are having a major impact on enterprise networks and information security. Networking patterns have changed, and organizations need to deploy new services and cater to new requirements faster than ever before.
A SASE architecture provides the agility and flexibility needed in this new environment. SASE makes it possible to deploy new branches remotely with low overhead. It also provides the security stack to ensure employees and contractors can access systems securely from anywhere.
As a result, Gartner predicts that 20% of organizations will soon use SWG, ZTNA, and FWaas from the same vendor. By 2024, at least 40% of organizations will have an official SASE adoption strategy.
How Does SASE Work?
SASE provides a single cloud-based network that connects and secures any physical, cloud, or mobile enterprise resource, in any location. A SASE architecture has four main characteristics:
Identity-Driven
User and resource identities determine the level of access, networking experience, and quality of service for every network connection, based on a unified organizational policy.
Cloud-Native
SASE is elastic, self-healing, and self-maintaining. Its cloud native nature allows it to rapidly adapt to business needs and make network services available from any location.
Support for All Edges
SASE can equally service any edge including on-premise data centers, branch offices, cloud resources, and mobile users on the go.
Globally Distributed
SASE operates on a global scale to deliver all networking and security capabilities with high performance and low latency experience for all edges.
What are the key components of SASE?
Software-Defined WAN (SD-WAN)
SD-WAN enables optimal WAN management. SASE leverages SD-WAN capabilities to provide optimized network routing, global connectivity, WAN and Internet security, cloud acceleration, and remote access.
Zero-Trust Network Access (ZTNA)
ZTNA offers a modern approach to securing application access for users. It embraces a zero-trust policy, where application access dynamically adjusts based on user identity, location, device type, and more.
Secure Web Gateway (SWG)
SWG solutions protect users against malware, phishing, and other web-borne threats. SASE offers SWG protection to all users, at all locations, and eliminates the need to maintain policies across multiple point solutions.
Firewall as a Service (FWaaS)
A firewall is the foundation of any network security stack. SASE includes FWaaS to provide the scalability and elasticity needed for the digital business and to extend a full network security stack wherever needed.
Cloud Access Security Broker (CASB)
CASB helps enterprises adapt to the new threats that come with cloud computing. When delivered as part of a SASE service, the complexity of integrating CASB with other point security solutions is eliminated.
Unified Management
SASE solves the complexity of managing multiple disparate products. A true SASE allows users to monitor and manage all network and security solutions from a single pane of glass.
What are the Benefits of SASE?
Performance and Security.
Improving Agility
With SASE, it is easy to deploy new resources. All you need is to deploy an edge client and connect it to the SASE platform. There is no need to maintain on-premise infrastructure.
Security via Unified Policies
SASE provides a full security stack, protecting all resources with a unified security policy. It provides full visibility into WAN and Internet traffic with no blind spots.
Single Software Stack
SASE provides a simpler network and security stack by consolidating multiple point solutions. It reduces upfront costs and eliminates the need for in-house management.
Instant Connectivity
The SASE architecture leverages key cloud capabilities including elasticity and scalability. This provides a platform that instantly adapts to emerging business needs, such as connecting a remote workforce with just a click of a button; or provisioning new resources easily for quick global expansion.
Single Pass Processing
True SASE implements a single-pass engine that processes each packet for multiple networking and security objectives in parallel. This delivers maximum flexibility with minimal latency and resource requirements.
Global Availability
Cato’s globally distributed PoPs ensure that all networking and security capabilities are available everywhere, delivering the best possible experience to all edges.
Simple Management
Managing an ever-growing pile of point solutions is becoming too complex, too slow. One of the SASE benefits is that, management becomes simple via a single-pane-of-glass that provides control across an entire enterprise.
No Maintenance
IT is relieved of maintenance tasks like patching and hardware replacements, and can focus efforts on responding quickly to evolving business challenges.
