Cisco Meraki vs HPE Aruba (SD WAN & Cybersecurity)

Cisco SD WAN powered by Meraki can provide customers with a secure SD WAN fabric allowing them to effortlessly progress from legacy MPLS. Meraki vMX is the virtual instance of one of their security and SD WAN appliances, allowing for effortless extension into the public cloud. Supported in AWS, Azure, Google Cloud Platform, Alibaba Cloud, Cisco NFVIS. Cisco SD WAN is optimized for multi-cloud and supports any deployment via any mode of transport.

The Aruba SD WAN and secure edge portfolio supports WAN connections across multiple instances including: broadband, MPLS and LTE cellular. Features consist of: centralized cloud management portal, policy-based routing for 3200+ applications and virtual gateways and hub routing available for AWS and Azure. HP holds a solid 20 year partnership with Microsoft, so it comes with no surprise that Azure and Office 365 are heavily optimized. Aruba Virtual Gateways are a Microsoft preferred solution in the Azure Marketplace.

Cisco Talos team is built of the world's most sought after security researchers and engineers who are dedicated to help defend customers whilst uncovering new vulnerabilities. Cisco Umbrella is their flexible, fast and easy to manage cybersecurity offering. The product includes DNS layer security, secure web gateway, cloud access security broker and application aware firewall functionality.

Using the principles of Zero Trust and SASE, Aruba edge-to-cloud security seamlessly and securely connects anyone/anything at edge locations to the cloud. Aruba SASE components are made up of: Secure Web Gateway (SWG), Firewall as a Service (FWaaS), Cloud Access Security Broker (CASB), Zero Trust Network Access (ZTNA), antivirus, Data Loss Prevention (DLP) and sandbox areas. Additional SD WAN SASE capabilities offered are first packet application identification, automated backups and orchestration.

Meraki has a range of remote work solutions including: next generation WiFi 6, SD-WAN and Auto VPN connections to create an ideal experience for users. Features also include optimized operations with app-based policy enforcement and real time monitoring and bring your own device (BYOD) capabilities.

Aruba offers Remote Access Points (RAPs) which are ideal for micro branches and employees working from home. These small form factor devices enable users to securely connect into the WAN and access corporate resources. Benefits of these access points include zero touch provisioning, advanced wired and wireless security whilst providing high quality application access.

As mentioned earlier, Meraki vMX is their virtual offering allowing for connection into the public cloud. Supported in AWS, Azure, Google Cloud Platform, Alibaba Cloud, Cisco NFVIS. Cisco OnRamp provides users with multi cloud access whilst providing outstanding application experience, security and network performance.

AOS-CX is their cloud native operating system built on microservices architecture allowing for simplified IT operations through automation. It was designed around the four cloud principles: modularity, resiliency, programmability and elasticity. Unsurprisingly, enterprise cloud customers have a better experience with Aruba than others. AWS and Azure user's benefit from simplified routing and resiliency capabilities when using Aruba SD WAN.

The cloud dashboard provides basic event log management and can be used to track a number of events occurring on your network. A range of events can be reported including: BGP sessions, 3G/4G connectivity, DHCP leases and related errors, primary uplink events and VPN sessions. Although larger enterprise customers expecting hundreds of daily logs should consider an external SIEM.

Aruba’s Intrusion Detection and Prevention System (IDPS) allows for threat event data to be sent to a third party Security Incident and Event Management (SIEM) service such as Splunk or Datadog. This is configured on their cloud dashboard, Aruba Central. IntroSpect is their User and Entity Behavior Analytics (UEBA) solution powered by machine learning, which is constantly looking for irregular activity which could indicate a threat.

AMP (Advanced Malware Protection) is Meraki’s self-proclaimed industry leading malware protection solution. It works by pairing a 500+ million file heavy malware database with context aware monitoring and reporting. Again, this is available in the Meraki dashboard. Alongside threat detection, AMP offers increased visibility, enhanced threat defense and overall ease of malware protection management.

Another feature of IntroSpect is the detection of compromised user's and devices, if a threat is signaled then IntroSpect triggers ClearPass to perform a quick change of authorization for the entity involved. After the issue is guaranteed, a network analyst can use IntroSpect’s big data investigation system and begin uncovering the matter in question. A whole variety of information is available, even down to the packet level.

