What is Passive Optical Networking (PON)?

Passive optical networking (PON) is a high-speed broadband technology that enables the delivery of multiple services over a single fiber optic cable. XGS-PON – 10G Symmetrical PON –  offers speeds of up to 10 Gbps downstream and 10 Gbps upstream (hence the term ‘symmetrical’), making it ideal for applications such as video streaming, online gaming, and cloud computing.

What Problems Does PON Solve for Out-of-Band Management?

PON addresses the issue of efficiency in terms of both uplink costs and bandwidth usage. Traditional POTS lines and dedicated circuits rely on legacy infrastructure that requires regular maintenance. This infrastructure must scale as more out-of-band devices are added to the network, which increases costs and energy consumption. On top of this, using a 10G uplink for a serial console’s 10K traffic is like throwing away 99% of that high bandwidth. Per Gartner’s Market Guide for Optical Transport Systems report (Published 20 November 2023) the best way to “lower cost and energy per transported bit” is by using technologies such as passive optical networking.

Because PON uses passive optical splitters that have no moving parts or powered components between the central hub and end users, PON is much more efficient for deploying serial consoles close to target assets. These out-of-band devices can be deployed in large quantities and close to the network edge, with up to 256 devices sharing one uplink. This reduces cabling and power requirements, and is ideal for MSP and campus operators, where there are many out-of-band devices distributed over long distances. 

More About PON: GPON and XGS-PON Technologies

Passive Optical Networking (PON) leverages time-division multiplexing (TDM) and different wavelengths of light to transmit and receive data on a single fiber strand. This allows efficient communication among up to 256 devices over a single fiber. Initially developed for fiber-to-the-home (FTTH) deployments, PON technology has evolved to facilitate the addition of network nodes with minimal infrastructure changes. GPON (gigabit-capable PON) and XGS-PON use different frequencies for upstream and downstream data transmission. The upstream headend, known as the Optical Line Terminal (OLT), manages and coordinates the time slots allocated to downstream Optical Network Units (ONUs) for data transmission.

GPON and XGS-PON Support on ZPE Systems’ Nodegrid SR Gateway

ZPE Systems’ Nodegrid SR appliances, which are used as out-of-band access nodes or complete branch gateways, now support GPON and XGS-PON technology (patent pending) via SFP and SFP+ ports. The Nodegrid SR family is offered in multiple form factors to be right-sized for deployments in branch offices, factories, smart buildings, and industrial environments (such as for SCADA).

Having support for GPON and XGS-PON means network engineers now have a flexible choice of high-speed uplink technologies. This versatility makes the Nodegrid SR gateway suitable for edge deployments, where it can establish an OOBI-WAN (out-of-band infrastructure WAN) link, and for data centers, where it enhances uplink efficiency. Given the low bandwidth requirements of serial console and out-of-band communications, PON technology is well-suited for these applications. A single fiber strand can be shared among hundreds of out-of-band and serial console devices using passive optical splitters. Organizations can deploy out-of-band devices close to the racks and edges of the network in a cost- and energy-efficient manner. Additionally, ZPE devices support ONU SFPs compatible with third-party OLT headends, ensuring broad interoperability and integration.

Benefits of Using XGS-PON with ZPE Systems’ Nodegrid SR Gateway

The benefits of using XGS-PON with ZPE Systems’ Nodegrid SR gateway include:

• High-Speed Connectivity: XGS-PON delivers symmetrical speeds of up to 10 Gbps, making it ideal for high-bandwidth applications like video streaming, online gaming, and cloud computing. This ensures consistent and high-quality service for end-users.
• Cost-Effectiveness: Deploying XGS-PON is a cost-effective solution for delivering high-speed broadband services, especially in scenarios where upgrading existing infrastructure may be challenging.
• Scalability: The Nodegrid SR Gateway, acting as an ONU, can connect up to 256 serial consoles through a single fiber strand. PON’s use of asymmetric wavelengths and TDM enables multiple devices to share the same fiber strand efficiently. Optical splitters, which require no external power, facilitate the sharing of fiber between multiple ONUs, which makes scaling much more cost and energy efficient.
• Reliability: The Nodegrid SR gateway is proven by service providers worldwide. Its robust design and compatibility with various network configurations make it a reliable choice for delivering high-quality broadband services.