Full Visibility
With SASE, IT has complete visibility into the network as all WAN and Internet traffic passes through the SASE Cloud. There are no blind spots and IT is able to easily maintain control of the entire network.
What are the Cost Benefits of SASE?
Quick ROI
SASE enables augmenting or replacing MPLS altogether. This offers an immediate, significant cost-saving compared to the expensive MPLS links.
Optimized Cost Model
SASE eliminates the need for any CAPEX purchases and in-house management and maintenance. All costs are transformed to OPEX.
Reduced TCO
SASE minimizes both visible and hidden costs:
Visible costs – SASE includes all networking and security functions, eliminating the cost of purchasing point solutions.
Hidden costs – With legacy solutions, IT is busy agonizing over how to handle the network and unintentionally slowing down business. With SASE, the burden of sizing, deploying, configuring, patching, upgrading, and maintaining multiple point solutions is removed, turning IT into a business enabler.
Cato Networks is the World’s First SASE Platform
Cato SASE Cloud is a proven SASE platform you can deploy today. Cato’s cloud-native architecture converges SD-WAN, a global private backbone, a full network security stack, and seamless support for cloud resources and mobile devices.
Customers easily connect physical locations, cloud resources, and mobile users to Cato SASE Cloud, and IT teams immediately benefit from the agility of a unified network and security service managed through a single, self-service console.
”With Cato, we got the functionality of SD-WAN, a global backbone, and security service for our sites and mobile users integrated together and at a fraction of the cost.
Willem-Jan HerckenrathManager ICT, Alewijnse
What Isn’t SASE?
When Gartner published “The Future of Network Security Is in the Cloud” in 2019 they did two things. First, they accurately identified and described where enterprise network and security architectures were headed in the next decade. Second, to describe this new approach they created one of the biggest IT buzzwords of the time: SASE short for “Secure Access Service Edge”.
Because of all the buzz around SASE, many “SASE vendors” are marketing solutions that have features found in SASE. However, most of these solutions miss the mark when it comes to achieving SASE’s promise of a holistic and converged network security solution. Here, we’ll look at what is not SASE to help identify what value SASE vendors should deliver to enterprises.
SD-WAN Isn’t SASE
In some contexts, SASE is viewed as the next generation of SD-WAN. From the perspective of bringing agility and convergence to network infrastructure, it’s understandable why the comparison gets made. In fact, the ability to optimally route traffic and abstract away the underlying physical medium (which are core benefits of SD-WAN) is an important part of SASE.
However, SD-WAN alone is only a piece of a broader solution SASE vendors should provide. Further, not all SD-WAN implementations are created equal. For example, SASE aims to support all network edges (WAN, edge computing, cloud computing, and mobile), but with many SD-WAN appliances, mobile support is lacking or non-existent.
Cloud-Based Security Isn’t SASE
As with SD-WAN, there are many security features that are important parts of a SASE solution. Examples include IPS (intrusion prevention system), NGFW (next-generation firewall), and SWG (secure web gateway).
Since identity-driven security and cloud native architecture are key characteristics of SASE, it may be easy to buy into the idea that a feature rich cloud-based firewall can serve as a method to implement SASE. However, in practice, this doesn’t work out well. Security is only half SASE architecture, and a cloud-based firewall and IPS alone can’t help with routing and WAN optimization at a global scale.
Again, as with SD-WAN the benefits of these technologies make them an important part of SASE, but even while bundled-together they are not in and of themselves SASE.
Multiple Appliances Patched Together Isn’t SASE
The SD-WAN functionality that enables agile and efficient routing is an important part of SASE. Similarly, security features such as IPS, SWG, and NGFW are an important part of SASE. However, simply deploying appliances and solutions from “SASE providers” that check all the boxes of the SASE feature set won’t deliver the promise of SASE.
