Ericsson NetCloud SASE

Simple SD-WAN and zero-trust security for distributed WANs

The Challenge

The adoption of Wireless WANs allows fast moving organizations to take advantage of agile connectivity for temporary and fixed sites, vehicles, IoT devices and remote workers.  However, as the WAN becomes more distributed and far more dynamic, a simplified, cellular-centric approach to SD-WAN and security is required.

The Value of NetCloud SASE

Optimized for LTE/5G Wireless WANs, NetCloud SASE provides the modern SD-WAN and security features to help organizations increase WAN resiliency and quality of experience while also protecting their corporate assets, applications, and users from the threat of an attack.

With a range of fully integrated services, NetCloud SASE enables organizations to:

• Dynamically construct zero trust networks in under 6 minutes
• Deliver a highly resilient, high-performance WAN with SD-WAN and intelligent bonding
• Provide secure remote access capabilities for both managed and unmanaged devices
• Protect users from web-borne threats with pre-built web security profiles
• Apply application aware traffic filtering while continuously inspecting traffic with hybrid mesh firewall and IDS/IPS capabilities
• Streamline operations with a truly unified SASE solution (one policy engine, one pane of glass and one provisioning experience) that offers powerful AI insights

NetCloud SASE Capabilities

Secure Connect – The zero trust network foundation, offering a simple-to-manage alternative to complex VPN infrastructures for securely connecting IoT devices, sites, vehicles, and remote workers. As the foundation for all other services, Secure Connect delivers a policy-governed, zero-trust network that can be easily orchestrated to enable highly secure communications from the WAN edge to the cloud.

Zero Trust Network Access (ZTNA) – Secure remote access for employees and contractors, providing a security service that integrates with an organization’s existing identity provider to provide isolated user-to-resource access for authenticated users. It enables secure remote access for internal employees and third parties to resources (IoT devices and/or applications) on the wireless WAN through granular user-based access policies.

SD-WAN – A simpler, more secure SD-WAN, optimized for cellular networks. It allows organizations to provide an outstanding digital experience in environments where applications reside anywhere and require secure access from anywhere. Application-based traffic steering, intelligent bonding, and forward error correction ensure that an elevated level of resiliency and quality of experience is achieved for every user and every location.

Hybrid Mesh Firewall – Enabled with a premium license, hybrid mesh firewall provides application governance, web content filtering to align to acceptable use policies and offers continuous inspection of traffic to detect and prevent malicious activity.

Advanced Web Security (Cloud-delivered version only) – Protects users from malicious web activity with simple pre-set web security profiles. It goes beyond allowing and denying websites, to air-gapping high-risk websites with remote browser isolation to prevent malware/ransomware spread to a user’s device. Downloads from websites are also sanitized providing an extra layer of protection.

NetCloud SASE Components

NetCloud SASE comes in three flexible deployment models:  cloud-delivered, customer-hosted and hybrid.

The following components are available across all three deployment models:  

• For connecting and securing sites, vehicles or IoT devices –  Ericsson WAN edge routers/ appliances provide reliable connectivity for IoT devices, vehicles and fixed/ temporary sites.  

• For connecting and securing users –  Ericsson NetCloud Client (available for Apple, Microsoft, and Linux devices) enables secure remote access to specific resources and assets on the WAN.

• For connecting private applications –  Ericsson NetCloud Virtual Edge is a software-based solution that can be easily deployed in an AWS or Azure private cloud or an on-premises data center to allow controlled access to customer-hosted applications.

• For management and orchestration of the end-to-end solution –Ericsson’s NetCloud simplifies the deployment, management, and ongoing troubleshooting of the network consolidating 5G, advanced networking and security into a single pane of glass.

• For customer-hosted deployments only –  Ericsson’s NetCloud Exchange Service Gateway is a scalable and reliable services delivery platform (or headend) that can reside standalone or in an active/standby configuration in a customer’s data center or hosted cloud.

Why NetCloud SASE is Different

Designed for cellular-centric use cases that include roaming and mobility, with key Wireless WAN optimizations that preserve bandwidth, enhance performance, and deliver a slicing-ready solution as 5G networks evolve to 5G standalone.

Truly unified for unparalleled simplicity. Although many SASE solutions provide unified management, underneath there are still multiple disjointed products, multiple policy engines, and an inconsistent provisioning experience across the assorted services. NetCloud SASE is unified from a management, control, and data plane perspective, offering one true policy engine and one consistent provisioning experience across all networking and security services.

Zero trust built in rather than bolted on. Combines security with the network creation process to construct a zero-trust foundation that is deny-all by default. This provides the secure foundation to build additional policies from. The NetCloud SASE solution obscures all public IP addresses (even for applications and assets that connect to the zero-trust network), ensures assets and applications connecting to the network remain “dark” until explicitly defined, and restricts all access unless explicitly defined by policy. 

Robust security for unmanaged devices. While most SASE solutions provide security for managed devices, unmanaged devices can still put organizations at risk.  NetCloud SASE provides clientless secure access for third-party devices and leverages isolation technology to completely airgap corporate web applications from risky third-party devices – mitigating the risk of malware infection.

NetCloud Management and Operations

NetCloud SASE is fully deployed and managed through Ericsson’s powerful cloud management and orchestration platform, NetCloud.  With features that include zero-touch deployment, multi-layered dashboards and intuitive troubleshooting tools, NetCloud Manager is a valuable assist to lean IT organizations.  Some of the key features include: 

• Virtual Expert capabilities –  Ericsson’s GenAI-based NetCloud Assistant (ANA) uses Natural Language Processing to assist administrators with everyday queries about the network. 

• AI-driven insights – An integrated AIOps dashboard simplifies the ongoing operations of the SASE network by quickly identifying performance-driven anomalies, determining the root cause, pinpointing all affected sites, users, and applications and recommending remediation steps. 

• Centralized flow level visibility –  NetCloud’s Traffic Monitor dashboard is a powerful tool that lets administrators drill into every flow for detailed traffic analysis and forensics.

NetCloud SASE Services and Specifications

NetCloud SASE Appliances and Specifications

Ordering Guide

The NetCloud Service Gateway is a required component to implementing NetCloud Exchange services (Secure Connect, SD-WAN and ZTNA). These services can be purchased as an add-on to any compatible router with a NetCloud Branch, Mobile or IoT service plan, while the NetCloud Service Gateway is purchased based on required network capacity.

For ordering details, see the following:

• Step 1 (required): Select the deployment model NetCloud SASE cloud-hosted or NetCloud Exchange customer-hosted.
• Step 2 (required): Select the NetCloud Service plan(s) for the compatible router(s).
• Step 3 (required NetCloud Exchange only): Select the NetCloud Service Gateway capacity for entire solution (separate part number for high availability).
• Step 4 (required): Select the Secure Connect or SD-WAN site (router-based) license(s) in either Standard or Premium for each router. NOTE: Each NetCloud SASE license includes 500 GB for a shared data pool.
• Step 5 (optional): Select ZTNA in either Standard or Premium per user license(s) (selection of Standard or Premium must match Step 4).
• Step 6 (optional): Select the NetCloud Virtual Edge in either Standard or Premium per each additional data center or private cloud environment beyond where the NetCloud Service Gateway is located (selection of Standard or Premium must match Step 4). NOTE: Each NetCloud SASE license includes 500 GB for a shared data pool.
• Step 7 (optional NetCloud SASE only): Select additional 500 GB data credits to add to the shared data pool.