Figure 1: ZPE Nodegrid SR gateway with XGS-PON ONU support

XGS-PON Enhances Efficiency of Out-of-Band

XGS-PON is a significant advancement over traditional, copper-based uplinks. The integration of XGS-PON support in the ZPE Systems Nodegrid SR Gateway allows network architects to deploy a dedicated out-of-band ring that is not only high-speed but also cost-effective, energy-efficient, and capable of covering longer distances. PON technology, with its ability to handle the lower data rates of out-of-band transmissions, is an ideal uplink medium for serial console transmission. The combination of XGS-PON and the Nodegrid SR Gateway provides a powerful and flexible solution for modern network infrastructure.

Be one of the first to try PON on the Nodegrid SR Gateway

Set up a demo for a deeper dive into PON use cases and how it can benefit your organization.

Schedule a demo

AI data center infrastructure components

Computing

Generative AI and other artificial intelligence technologies require significant processing power. AI workloads typically run on graphics processing units (GPUs), which are made up of many smaller cores that perform simple, repetitive computing tasks in parallel. GPUs can be clustered together to process data for AI much faster than CPUs.

Storage

AI requires vast amounts of data for training and inference. On-premises AI data centers typically use object storage systems with solid-state disks (SSDs) composed of multiple sections of flash memory (a.k.a., flash storage). Storage solutions for AI workloads must be modular so additional capacity can be added as data needs grow, through either physical or logical (networking) connections between devices.

Networking

AI workloads are often distributed across multiple computing and storage nodes within the same data center. To prevent packet loss or delays from affecting the accuracy or performance of AI models, nodes must be connected with high-speed, low-latency networking. Additionally, high-throughput WAN connections are needed to accommodate all the data flowing in from end-users, business sites, cloud apps, IoT devices, and other sources across the enterprise.

Power

AI infrastructure uses significantly more power than traditional data center infrastructure, with a rack of three or four AI servers consuming as much energy as 30 to 40 standard servers. To prevent issues, these power demands must be accounted for in the layout design for new AI data center deployments and, if necessary, discussed with the colocation provider to ensure enough power is available.

Management

Data center infrastructure, especially at the scale required for AI, is typically managed with a jump box, terminal server, or serial console that allows admins to control multiple devices at once. The best practice is to use an out-of-band (OOB) management device that separates the control plane from the data plane using alternative network interfaces. An OOB console server provides several important functions:

1. It provides an alternative path to data center infrastructure that isn’t reliant on the production ISP, WAN, or LAN, ensuring remote administrators have continuous access to troubleshoot and recover systems faster, without an on-site visit.
2. It isolates management interfaces from the production network, preventing malware or compromised accounts from jumping over from an infected system and hijacking critical data center infrastructure.
3. It helps create an isolated recovery environment where teams can clean and rebuild systems during a ransomware attack or other breach without risking reinfection.

An OOB serial console helps minimize disruptions to AI infrastructure. For example, teams can use OOB to remotely control PDU outlets to power cycle a hung server. Or, if a networking device failure brings down the LAN, teams can use a 5G cellular OOB connection to troubleshoot and fix the problem. Out-of-band management reduces the need for costly, time-consuming site visits, which significantly improves the resilience of AI infrastructure.