This is because creating a patchwork of network and security appliances and cloud solutions simply can’t provide the agility, visibility, simplicity, and performance a single converged solution can. Sourcing, deploying, managing, and integrating multiple products not only drives up costs, but it also increases network complexity. As a result, a patchwork of solutions that look good on paper often create operational bottlenecks and security oversights at scale. While some may argue for shifting the complexity to a service provider, this doesn’t resolve the underlying issues and often leads to higher costs for sub-optimal performance.
Virtual Appliances on Edge Devices Isn’t SASE
Running virtual appliances on an edge device reduces the hardware footprint but does little for operational costs. Appliances still need to be deployed, integrated, upgraded, deployed, and maintained. The underlying silos and complexity don’t go away. True SASE platforms eliminate the appliance form factor. Functions are delivered as a multi-tenant, cloud-native platform. SASE providers manage and maintain the underlying platform for the benefit of all customers. Neither the enterprise nor the provider incur the operational overhead of managing appliances.
Security Service Edge (SSE)
What is SSE?
In 2021, Gartner introduced a new category, the Security Service Edge (SSE), to describe the convergence of certain network security functions in the cloud. SSE converged SWG, CASB/DLP, and ZTNA, into a single cloud service. SSE is a subset of the security layer of SASE that can be deployed as a standalone capability or as a step in a full SASE transformation journey.
Security Service Edge provides secure access to internet- and cloud-based applications without directly addressing global application access optimization and east-west WAN traffic security. Extended visibility and control to all traffic is a key feature in competing SSE architectures.
*Only verified account holders can view this file. Create an account here.
Cato SSE 360
What is Driving Adoption of SSE?
Legacy Networks Built Around Physical Data Centers
The move to the cloud forces a re-architecture of networking and security to support users access to internal applications in physical and cloud datacenters, and public cloud applications, anytime and anywhere.
Backhauled Internet Traffic Slows Secure Cloud Access
As the volume of Internet and cloud-bound traffic increases, it doesn’t make sense to send all traffic through the datacenter firewalls. Direct secure internet access must be enabled at every location and down to every remote user to enforce full visibility and control in a way that doesn’t impact the user experience.
Enterprise IT Goes Hybrid
With the shift to a hybrid work model, enterprise IT security must also adapt. Work from anywhere requires a platform with the agility and scalability to ensure full security and policy enforcement across all edges (users, locations, applications, application, clouds), wherever they are located.
Legacy Security Applications Can’t Scale
Legacy security appliances are incompatible with today’s enterprise requirements: they’re location-bound, require constant maintenance, and cannot scale with increased load. Supporting a hybrid workforce requires a flexible, and scalable security architecture that can secure the entire workforce at any location: in the office, at home, or on the road.
Disjointed Solutions Introduce Complex Management
Point solutions increase the manual work IT needs to perform in patching and upgrading, and the potential for errors and oversights. As-a-service delivery model can eliminate the need to update security infrastructure and maintain security posture.
Benefits of Security Service Edge?
Consistent Policy Enforcement
SSE establishes a global fabric that connects all edges into a common security platform. All traffic between any two edges is inspected, and corporate policies are enforced for threat prevention and data protection.
Reduced Attack Surface
SSE implements zero trust access, ensuring users only have access to authorized applications via least privilege access. Application traffic is continuously monitored for anomalies, threats, attacks, and sensitive data loss.
High-Performance Security Inspection
SSE is a cloud-native solution, delivered through a global backbone of PoPs. Security Service Edge seamlessly inspects all traffic, scales vertically and horizontally with traffic growth and minimize latency with each PoP residing within 25 ms of every user and location.
Improved Security Posture
SSE offloads IT of the burden of manually deploying mitigations for emerging threats. The expertise of the Security Service Edge provider’s SOC ensures that end-users are always protected, and the enterprise attack surface is minimized.
Reduced IT Workload
The SSE provider continuously enhances all cloud-delivered capabilities as part of a self-maintaining service. This reduces IT workload and shifts focus to business-critical activities, rather than having to focus on “keeping the lights on.”
Introducing Cato SSE 360
Total visibility and control for all WAN, Cloud and Internet.