Another feature of AMP, whenever a file is downloaded through a Meraki device the file signature is checked against the malware database. If an issue is clocked, AMP administrators are made aware allowing them to act quickly and quarantine if needed to avoid network wide spread.

Once again, the powerful IntroSpect provides consumers with Network Traffic Analysis (NTA) which, powered by advanced analytics, ML and AI helps to detect, investigate and respond to issues that potentially evade firewalls and perimeter defenses. Performing deep packet inspection (DPI) of all local traffic.

Meraki's work from home solution is designed to be simple but effective. Using their cloud security and real time monitoring allows for consistent app and workload protection. They offer machine learning solutions to identify and resolve performance bottlenecks.

At the front line of defense there should be a firewall to protect your data. These can be physical as in the case of on-premises or virtual in the public/private cloud. Aruba ClearPass is their network access control program which when paired with a firewall, unauthorized access becomes much harder to achieve.

While Meraki doesn’t directly offer vendor risk management tools they are compliant with various security standards. All of their data centers are ISO 27001 Certified and SSAE18 Type II audited. A third party tool such as  ServiceNow would be compatible.

Aruba does have a multi vendor management solution, this being Aruba AirWave. AirWave is an adaptable multi vendor management system for both wired and wireless networks. Utilize key features such as Zero-Touch Provisioning, added user and application visibility, and multi vendor and 3rd party integration.

Meraki realizes that insider risks, whether malicious insider or compromised credentials, are the hardest to detect and the most costly. IBM Security teamed up with Cisco to help customers reduce insider threats with defensive technologies to block known bad activity using advanced analytics to quickly prioritize and remediate any malicious activity.

You can find an excellent User and Entity Behavioral Analytics (UEBA) use case on the Aruba website. IntroSpect can ingest the following data sources: Active Directory logs, firewall logs, DNS logs, VPN logs and internal network flows. Entity360 service makes it effortless to spot anomalies in activity such as excessive numbers of failed logins under a certain credential.

Another feature of the Meraki dashboard is their device management solution Systems Manager. Allowing customers to provision, monitor and secure all endpoint devices. Capable of managing all devices on the network including Meraki MX security and SD WAN appliances, BYODs and any other hardware.

Aruba has put identity governance as the cornerstone of cybersecurity and digital transformation. They offer an Identity as a Service (IDaaS) solution which allows all sizes of enterprises to rationalize and regulate the use of internal applications and information. Access levels are granted according to your role.

The majority of IoT devices aren’t compatible with standard 802.1X security protocols which poses a direct threat to a network. Meraki has a feature called Identity PSK (IPSK) which combines private PSK with RADIUS authentication using MAC address to allow different PSKs to be set for specific clients or groups of clients.

As a work around to IoT device authentication, Aruba’s WiFi 6 access points come supporting multiple IoT technologies. The use of these and applying Zero Trust Security principles allow for automated device identification, policity application and enforcement.

With a purely cloud based approach vulnerabilities can arise. Potential for login credentials to be compromised could provide malicious users access to the central management portal where they could wreak chaos. Meraki does offer 2FA which would help to drastically reduce this issue.

Similar to Meraki, Aruba dashboard is cloud based and can be accessed from anywhere. Two-factor authentication is supported for both computers and mobile phones. Aruba has a dedicated team, Security Incident Response Team (SIRT) for dealing with vulnerabilities discovered in any of their products.

With over $3B+ in revenue in 2020 and 7,000+ employees servicing 7 of the possible 8 regions worldwide, Aruba has to be compliant with a range of different regulations and frameworks. Holding 8 ISO certifications (including 9001, 27001 and 14001), PSD2 (Qualified Trust Service Providers in the OBE Directory) and surprisingly are powered by 100% green energy exclusively produced from renewable sources. They realize that every sector has security regulations to meet, these include: Payment Card Information Data Security Standards (PCI DSS) for retail, Heath Information Portability and Accountability Act (HIPAA) for healthcare and Federal Information Processing Standard (FIPS) for government agencies and departments. Aruba 802.11n WLANs have built in security capabilities that comprehensively address these requirements.