AI data center challenges

Artificial intelligence workloads, and the data center infrastructure needed to support them, are highly complex. Many IT teams struggle to efficiently provision, maintain, and repair AI data center infrastructure at the scale and speed required, especially when workflows are fragmented across legacy and multi-vendor solutions that may not integrate. The best way to ensure data center teams can keep up with the demands of artificial intelligence is with a unified AI orchestration platform. Such a platform should include:

• Automation for repetitive provisioning and troubleshooting tasks
• Unification of all AI-related workflows with a single, vendor-neutral platform
• Resilience with cellular failover and Gen 3 out-of-band management.

To learn more, read AI Orchestration: Solving Challenges to Improve AI Value

Improving operational efficiency with a vendor-neutral platform

Nodegrid is a Gen 3 out-of-band management solution that provides the perfect unification platform for AI data center orchestration. The vendor-neutral Nodegrid platform can integrate with or directly run third-party software, unifying all your networking, management, automation, security, and recovery workflows. A single, 1RU Nodegrid Serial Console Plus (NSCP) can manage up to 96 data center devices, and even extend automation to legacy and mixed-vendor solutions that wouldn’t otherwise support it. Nodegrid Serial Consoles enable the fast and cost-efficient infrastructure scaling required to support GenAI and other artificial intelligence technologies.

Make Nodegrid your AI data center orchestration platform

Request a demo to learn how Nodegrid can improve the efficiency and resilience of your AI data center infrastructure.
 Contact Us

The world as we know it is connected to IT, and IT relies on its underlying infrastructure. Organizations must prioritize maintaining this infrastructure; otherwise, any disruption or breach has a ripple effect that takes services offline for millions of users (take the recent CrowdStrike outage, for example). A big part of this maintenance is ensuring that all hardware components, including console servers, are up-to-date and secure. Most console servers reach end-of-life (EOL) and need to be replaced, but for many reasons, whether budgetary concerns or the “if it isn’t broken” mentality, IT teams often keep their EOL devices. Let’s look at the risks of using EOL console servers, and why replacing them goes hand-in-hand with securing IT.

The Risks of Using End-of-Life Console Servers

End-of-life console servers can undermine the security and functionality of IT systems. These risks include:

1. Lack of Security Features and Updates

Aging console servers lack adequate hardware and management security features, meaning they can’t support a zero trust approach. On top of this, once a console server reaches EOL, the manufacturer stops providing security patches and updates. The device then becomes vulnerable to newly discovered CVEs and complex cyberattacks (like the MOVEit and Ragnar Locker breaches). Cybercriminals often target outdated hardware because they know that these devices are no longer receiving updates, making them easy entry points for launching attacks.

2. Compliance Issues

Many industries have stringent regulatory requirements regarding data security and IT infrastructure. DORA, NIS2 (EU), NIST2 (US), PCI 4.0 (finance), and CER Directive are just a few of the updated regulations that are cracking down on how organizations architect IT, including the management layer. Using EOL hardware can lead to non-compliance, resulting in fines and legal repercussions. Regulatory bodies expect organizations to use up-to-date and secure equipment to protect sensitive information.

3. Prolonged Recovery

EOL console servers are prone to failures and inefficiencies. As these devices age, their performance deteriorates, leading to increased downtime and disruptions. Most console servers are Gen 2, meaning they offer basic remote troubleshooting (to address break/fix scenarios) and limited automation capabilities. When there is a severe disruption, such as a ransomware attack, hackers can easily access and encrypt these devices to lock out admin access. Organizations then must endure prolonged recovery (just look the still ongoing CrowdStrike outage, or last year’s MGM attack) because they need to physically decommission and restore their infrastructure.

The Importance of Replacing EOL Console Servers

Here’s why replacing EOL console servers is essential to securing IT:

1. Modern Security Approach

Zero trust is an approach that uses segmentation across IT assets. This ensures that only authorized users can access resources necessary for their job function. This approach requires SAML, SSO, MFA/2FA, and role-based access controls, which are only supported by modern console servers. Modern devices additionally feature advanced security through encryption, signed OS, and tampering detection. This ensures a complete cyber and physical approach to security.