Cato SSE 360 goes beyond the convergence scope of SSE to provide total visibility, optimization, and security for all traffic, users, devices, and applications everywhere.
Most traditional Security Service Edge solutions provide secure access to the internet and cloud applications, as well selected internal applications. But enterprises need to optimize and secure all traffic, to all WAN, cloud and internet applications and resources, and across all ports and protocols. This requires additional point solutions like firewalls and global backbones to fill these security gaps.
And, when combined with Cato Edge SD-WAN, Cato SSE 360 offers a clear path to SASE convergence.
”Security at the core of the infrastructure helps us meet our audit and business requirements and maintain standards without having to maintain and manage a lot of security appliances. We can gather information about circuit quality at each branch and get security alerts for quick remediation of attacks or malware infection.
Dave OliverIT Manager, Grant and Stone
How Does Cato SSE 360 Work?
Total Visibility, Optimization, and Control for All Traffic
SSE 360 sees traffic from all edges, across all ports and protocols, and in all directions: WAN, Internet, and Cloud. SSE 360 uniformly applies all security inspections and optimizations to all traffic across users, devices, applications, and locations.
High-Performance Security, Everywhere
SSE 360 is deployed across 75+ cloud PoPs (Points of Presence), that are built for multi-gig traffic processing, to ensure low latency (<25ms from every user and locations) and high performance over the “middle-mile” to both cloud and WAN destinations.
Converged Management Console
All SSE 360 policies, events and analytics are accessed through a single pane of glass and allow for granular policy management. All events across users, threats, data, and application access are available in a single, unified, analytics dashboard.
Future-Proof, Resilient SSE Service
A converged, single-pass architecture easily allows for new security capabilities to be seamlessly added via the SSE 360 cloud service. The SSE 360 cloud is designed with high availability to ensure continued security inspection in case of a PoP or network failure.
Seamless Path to SASE
Cato SSE 360 offers a seamless path to full Cato SASE deployment by expanding the deployment to converged Cato’s SD-WAN and WAN optimization further streamlining customer’s IT infrastructure.
What Are the Components of Cato SSE 360?
Cloud-Native Security Service Edge
Cato’s Single-Pass Cloud Engine (SPACE) is the foundation of Cato’s global, converged, cloud-native service that delivers multi-gig packet processing and real time policy enforcement. Current SPACE capabilities powering Cato SSE 360 include: SWG, ZTNA, CASB/DLP, FWaaS and Advanced Threat Prevention (IPS, Next Generation Anti-Malware).
Cato Global Private Backbone
Cato’s global, geographically distributed, SLA-backed network of 75+ PoPs interconnects multiple, Tier 1 carriers. Each PoP runs the full set of SSE capabilities across multiple compute nodes and SPACEs to ensure minimal latency, deliver global routing optimization, and fully automated self-healing service.
Cato ZTNA/SDP Clients for Users
Users connect via lightweight clients to Cato. They can optimally and securely access the internet, internal applications, on-premises and in cloud datacenters, and global public cloud apps. Clientless access through an application portal is available for 3rd parties.
IPsec-Enabled Devices and Cato Socket SD-WAN for Locations
Physical and cloud locations connect with an IPsec enabled third-party devices or Cato Socket SD-WAN edges. Customers can opt to use current firewalls or SD-WAN edges that reside on their networks and benefit from Cato’s deep security capabilities. The Cato Sockets provide last mile resiliency and QoS and overcome blackouts and brownouts with application-based dynamic path selection and packet loss mitigation.
Comprehensive Management Application
Our comprehensive management application provides clear security and network analytics, with full, granular policy configuration. Managed services include site deployment, intelligent last-mile monitoring, network configuration, security policy change, and MDR.
Quick Q&A
- +What is Security Service Edge (SSE)?
