Cisco ACE EOL: Strategies for selecting a Replacement XML Gateway

Learn best practices and requirements for replacing End-of-Life (EOL) Cisco ACE XML Gateway with other technologies.

XML Gateways are core infrastructure components of modern SOA deployments with their ability to integrate services securely. Typically deployed as hardware appliances, XML Gateways seamlessly control access to services, protect information through data-level encryption, ensure the integrity of a message through signatures, and controls corporate information flow. This whitepaper highlights the requirements and process for replacing existing XML Gateways, specifically ones that have published EOL announcements such as Cisco ACE Gateway. However, the requirements and migration process is applicable whenever a corporation decides to change its XML Gateway vendor.

Here are the top 5 strategic factors that customers must consider while choosing a new XML Gateway appliance as replacement for their existing technology:

We will discuss each salient point in further detail.

In 2003, Network Computing published a bake-off between vendors in XML Gateway space. Reactivity (acquired by Cisco), DataPower (acquired by IBM), Westbridge (acquired by Actional) and a number of other gateway vendors including Forum Systems, VeriSign and Xtradyne were also a part of the assessment.

Looking back at this vendor assessment, one can see a clear trend: companies such as Cisco and VeriSign that changed their directions to pursue the pioneer (Forum Systems) eventually gave up on the space. Others like DataPower that started off as an XSLT network device tried to morph into security and still struggle with their XML Security Appliance architecture rooted in XSLT transformation.

Although the strategy of a company changing direction to follow a viable market seemed like a good idea at that time, it had profound future implications on product viability. When a product is not built ground-up to address a specific market, architectural comprises ensue that result in the demise of such products in the future. The key factor in picking any technology solution is to identify the leaders and the followers.

New "me too" vendors continue to follow Forum Systems, the leader in the XML Gateway space, by changing their ESB-like products to look like secure XML Gateways, however, they lack the innovation and intellectual property established by the leader. See fore example, Forum System Issued Patent 7,516,333 for XML Security Gateway.

Step#1: Select Innovators not Followers

Going with a non-patented XML Gateway means that customers will have to replace their XML Gateways in the future yet again. Customers tend to select innovative and leading technology providers with defensible Intellectual Property (IP). They prefer to minimize their risk by avoiding trailing "me-too" technologies that continue to copy the leading patented XML Gateways. Ask for vendors patents. Forum Sentry is the only XML Gateway Appliance with a published patent (Patent #7,516,333).

Step#2: Understand XML Gateway vs. ESB

Would you add custom code to your network packet firewall? Then why would you ever consider adding custom code to your XML Gateway? A clear separation of roles should be enforced between an XML Gateway and an ESB/Application Server. When replacing Cisco ACE XML Gateway, focus on security. Let the ESBs and Application Servers run your custom code. If you choose an XML Gateway that allows you to drop jar files, shared objects or any arbitrary code into its runtime environment, then you have selected and XML Gateway with a flawed security model. Such XML Gateway architectures can make you feel safe while compromising your corporate infrastructure, especially your sensitive data.

Review vendors' XML Gateway architecture before replacing the Cisco ACE Gateway. Don't make the same mistake twice. Cisco's architecture permitted dropping code on the Gateway that resulted in a poor security model. Other XML Gateway vendors have followed Cisco's XML Gateway architecture that permits adding custom code. IBM DataPower and Forum Sentry are the only products that do not permit arbitrary code to be dropped into their XML Gateways and stay true to the XML Gateway roles.

Step#3: Demand Independent Security Assessment

XML Gateways are typically deployed close to the corporate boundary and serve as a centralized conduit for information exchange between corporations and their trading partners. The nature, volume, and value of transactions flowing through the XML Gateway requires a high degree of security and reliability. Review vendors independent security assessment. FIPS 140-2 is the gold standard for independent security assessment. Demand certification details from vendors. Sticking an HSM crypto card into a hardware appliance and claiming FIPS certification is not sufficient. The ENTIRE XML Gateway, not just the HSM crypto card should be FIPS 104-2 certified. For any other certification, ask for the "boundary" of certification. Most vendors have never subjected their entire XML Gateway Appliance to an independent security evaluation. Forum Sentry is the only product in the industry to have achieved FIP 140-2 security certification across the entire hardware boundary.

Step#4: Validate Feature Equivalancy

Migration of your policies from the Cisco ACE Gateway to the replacement XML Gateway should be seamless. The selected XML Gateway should be architected with modular policy design for fundamental constructs such as Keys, Encryption/Signature Policies, Firewall rules can be readily moved from the ACE Gateway to the selected replacement platform. The selected gateway should have the same or better functionality than Cisco ACE Gateway.

Selecting patented, industry-leading XML Gateway is paramount. This ensures that there are no functional gaps between existing and replacement products. XML Gateway companies that continue to innovate and patent their IP are more sustainable and provide broader features than vendors that follow the leaders.

Step#5: Expect Flexible Replacement Costs

For corporations that have made a bet on technology that has been EOLed, there are a number of costs including: i) Product Cost ii) Configuration Cost iii) Transition Costs. iv) On-going support and maintenance costs. Replacement vendors should have flexible pricing models to accommodate your corporate EOL plan.

Select vendors that can work within your budget and time-lines. Vendors should be flexible in reducing your CapEX expense while working with your planned multi-year support and maintenance budgets. Depending on the complexity of your policies, vendors should be open to helping you with your migration costs. For a duration, you may be required to run both Cisco ACE and your new XML Gateway together while you migrate away from the ACE Gateway. Your selected XML Gateway vendor should provide pricing options to accommodate this transition process.

Summary

XML Gateways are essential components of corporate infrastructure. Choosing the right vendor initially or for replacement should be a rigorous and methodical process based on key factors as listed above. Without this rigor, corporations may to choose inferior technology that, in the future, will have to be replaced yet again.