2. Protection Against New Threats

New CVEs and evolving threats can easily take advantage of EOL devices that no longer receive updates. Modern console servers benefit from ongoing support in the form of firmware upgrades and security patches. Upgrading with a security-focused device vendor can drastically shrink the attack surface, by addressing supply chain security risks, codebase integrity, and CVE patching.

3. Ease of Compliance

EOL devices lack modern security features, but this isn’t the only reason why they make it difficult or impossible to comply with regulations. They also lack the ability to isolate the control plane from the production network (see Diagram 1 below), meaning attackers can easily move between the two in order to launch ransomware and steal sensitive information. Watchdog agencies and new legislation are stipulating that organizations follow the latest best practice of separating the control plane from production, called Isolated Management Infrastructure (IMI). Modern console servers make this best practice simple to achieve by offering drop-in out-of-band that is completely isolated from production assets (see Diagram 2 below). This means that the organization is always in control of its IT assets and sensitive data.

Diagram 1: Though an acceptable approach, Gen 2 out-of-band lacks isolation and leaves management interfaces vulnerable to the internet.

Diagram 2: Gen 3 out-of-band fully isolates the control plane to guarantee organizations retain control of their IT assets and sensitive info.

4. Faster Recovery

New console servers are designed to handle more workloads and functions, which eliminates single-purpose devices and shrinks the attack surface. They can also run VMs and Docker containers to host applications. This enables what Gartner calls the Isolated Recovery Environment (IRE) (see Diagram 3 below), which is becoming essential for faster recovery from ransomware. Since the IMI component prohibits attackers from accessing the control plane, admins retain control during an attack. They can use the IMI to deploy their IRE and the necessary applications — remotely — to decommission, cleanse, and restore their infected infrastructure. This means that they don’t have to roll trucks week after week when there’s an attack; they just need to log into their management infrastructure to begin assessing and responding immediately, which significantly reduces recovery times.

Diagram 3: The Isolated Recovery Environment allows for a comprehensive and rapid response to ransomware attacks.

Watch How To Secure The Network Backbone

I recently presented at Cisco Live Vegas on how to secure the network’s backbone using Isolated Management Infrastructure. I walk you through the evolution of network management, and it becomes obvious that end-of-life console servers are a major security concern, both from the hardware perspective itself and their lack of isolation capabilities. Watch my 10-minute presentation from the show and download some helpful resources, including the blueprint to building IMI.

On July 19, 2024, CrowdStrike, a leading cybersecurity firm renowned for its advanced endpoint protection and threat intelligence solutions, experienced a significant outage that disrupted operations for many of its clients. This outage, triggered by a software upgrade, resulted in crashes for Windows PCs, creating a wave of operational challenges for banks, airports, enterprises, and organizations worldwide. This blog post explores what transpired during this incident, what caused the outage, and the broader implications for the cybersecurity industry.

What happened?

The incident began on the morning of July 19, 2024, when numerous CrowdStrike customers started reporting issues with their Windows PCs. Users experienced the BSOD (blue screen of death), which is when Windows crashes and renders devices unusable. As the day went on, it became evident that the problem was widespread and directly linked to a recent software upgrade deployed by CrowdStrike.

Timeline of Events

1. Initial Reports: Early in the day, airports, hospitals, and critical infrastructure operators began experiencing unexplained crashes on their Windows PCs. The issue was quickly reported to CrowdStrike’s support team.
2. Incident Acknowledgement: CrowdStrike acknowledged the issue via their social media channels and direct communications with affected clients, confirming that they were investigating the cause of the crashes.
3. Root Cause Analysis: CrowdStrike’s engineering team worked diligently to identify the root cause of the problem. They soon determined that a software upgrade released the previous night was responsible for the crashes.
4. Mitigation Efforts: Upon isolating the faulty software update, CrowdStrike issued guidance on how to roll back the update and provided patches to fix the issue.

What caused the CrowdStrike outage?