- In 2021, Gartner introduced the Security Service Edge (SSE). SSE converges secure application access functions including SWG, ZTNA and CASB/DLP, into a single cloud service. SSE enables enterprises to move away from rigid, disjointed IT architecture to a converged security platform delivered as a cloud-native service. With SSE, enterprise IT can rapidly address new business and security requirements such as cloud migration, adoption of public cloud applications, and work from anywhere. SSE’s converged architecture reduces cost and complexity with simple management through a single pane of glass, self-healing infrastructure, and automatically evolving defenses that seamlessly mitigate emerging threats.
- +What is the difference between security point solutions and SSE?
- Traditionally, enterprise IT built a security stack featuring multiple point solutions and legacy appliances. Enterprises are increasingly slow to adapt to ever-changing business and technical requirements and the evolving threat landscape. This is compounded by scarcity of cybersecurity skills, limited resources and budgets, and the high cost of outsourced support.
- +Why is Security Service Edge important?
- SSE is a first step in achieving security-driven transformation, by converging secure, consistent access to all applications for all users. SSE, that is part of a single vendor SASE platform, keeps the path open for a full SASE transformation at a later stage, with converged SD-WAN and WAN optimization. The deeper the IT convergence, the more an enterprise enjoys the benefits of increased visibility, lower cost, greater operations savings and added business agility.
- +What is the relationship between SSE and SASE?
- Two years after introducing SASE (Secure Access Service Edge), Gartner introduced SSE (Security Service Edge.) SASE converges SD-WAN and cloud-native security (FWaaS, CASB, SWG and ZTNA,) into a single cloud service. SSE defines a more limited scope of converged network security functions, consisting of SWG, CASB / DLP and ZTNA. SSE is focused on providing secure access to applications, without addressing end-to-end optimized network connectivity and east-west WAN security.
- +What is the difference between traditional SSE providers and Cato SSE 360?
- Traditional SSE solutions are based on a web proxy architecture that supports access to web sites and SaaS applications. To enable ZTNA for all applications, transitional SSE vendors had to introduce yet another architecture of application connectors. Even with that extension traffic generated by enterprise edges like IoT, app-to-app traffic, and most WAN traffic remain outside the scope of SSE.
Cato SSE 360 is built on the Cato Single Pass Cloud Engine architecture to provide total visibility, optimization, and control of all traffic (WAN, Internet, and Cloud) and across all edges (users, locations, applications, and clouds). Cato SSE 360 optimizes global access using a global private backbone with built-in traffic acceleration that outperforms the unpredictable public Interent. Lastly, Cato offers a seamless path to full SASE transformation by expanding the deployment to include Cato Socket Edge SD-WAN devices.
Software-Defined Wide-Area-Network (SD-WAN)
SD-WAN: What is Software-Defined WAN?
Software-Defined Wide-Area-Network (SD-WAN) is defined as a virtual WAN architecture that allows enterprises to securely and efficiently connect users to applications. This technology solution brings unparalleled agility and cost savings to networking. With SD-WAN, organizations can deliver more responsive, more predictable applications at lower cost in less time than the managed MPLS services traditionally used by the enterprise. IT becomes far more agile, deploying sites in minutes; leveraging any available data service such as MPLS, dedicated Internet access (DIA), broadband or wireless; being able to reconfigure sites instantly; and more easily supporting migration to hybrid cloud.
SD-WAN does this by separating applications from the underlying network services with a policy-based, virtual overlay. This overlay monitors the real-time performance characteristics of the underlying networks and selects the optimum network for each application based on configuration policies.
Cato Edge SD-WAN
The Cato Socket SD-WAN device connects a physical location to the nearest Cato PoP via one or more last mile connections. Customers can choose any mix of fiber, cable, xDSL, and 4G/LTE connections. Cato’s Edge SD-WAN device, is a zero-touch device ready to work in minutes. Sockets come in two models: X1500 for branch offices and X1700 for datacenters. Both are continuously monitored and updated by Cato’s network operations center (NOC).
