Ericsson NetCloud SASE and NetCloud Exchange

SD-WAN enhances WAN resilience and quality of experience (QoE) by optimizing traffic over multiple physical or logical connections including, wired, 5G/LTE, satellite, Wi-Fi as WAN, private APNs, and 5G standalone network slices.

• Zero trust foundation for SD-WAN – While traditional SD-WAN technology leverages encryption and site-based VPN technology to secure traffic over multiple WAN connections, NetCloud SD-WAN leverages a true zero trust foundation that minimizes the attack surface, limits the blast radius, and is deny-all by default.
• Classification of traffic into predefined classes – Through deep packet inspection, administrators can classify their traffic into business critical, real-time, interactive, or best effort.
• Application-based traffic steering – After traffic is classified, policies can be created to ensure business critical and real-time applications are prioritized across the WAN and are always traversing the highest performing WAN connection.
• Traffic steering based on real-time WAN performance – Using in-line traffic, NetCloud SD-WAN measures latency, loss, and available bandwidth across all available WAN connections.  If performance degrades beyond the predefined thresholds, traffic is dynamically steered to a better performing connection.
• Direct Internet Access – To enhance performance and reduce the costs of backhauling, NetCloud SD-WAN enables direct internet access capabilities from sites and vehicles.
• Traffic steering across 5G network slices – Select modems can support up to eight 5G SA network slices. Leveraging NetCloud SD-WAN, when a 5G SA network is in place, the ability to steer applications into the most suitable network slide is available.  (For example, business-critical traffic can be steered into an ultra-reliable low latency slice.)
• Intelligent Link Bonding – Allows the creation of a bonded interface using multiple WAN interfaces.
  • Flow duplication across bonded WAN connections – Provides a highly resilient connection for mission-critical applications by duplicating traffic flows across two diverse connections, increasing availability.
  • Weighted flow balancing across bonded WAN connections – Distributes application traffic flows across diverse WAN links according to user-defined weights for improved efficiency and cost savings.
  • Bandwidth aggregation across bonded WAN connections – Aggregates two or more WAN links into one logical link providing more bandwidth (especially for uploads) for applications like video and large file transfers.
• Forward Error Correction – Most effective for chatty TCP-based applications, FEC mitigates against lossy connections by adding parity bits to an application flow to prevent application retries, thereby improving application quality of experience.
• Networkwide application-based policies – With NetCloud SD-WAN, a single policy can be applied across heterogenous product types.

 Zero Trust Network Access (ZTNA) integrates with an organization’s existing identity provider to provide isolated user-to-resource access for authenticated users.

• Identity verification – Offers integration to any SAML 2.0 compliant Identity Management Platform, preventing identity sprawl. 
• Isolated user-to-resource access – Users are directly authenticated to their authorized resources per session. 
• Least privilege access – Various levels of access, ranging from visibility only to full configuration, can be granted based on the user’s job function or identity.   
• Continuous monitoring for changes in context – Changes in context are monitored, resulting in changes in access privileges if warranted. 
• Device posture visibility – Administrators can view details on the device posture (for example, anti-virus installed and running, OS version, and device type) for any device that has the client installed.
• Flexible user authentication – Users can authenticate through an Ericsson Cradlepoint router, a wide range of Windows, Mac, and Linux clients, or a secure web browser enable safe remote connectivity from anywhere.
• NetCloud Client – This software enables secure remote access to an NetCloud Secure Connect network. The NetCloud Client supports Windows and macOS laptops, iOS mobile devices, and Linux devices. The NetCloud Client is available to download with a ZTNA license.
• Clientless ZTNA (NetCloud SASE only) – Allows contractors and third parties to access specific resources without requiring a client. Clientless ZTNA supports HTTP, HTTPS, Virtual Network Computing (VNC), Remote Desktop Protocol (RDP, and Secure Shell (SSH) based access. This unique solution leverages isolation technology and protects company assets from unmanaged devices.

Hybrid Mesh Firewall (HMF) is a service that can be added to a Secure Connect or SD-WAN network.  With application and web filtering plus integrated IDS/IPS, HMF brings in modern firewall features, without the complexity.

• Application visibility and enforcement – Uses policies and deep packet inspection to determine whether to block or allow traffic, including communications to or from an application. 
• IDS/IPS – Provides continuous monitoring of all north/south and east/west traffic flows to detect and prevent malicious activity. 
• Web filtering – Blocks access to inappropriate web content including high-risk domains that may contain malware.
• Firewall-as-a-Service (NetCloud SASE only) – Simplifies firewall deployment by using cloud firewall capabilities instead of requiring local firewalls in all locations.

• AI-driven insights – An integrated AIOps dashboard detects performance driven anomalies and flags them to the administrator pinpointing the root cause and recommended remediation.
• Virtual Expert capabilities – While Ericsson’s NetCloud Assistant (ANA) is to be available across all NetCloud Manager dashboards, more specialized functionality is only available with a NetCloud SASE Premium license.

• Secure Web Gateway – Ensures web requests align organizational policies. If the request raises any red flags or is linked to a malicious website, the gateway returns a warning or blocks user access.
• Anti-virus – Scans incoming web traffic for known virus signatures, allowing the SWG to detect and block malicious content before it reaches a user's device.
• Cloud Access Security Broker – Acts as an intermediary between end users and the cloud, to control access to cloud-based applications.
• Remote Browser Isolation – Separates users' devices from the act of Internet browsing by hosting and running all browsing activity in a remote, isolated cloud-based container.  Only a safe rendering is delivered to the end user.
• Content Disarm and Reconstruct – Protects against known and unknown threats contained in documents by removing executable content before the file is downloaded to the user’s device.

NetCloud Service Gateway is a services delivery platform (or headend) that can reside standalone or in an active/standby configuration in a customer’s data center or hosted cloud. The Service Gateway aggregates traffic from IoT, vehicle, site, and remote work environments, enforces policy, and provides visibility into every flow.