The root cause of the outage was a software upgrade intended to enhance the functionality and security of CrowdStrike’s Falcon sensor endpoint protection platform. However, this upgrade contained a bug that conflicted with certain configurations of Windows PCs, leading to system crashes. Several factors contributed to the incident:

1. Insufficient Testing: The software update did not undergo adequate testing across all possible configurations of Windows PCs. This oversight meant that the bug was not detected before the update was deployed to customers.
2. Complex Interdependencies: The incident highlights the complex interdependencies between software components and operating systems. Even minor changes can have unforeseen impacts on system stability.
3. Rapid Deployment: In the cybersecurity industry, quick responses to emerging threats are crucial. However, the pressure to deploy updates rapidly can sometimes lead to insufficient testing and quality assurance processes.

We need to remember one important fact: whether software is written by humans or AI, there will be mistakes in coding and testing. When an issue slips through the cracks, the customer lab is the last resort to catch it. Usually, this can be done with a controlled rollout, where the IT team first upgrades their lab equipment, performs further testing, puts in place a rollback plan, and pushes the update to a less critical site. But in a cloud-connected SaaS world, the customer is no longer in control. That’s why they sign waivers stating that if such an incident occurs, the company that caused the problem is not liable. Experts are saying the only way to address this challenge is to have an infrastructure that’s designed, deployed, and operated for resilience. We discuss this architecture further down in this article.

How to recover from the CrowdStrike outage

CrowdStrike gives two options for recovering:

• Option 1: Reboot in Safe Mode – Reboot the affected device in Safe Mode, locate and delete the file “C-00000291*.sys”, and then restart the device.
• Option 2: Re-image – Download and configure the recovery utility to create a new Windows image, add this image to a USB drive, and then insert this USB drive into the target device. The utility will automatically find and delete the file that’s causing the crash.

The biggest obstacle that is costing organizations a lot of time and money is that with either of these recovery methods, IT staff need to be physically present to work on each affected device. They need to go one by one manually remediating via Safe Mode or physically inserting the USB drive. What makes this more difficult is that many organizations use physical and software/management security controls to limit access. Locked device cabinets slow down physical access to devices, and things like role-based access policies and disk encryption can make Safe Mode unusable. Because this outage is affecting more than 8.5 million computers, this kind of work won’t scale efficiently. That’s why organizations are turning to Isolated Management Infrastructure (IMI) and the Isolated Recovery Environment (IRE).

How IMI and IRE help you recover faster

IMI is a dedicated control plane network that’s meant for administration and recovery of IT systems, including Windows PCs affected by the CrowdStrike outage. It uses the concept of out-of-band management, where you deploy a management device that is connected to dedicated management ports of your IT infrastructure (e.g., serial ports, IPMI ports, and other ethernet management ports). IMI also allows you to deploy recovery services for your digital estate that is immutable and near-line when recovery needs to take place.

IMI does not rely at all on the production assets, as it has its own dedicated remote access via WAN links like 4G/5G, and can contain and encrypt recovery keys and tools with zero trust.

IMI gives teams remote, low-level access to devices so they can recover their systems remotely without the need to visit sites. Organizations that employ IMI are able to revert back to a golden image through automation, or deploy bootable tools to all the computers at the site to rescue them without data loss.

The dedicated out-of-band access to serial/IPMI and management ports gives automation software the same abilities as if a physical crash cart was pulled up to the servers. ZPE Systems’ Nodegrid (now a brand of Legrand) enables this architecture as explained next. Using Nodegrid and ZPE Cloud, teams can use either option to recover from the CrowdStrike outage:

• Option 1: Reboot in Pre-Execution Environment Software – Nodegrid gives low-level network access to connected Windows as if teams were sitting directly in front of the affected device. This means they can remote-in, reboot to a network image, remote into the booted image, delete the faulty file, and restart the system.
• Option 2: Re-image – ZPE Cloud serves as a file repository and orchestration engine. Teams can upload their working Windows image, and then automatically push this across their global fleet of affected devices. This option speeds up recovery times exponentially.
• Option 3 – Run Windows Deployment server on the IMI device at the location and re-image servers and workstations if a good backup of the data has been located. This backup can be made available through the IMI after the initial image has been deployed. The IMI can provide dedicated secure access to the InTune services in your M365 cloud, and the backups do not have to transit the entire internet for all workstations at the time, speeding up recovery many times over.