The Socket applies multiple traffic management capabilities such as active-active link usage, application- and user-aware QoS prioritization, dynamic path selection to work around link blackouts and brownouts, and packet duplication to overcome packet loss.
The Socket can also route site-to-site traffic over MPLS and the Internet to address regional and application-specific requirements.
SD-WAN Operation
Cato improves capacity and resiliency by balancing traffic across links. Multiple link aggregation scenarios for MPLS and Internet circuits (fiber, DSL, cable, 4G/LTE or 5G) are supported. In active-active mode, Cato balances traffic across last-mile circuits. Using active-passive or active-active-passive, customers can designate one or two active connection(s) and a secondary connection for reliability purposes.
Regardless, should a brownout or blackout occur on a link, Cato instantly switches traffic to the best available link. Customizable management policies guide link failover, prioritizing applications so business-critical applications continue to receive the optimum capacity. Preconfigured timers determine failback, preventing flapping from disrupting network operation.
Dynamic Path Selection
Applications receive the optimum network experience with Dynamic Path Selection and Policy-based Routing (PbR). Cato Socket monitor link quality metrics (jitter, latency, and packet loss), dynamically selecting the optimum link based on preconfigured network rules. Using Cato’s PbR capabilities, applications can also be pinned to specific transports, such as restricting business critical applications to a high-quality, symmetric fiber links and leisure applications to a lower-quality, asymmetric links.
Network rules describe application routing through traditional application and network information, as well as Cato’s identity awareness capabilities. Identity awareness allows use of familiar constructs, such as team, username or other Microsoft Active Directory (AD) attributes, making policy creation intuitive and providing the highest level of policy abstraction.
Application Identification
Cato’s advanced Deep Packet Inspection (DPI) engine automatically identifies thousands of applications and millions of domains on the first packet. This robust library is continuously enriched by third-party URL categorization engines and machine learning algorithms that mine a massive data warehouse built from the metadata of all traffic flows traversing Cato Cloud. Customers can also configure policies to identify custom applications or have that done for them by Cato engineers.
Bandwidth Management and QOS
Cato aligns network usage with business intent through Bandwidth Management rules. The rules assure that more critical applications always receive the necessary upstream and downstream capacity, serving other applications on a best-effort basis. Rules contain priority, class of service, and capacity limits, if relevant. Administrators can modify or create rules, network-wide or per site. Detailed analytics for all rules can be easily seen through Cato’s advanced reporting capabilities.
Packet Loss Mitigation
To address last mile packet loss, Cato employs numerous mitigation techniques. The effects of packet loss are dramatically reduced by detecting lost packets nearly instantly in the nearby PoP and not the remote destination. When packet loss does jump, Cato Sockets automatically detect the change and switch traffic to alternate link(s) connecting the site. Cato intelligently resumes use of primary links to avoid link flapping.
To address very unstable last-mile links, Cato customers proactively enable packet duplication on a per application basis. When configured, Cato duplicates application packets on both links of an active-active connection. Traditional packet duplication operates for all applications, wasting bandwidth on the redundant packets. Cato’s proactive packet duplication allows customers to only use the technology for applications with low packet loss tolerance, such as Remote Desktop Protocol (RDP) and Voice-over-IP (VoIP), minimizing bandwidth usage..
BGP Integration
When organizations consider WAN transformation, they can face the migration challenge of integrating SD-WAN with their existing routing infrastructure. Without routing protocol integration, companies end up having to manually configure multiple static paths to connect their routed and SD-WAN infrastructure.
Cato’s routing protocol integration renders those actions are unnecessary. Based on a customer’s configurations and by leveraging BGP routing information, Cato Cloud can make informed real-time routing decisions. This enables enhanced support for scenarios such as direct connect and/or active-active configuration in AWS, disaster recovery (DR) with virtual IPs, integration with autonomous systems (AS) within sites, and greater flexibility in gradual deployments.
