8/8/2019 Forum Systems: Cisco ACE XML Gateway Replacement Strategy

http://slidepdf.com/reader/full/forum-systems-cisco-ace-xml-gateway-replacement-strategy 1/2

11/25/10 3:isco ACE XML Gateway Replacement Strategy

Page ttp://www.forumsys.com/resources/cisco-ace-replacement-program.php

» Overview

» White Papers

» Data Sheets

» Posters

» Videos

» Newsletters

 

Cisco ACE EOL: Strategies for selecting a Replacement XML Gateway

Learn best practices and requirements for replacing End-of-Life (EOL) Cisco ACE XML Gateway with other technologies.

XML Gateways are core infrastructure components of modern SOA deployments with their ability to integrate services

securely. Typically deployed as hardware appliances, XML Gateways seamlessly control access to services, protect

information through data-level encryption, ensure the integrity of a message through signatures, and controls corporate

information flow. This whitepaper highlights the requirements and process for replacing existing XML Gateways,

specifically ones that have published EOL announcements such as Cisco ACE Gateway. However, the requirements

and migration process is applicable whenever a corporation decides to change its XML Gateway vendor.

Here are the top 5 strategic factors that customersmust consider while choosing a new XML Gateway appliance as

replacement for their existing technology:

Select a patented product or face replacement issues as the patents are enforced.

Pick an XML Gateway and not a product that is like an ESB/Application server.

Demand an Independent Security Assessment on the ENTIRE XML Gateway.

Validate feature/function availability and innovation leadership.Demand flexible replacement costs and options.

We will discuss each salient point in further detail.

In 2003, Network Computing published a bake-off between vendors in XML Gatewayspace. Reactivity (acquired by

Cisco), DataPower (acquired by IBM), Westbridge (acquired by Actional) and a number of other gateway vendors

including Forum Systems, VeriSign and Xtradyne were also a part of the assessment.

Looking back at this vendor assessment, one can see a clear trend: companies such as Cisco and VeriSign that

changed their directions to pursue the pioneer (Forum Systems) eventually gave up on the space. Others like

DataPower that started off as an XSLT network device tried to morph into security and still struggle with their XML

Security Appliance architecture rooted in XSLT transformation.

Although the strategy of a company changing direction to follow a viable market seemed like a good idea at that time, it

had profound future implications on product viability. When a product is not built ground-up to address a specificmarket, architectural comprises ensue that result in the demise of such products in the future. The key factor in picking

any technology solution is to identify the leaders and the followers.

New "me too" vendors continue to follow Forum Systems, the leader in the XML Gateway space, by changing their 

ESB-like products to look like secure XML Gateways, however, they lack the innovation and intellectual property

established by the leader. See fore example,Forum System Issued Patent 7,516,333 for XML Security Gateway.

Step#1: Select Innovators not Followers

Going with a non-patented XML Gateway means that customers will have to replace their XML Gateways in the future

yet again. Customers tend to select innovative and leading technology providers with defensible Intellectual Property

Home »

8/8/2019 Forum Systems: Cisco ACE XML Gateway Replacement Strategy

http://slidepdf.com/reader/full/forum-systems-cisco-ace-xml-gateway-replacement-strategy 2/2

11/25/10 3:isco ACE XML Gateway Replacement Strategy

Page ttp://www.forumsys.com/resources/cisco-ace-replacement-program.php

Home | Privacy Statement | Terms of Use | Contact

© 2001-2010 Forum Systems. All Rights Reserved.

(IP). They prefer to minimize their risk by avoiding trailing "me-too" technologies that continue to copy the leading

patented XML Gateways. Ask for vendors patents. Forum Sentry is the only XML Gateway Appliance with a published

patent (Patent #7,516,333).

Step#2: Understand XML Gateway vs. ESB

Would you add custom code to your network packet firewall? Then why would you ever consider adding custom code

to your XML Gateway? A clear separation of roles should be enforced between an XML Gateway and an

ESB/Application Server. When replacing Cisco ACE XML Gateway, focus on security. Let the ESBs and Application

Servers run your custom code. If you choose an XML Gateway that allows you to drop jar files, shared objects or any

arbitrary code into its runtime environment, then you have selected and XML Gateway with a flawed security model.

Such XML Gateway architectures can make you feel safe while compromising your corporate infrastructure, especially

your sensitive data.

Review vendors' XML Gateway architecture before replacing the Cisco ACE Gateway. Don't make the same mistake

twice. Cisco's architecture permitted dropping code on the Gateway that resulted in a poor security model. Other XML

Gateway vendors have followed Cisco's XML Gateway architecture that permits adding custom code. IBM DataPower 

and Forum Sentry are the only products that do not permit arbitrary code to be dropped into their XML Gateways and

stay true to the XML Gateway roles.

Step#3: Demand Independent Security Assessment

XML Gateways are typically deployed close to the corporate boundary and serve as a centralized conduit for 

information exchange between corporations and their trading partners. The nature, volume, and value of transactions

flowing through the XML Gateway requires a high degree of security and reliability. Review vendors independent

security assessment. FIPS 140-2 is the gold standard for independent security assessment. Demand certification details

from vendors. Sticking an HSM crypto card into a hardware appliance and claiming FIPS certification is not sufficient.

The ENTIRE XML Gateway, not just the HSM crypto card should be FIPS 104-2 certified. For any other certification, ask

for the "boundary" of certification. Most vendors have never subjected their entire XML Gateway Appliance to an

independent security evaluation. Forum Sentry is the only product in the industry to have achieved FIP 140-2 security

certification across the entire hardware boundary.

Step#4: Validate Feature Equivalancy

Migration of your policies from the Cisco ACE Gateway to the replacement XML Gateway should be seamless. The

selected XML Gateway should be architected with modular policy design for fundamental constructs such as Keys,

Encryption/Signature Policies, Firewall rules can be readily moved from the ACE Gateway to the selected replacement

platform. The selected gateway should have the same or better functionality than Cisco ACE Gateway.

Selecting patented, industry-leading XML Gateway is paramount. This ensures that there are no functional gaps

between existing and replacement products. XML Gateway companies that continue to innovate and patent their IP are

more sustainable and provide broader features than vendors that follow the leaders.

Step#5: Expect Flexible Replacement Costs

For corporations that have made a bet on technology that has been EOLed, there are a number of costs including: i)

Product Cost ii) Configuration Cost iii) Transition Costs. iv) On-going support and maintenance costs. Replacement

vendors should have flexible pricing models to accommodate your corporate EOL plan.

Select vendors that can work within your budget and time-lines. Vendors should be flexible in reducing your CapEX

expense while working with your planned multi-year support and maintenance budgets. Depending on the complexity of 

your policies, vendors should be open to helping you with your migration costs. For a duration, you may be required to

run both Cisco ACE and your new XML Gateway together while you migrate away from the ACE Gateway. Your 

selected XML Gateway vendor should provide pricing options to accommodate this transition process.

Summary

XML Gateways are essential components of corporate infrastructure. Choosing the right vendor initially or for 

replacement should be a rigorous and methodical process based on key factors as listed above. Without this rigor,

corporations may to choose inferior technology that, in the future, will have to be replaced yet again.