All of these options can be performed at scale or even automated. Server recovery with large backups, although it may take a couple of hours, can be delivered locally and tracked for performance and consistency.

But what about the risk of making mistakes when you have to repeat these tasks? Won’t this cause more damage and data loss?

Any team can make a mistake repeating these recovery tasks over a large footprint, and cause further damage or loss of data, slowing the recovery further. Automated recovery through the IMI addresses this, and can provide reliable recording and reporting to ensure that the restoration is complete and trusted. 

What does IMI look like?

Here’s a simplified view of Isolated Management Infrastructure. You can see that ZPE’s Nodegrid device is needed, which sits beside production infrastructure and provides the platform for hosting all the tools necessary for fast recovery.

What you need to deploy IMI for recovery:

1. Out-of-band appliance with serial, USB, ethernet interfaces (e.g., ZPE’s Nodegrid Net SR)
2. Switchable PDU: Legrand Server Tech or Raritan PDU
3. Windows PXE Boot image

Here’s the order of operations for a faster CrowdStrike outage recovery:

• Option 1 – Recover

1. 1. IMI deployed with a ZPE Nodegrid device that will start Pre-Execution Environment (PXE) which are Windows boot images that the Nodegrid will push to the computers when they boot up
   2. Send recovery keys from Intune to IMI remote storage over ZPE Cloud’s zero trust platform easily available in cloud or air-gapped through Nodegrid Manager
   3. Enable PXE service (automated across entire enterprise) and define the PXE recovery image
   4. Use serial or IP control of power to the computers, or if possible Intel vPro or IPMI capable machines, to reboot all machines
   5. All machines will boot and check in to a control tower for PXE, or be made available to remote into using stored passwords on the PXE environment, Windows AD, or other Privileged Access Management (PAM)
   6. Delete Files
   7. Reboot

• Option 2 – Lean re-image

1. 1. IMI deployed with a Windows Pre-Execution boot image running PXE service
   2. Enable access to cloud and Azure Intune to the IMI remote storage for the local image for the PC
   3. Enable PXE service (automated across entire enterprise) and define the PXE recovery image
   4. Use serial or IP control of power to the computers, or if possible, Intel vPro or IPMI capable machines, to reboot all machines
   5. Machines will boot and check in to Intune either through the IMI or through normal Internet access and finish imaging
   6. Once the machine completes the InTune tasks, InTune will signal backups to come down to the machines. If these backups are offsite, they can be staged on the IMI through backup software running on a virtual machine located on the IMI appliance to speed up recovery and not impede the Internet connection at the remote site
   7. Pre-stage backups onto local storage, push recovery from the virtual machine on the IMI

• Option 3 – Windows controlled re-image

1. 1. Windows Deployment Server (WDS) installed as a virtual machine running on the IMI appliance (offline to prevent issues or online but under a slowed deployment cycle in case there was an issue) 
   2. Send recovery keys from Intune to IMI remote storage over a zero trust interface in cloud or air-gapped
   3. Use serial or IP control of power to the computers, or if possible, Intel vPro or IPMI capable machines, to reboot all machines
   4. Machines will boot and check in to the WDS for re-imaging
   5. Machines will boot and check in to Intune either through the IMI or through normal Internet access and finish imaging
   6. Once the machine completes the InTune tasks, InTune will signal backups to come down to the machines. If these backups are offsite, they can be staged on the IMI through backup software running on a virtual machine located on the IMI appliance to speed up recovery and not impede the Internet connection at the remote site
   7. Pre-stage backups onto local storage, push recovery from the virtual machine on the IMI

Deploy IMI now to recover and avoid the next outage

Get in touch for help choosing the right size IMI deployment for your organization. Nodegrid and ZPE Cloud are the drop-in solution to recovering from the CrowdStrike outage, with plenty of device options to fit any budget and environment size. Contact ZPE Sales now or download the blueprint to help you begin implementing IMI.

