Ericsson NetCloud Exchange

NetCloud Exchange Services and Specifications

Zero trust VPN / private APN replacement

Secure Connect delivers a policy-governed, zero-trust network that can be easily orchestrated from the WAN edge to the cloud.

• Domain name-based routing – Translates complex IP addresses to more intuitive names to hide the network attack surface, simplify provisioning, and to create more intuitive policies.;
• Support for overlapping IP addresses at sites – With domain-based routing in place, overlapping IP addresses can easily be accommodated.
• Resource-definition – Applications and assets connecting to the network are “dark” until explicitly defined and an access policy is created.
• Deny-all by default – Rather than broad network access, access is restricted until explicitly defined by policy.
• Blocks east/west traffic by default – Contains breaches to where they occurred by blocking east/west and all incoming traffic to a site, unless enabled by policy.
• Split routing from sites – Enables Direct Internet Access from the edge router. Administrators define all the IP subnets that need to go through the cloud-delivered or customer-hosted service gateway; all other traffic goes direct to the internet.
• Configurable options for cipher levels and encryption method – Allows administrators to select desired cipher levels and encryption method. Administrators can select IPsec where all traffic is encrypted, even if it is already encrypted. The microtunnel encryption mode enables administrators to select which ports and protocols they want encrypted. This can increase throughput on a wireless WAN while still providing the same level of security as IPsec. Selectable IPsec cipher levels include:
  • Level 1 (the default) – AES 128, SHA2 256, Group 14 (ECP 256)
  • Level 2 – AES 128, SHA 2 256, Group 19 (ECP 256)
  • Level 3 – AES 256, SHA2 384, Group 20 (ECP 256)

Microtunnel uses AES 256 encryption.

SD-WAN enhances WAN resilience and quality of experience (QoE) by optimizing traffic over multiple physical or logical connections including, wired, 5G/LTE, satellite, Wi-Fi as WAN, private APNs, and 5G standalone network slices.

• Zero trust foundation for SD-WAN – While traditional SD-WAN technology leverages encryption and site-based VPN technology to secure traffic over multiple WAN connections, NetCloud SD-WAN leverages a true zero trust foundation that minimizes the attack surface, limits the blast radius, and is deny-all by default.
• Classification of traffic into predefined classes – Through deep packet inspection, administrators can classify their traffic into business critical, real-time, interactive, or best effort.
• Application-based traffic steering – After traffic is classified, policies can be created to ensure business critical and real-time applications always traverse the highest performing WAN connection.
• Traffic steering based on real-time WAN performance – Using in-line traffic, NetCloud SD-WAN measures latency, loss, and available bandwidth across all available WAN connections.  If performance degrades beyond the predefined thresholds, traffic is dynamically steered to a better performing connection.
• Direct Internet Access – To enhance performance and reduce the costs of backhauling, NetCloud SD-WAN enables secure direct internet access capabilities from sites and vehicles.
• Traffic steering across 5G network slices – Select modems can support up to eight 5G SA network slices. Leveraging NetCloud SD-WAN, when a 5G SA network is in place, the ability to steer applications into the most suitable network slide is available.  (For example, business-critical traffic can be steered into an ultra-reliable low latency slice.)
• Intelligent Link Bonding – Allows the creation of a bonded interface using multiple WAN interfaces.
  • Flow duplication across bonded WAN connections – Provides a highly resilient connection for mission-critical applications by duplicating traffic flows across two diverse connections, increasing availability.
  • Dynamic or weighted flow balancing across bonded WAN connections – Distributes application traffic flows across diverse WAN links according to the real-time performance of the various WAN links or through user-defined weights.
  • Bandwidth aggregation across bonded WAN connections – Aggregates two or more WAN links into one logical link providing more bandwidth (especially for uploads) for applications like video and large file transfers.
• Forward Error Correction – Most effective for chatty TCP-based applications, FEC mitigates against lossy connections by adding parity bits to an application flow to prevent application retries, thereby improving application quality of experience.
• Networkwide application-based policies – With NetCloud SD-WAN, a single policy can be applied across heterogenous product types.

Secure remote access

 Zero Trust Network Access (ZTNA) integrates with an organization’s existing identity provider to provide isolated user-to-resource access for authenticated users.

• Identity verification – Offers integration to any SAML 2.0 compliant Identity Management Platform, preventing identity sprawl. 
• Isolated user-to-resource access – Users are directly authenticated to their authorized resources per session. 
• Least privilege access – Various levels of access, ranging from visibility only to full configuration, can be granted based on the user’s job function or identity.    
• Device posture visibility – In conjunction with the customer's identity management platform, administrators can view details on the device posture (for example, anti-virus installed and running, OS version, and device type) for any device that has the client installed.
• Flexible user authentication – Users can authenticate through an Ericsson Cradlepoint router, a wide range of Windows, macOS, iOS/iPadOS, Android, and Linux clients, or a secure web browser to enable safe remote connectivity from anywhere.
• NetCloud Client (supported on cloud-delivered and customer-hosted deployment options) – This software enables secure remote access to an NetCloud Secure Connect network. The NetCloud Client supports Windows and macOS laptops, iOS mobile devices, and Linux devices. The NetCloud Client is available to download with a ZTNA license.
• Clientless ZTNA (supported on cloud delivered only) – Allows contractors and third parties to access specific resources without requiring a client. Clientless ZTNA supports HTTP, HTTPS, Virtual Network Computing (VNC), Remote Desktop Protocol (RDP), and Secure Shell (SSH) based access. This unique solution leverages isolation technology and protects company assets from unmanaged devices.

(Requires a Premium license)

Hybrid Mesh Firewall (HMF) is a service that can be added to a Secure Connect or SD-WAN network.  With application and web filtering plus integrated IDS/IPS. HMF brings in modern firewall features, without the complexity.

• Application visibility and enforcement – Uses policies and deep packet inspection to determine whether to block or allow traffic, including communications to or from an application. 
• IDS/IPS – Provides continuous monitoring of all north/south and east/west traffic flows to detect and prevent malicious activity. 
• Web filtering – Blocks access to inappropriate web content including high-risk domains that may contain malware.
• Firewall-as-a-Service (supported on cloud delivered only) – Simplifies firewall deployment by delivering firewall services from the cloud instead of requiring local firewalls in all locations.

(Requires a Premium license)

• AI-driven insights – An integrated AIOps dashboard detects performance driven anomalies and flags them to the administrator pinpointing the root cause and recommended remediation.
• Virtual Expert capabilities – While Ericsson’s NetCloud Assistant (ANA) is available across all NetCloud Manager dashboards, more specialized functionality is available with a NetCloud Secure Connect or SD-WAN Premium license.

NetCloud Exchange Appliances and Specifications

NetCloud Virtual Edge is a cost-effective and simple solution for organizations that need to connect to one or more data center or private cloud environments as part of their zero-trust network.

(customer-hosted deployment model only)

NetCloud Exchange Service Gateway is a service delivery platform (or headend) that can reside standalone or in an active/standby configuration in a customer’s data center or hosted cloud. The service gateway aggregates traffic from IoT, vehicle, site, and remote work environments, enforces policy, and provides visibility into every flow.

The NetCloud Exchange Service Gateway Hardware Appliance delivers the full capabilities of the software service gateway in a low-touch, on-premises form factor—ideal for public sector and other organizations that must keep data off public clouds or have limited IT resources.

Physical Measurements & Features