Configuration and Management
Single-Pane-of-Glass: Cato provides a single-pane-of-glass for managing networking and security infrastructure. The Cato portal provides more than just visibility into the SD-WAN; customers and their partners can also configure, manage, and troubleshoot their networks. An overall view provides a snapshot of the global network including cloud resources and mobile users. Detailed statistics can be accessed by drilling down into each entity. Security services are available from the same interface.
Real-Time Analytics
To troubleshoot problems, Cato includes real-time network analytics providing metrics on jitter, packet loss, latency, packet discarded, throughput, and dropped packets for both upstream and downstream traffic. Mean opinion score (MOS) ratings provide real-time insight into the quality of experience for across Cato Cloud.
Configuration and Management
Single-Pane-of-Glass: Cato provides a single-pane-of-glass for managing networking and security infrastructure. The Cato portal provides more than just visibility into the SD-WAN; customers and their partners can also configure, manage, and troubleshoot their networks. An overall view provides a snapshot of the global network including cloud resources and mobile users. Detailed statistics can be accessed by drilling down into each entity. Security services are available from the same interface.
High Availability (HA)
Cato’s Affordable High Availability (HA) guarantees continuous operation in the event of a Socket failure. Primary and secondary Sockets are connected via VRRP, seamlessly switching over without disrupting application sessions. Should a Socket’s Internet connection degrade or fail, the Socket automatically reconnects to the best available PoP. Affordable HA carries no additional recurring charge; deployment is simple and completed in minutes.
Firewall as a Service (FWaaS)
What is FWaaS?
Firewall as a Service (FWaaS) is a new and revolutionary way of delivering firewall and other network security capabilities as a cloud service. Enterprises have always deployed next generation firewalls as appliances. While form factor varies between physical and virtual appliances, deployed on-premises or in the cloud, customers need to support the full appliance life cycle. Distributed locations need dedicated appliances that have to be sized and upgraded to accommodate business growth. Appliance software has to be patched and upgraded, and policy management must be done on an appliance basis.
FWaaS is a new type of a next-generation firewall. It doesn’t merely hide physical firewall appliances behind a “cloud duct tape”, but truly eliminates the appliance form factor, making network security (URL Filtering, IPS, Malware preventions, Analytics) available everywhere. In essence, the entire organization is connected to a single, logical global firewall with a unified application-aware security policy. Gartner has highlighted FWaaS as an emerging infrastructure protection technology with a high impact benefit rating.
Why Do Companies Need FWaaS?
FWaaS allows enterprises to partially or fully migrate network security to the cloud. With cloud-based firewall security, a third-party provider manages the solution. The provider maintains hardware infrastructure that supports the solution. The customer organization agrees to a service contract which outlines what features it can access depending on its subscription level.
In a local setup, the organization must procure an NGFW appliance, which incurs significant upfront costs. Because there is a need to keep up with new attacks and technological developments, there is a continuous need to upgrade and extend the NGFW. Each new purchase or upgrade requires staff to be trained in the new capabilities.
FWaaS is a cloud-based service that does not require an upfront investment and is continuously updated with the latest threat intelligence and security capabilities. Providers invest in advanced technologies and methods to improve network security, taking responsibility for keeping devices up to date.
What is Driving Adoption of FWaaS?
Scaling on Demand
Enables scaling up FWaaS in response to business growth, without needing to upgrade or purchase and configure additional appliances.
Reducing Costs
Lets organizations leverage cutting edge firewall technology at lower cost. Purchasing and maintaining an appliance doesn’t fit the budget and operational workflows of many companies.
Improving Deployment in Remote Sites
Allows organizations to easily deploy FWaaS to distributed sites and users, extending security by connecting them to a single logical firewall with a unified, application-aware security policy.
Device Support
Enables protection of a variety of devices to support all employees of any size organization, including organizations with bring your own device (BYOD) policies.
Supports Adoption of Secure Access Service Edge (SASE)
FWaaS is a basic component of a SASE architecture. SASE provides managed networking with NGFW and additional security capabilities, without the high capital investment of local wide area network (WAN) infrastructure.
The Cato Solution
Firewall as a Service Built Into a SASE Platform.
Cato Cloud, the world’s first SASE platform, built on a global private cloud of 75+ PoPs, aggregates all enterprise traffic from data centers, branches, mobile users, and cloud infrastructure. It then enforces a comprehensive security policies and threat prevention on both WAN and Internet-bound traffic, across all users and applications.
Cato’s FWaaS represents the next evolution in firewall technology that leverages advances in software and cloud technologies, to deliver a wide range of network security capabilities, on-demand, wherever businesses need it.
Challenge: Securing the Network in an Ever-Changing Business Environment
As enterprises expand their networks to include new resources, such as cloud infrastructure and mobile users, IT must extend security accordingly. However, relying on traditional appliance-based firewalls is no longer a viable solution. Firewall appliances don’t have a line of sight into these resources, forcing enterprises to backhaul mobile traffic through datacenter firewalls, adding latency due to the trombone effect. Alternatively, allowing direct access to the cloud leaves mobile users dependent on the unpredictable Internet performance. In addition, direct cloud access bypasses datacenter firewalls, requiring additional cloud security products to ensure enterprise-wide security.
Cloud-Native Security Delivered as a Service
FWaaS, delivered as an integral part of a full SASE platform, addresses the shortcomings of appliance-based firewalls. By leveraging the benefits of a cloud infrastructure, FWaaS provides the necessary scalability and elasticity to support today’s evolving business. In addition, it extends a full network security stack wherever needed, globally, and down to a single user. This eliminates the need to deploy additional point products, drastically reducing the cost and complexity of integrating, securing and managing remote locations, cloud applications and mobile users.
BGP Integration
When organizations consider WAN transformation, they can face the migration challenge of integrating SD-WAN with their existing routing infrastructure. Without routing protocol integration, companies end up having to manually configure multiple static paths to connect their routed and SD-WAN infrastructure.
Cato’s routing protocol integration renders those actions are unnecessary. Based on a customer’s configurations and by leveraging BGP routing information, Cato Cloud can make informed real-time routing decisions. This enables enhanced support for scenarios such as direct connect and/or active-active configuration in AWS, disaster recovery (DR) with virtual IPs, integration with autonomous systems (AS) within sites, and greater flexibility in gradual deployments.
Configuration and Management
Single-Pane-of-Glass: Cato provides a single-pane-of-glass for managing networking and security infrastructure. The Cato portal provides more than just visibility into the SD-WAN; customers and their partners can also configure, manage, and troubleshoot their networks. An overall view provides a snapshot of the global network including cloud resources and mobile users. Detailed statistics can be accessed by drilling down into each entity. Security services are available from the same interface.
Real-Time Analytics
To troubleshoot problems, Cato includes real-time network analytics providing metrics on jitter, packet loss, latency, packet discarded, throughput, and dropped packets for both upstream and downstream traffic. Mean opinion score (MOS) ratings provide real-time insight into the quality of experience for across Cato Cloud.
Configuration and Management
Single-Pane-of-Glass: Cato provides a single-pane-of-glass for managing networking and security infrastructure. The Cato portal provides more than just visibility into the SD-WAN; customers and their partners can also configure, manage, and troubleshoot their networks. An overall view provides a snapshot of the global network including cloud resources and mobile users. Detailed statistics can be accessed by drilling down into each entity. Security services are available from the same interface.
High Availability (HA)
Cato’s Affordable High Availability (HA) guarantees continuous operation in the event of a Socket failure. Primary and secondary Sockets are connected via VRRP, seamlessly switching over without disrupting application sessions. Should a Socket’s Internet connection degrade or fail, the Socket automatically reconnects to the best available PoP. Affordable HA carries no additional recurring charge; deployment is simple and completed in minutes.