Nodegrid Gate SR w/ Nvidia Jetson Nano

Budget-friendly console server product and dual-CPU NVIDIA platform help organizations protect their infrastructure and AI investments.

Fremont, CA — May 28, 2024 — ZPE Systems, a leader in network infrastructure and management solutions that is now part of Legrand, launches two new products at Cisco Live Las Vegas: the Nodegrid Serial Console Core Edition and the Nodegrid Gate SR platform with embedded NVIDIA Jetson Orin Nano module. These innovative products will empower organizations to better protect their vital IT infrastructure and NVIDIA AI investments from the growing risks of cyber-attacks.

The Nodegrid Serial Console Core Edition is a cost-effective third generation console server that resolves the vulnerabilities left by legacy console servers. It leverages drop-in Isolated Management Infrastructure (IMI) to fully separate management traffic from production networks. The creation of a separate management network provides physical and logical isolation from unauthorized users and cyber threats.  

“The first step in cybersecurity resiliency is proper IT hygiene, starting with the right architecture to remove anxiety from automated patching and recovery,” said Koroush Saraf, VP of Products and Marketing at ZPE Systems. “The Core Edition simplifies IMI, providing secure, isolated management access from any branch office or remote location via any LAN or WAN link type, including cellular connections. This gives customers a safe environment for patching or configuration rollback even during an outage or cyberattack.” 

Though IMI has been used primarily by hyperscalers and big tech brands, the Core Edition enables businesses of all sizes to build their own IMI networks and reap the benefits of a layered security approach at an affordable price. 

“With the NSCP Core Edition, our goal is to make big tech’s resilience practices accessible and affordable for all organizations,” emphasizes Arnaldo Zimmermann, Cofounder of ZPE and VP/GM at Legrand. “Now, anyone can drop in our Gen 3 console server, create their IMI, and close those vulnerabilities created by their outdated devices.” 

ZPE is also releasing the Nodegrid Gate SR with embedded Jetson module. This new platform internally hosts the NVIDIA Jetson Orin Nano module, serving as an out-of-band device for initial bring-up, patching, and upgrading when running NVIDIA workloads. ZPE’s Gate SR with embedded Jetson module offers a dual-CPU platform that uses the same IMI concept for provisioning AI workloads via out-of-band path and allows customers to deploy, manage, and upgrade remotely via ZPE Cloud. This new Nodegrid platform enables organizations to improve industrial floor safety, campus security, and manufacturing quality control, by deploying 3^rd party computer vision software at the edge. Organizations can now add resilience and recovery to the fleet of their NVIDIA AI workloads with ZPE embedded or external AI hardware devices.

To learn more, visit the Core Edition page or meet us in booth 5581 at Cisco Live. 

The new requirements cover everything from protecting cardholder data to implementing user access controls, zero trust security measures, and frequent penetration (pen) testing. Each major requirement defined in the updated PCI DSS 4.0 is summarized below, with tables breaking down the specific compliance stipulations and providing tips or best practices for meeting them.

Citation: The PCI DSS v4.0

PCI DSS 4.0 requirements and best practices

Every PCI DSS 4.0 requirement starts with a stipulation that the processes and mechanisms for implementation are clearly defined and understood. The best practice involves updating policy and process documents as soon as possible after changes occur, such as when business goals or technologies evolve, and communicating changes across all relevant business units.

Jump to the other requirements below:

• Build and maintain a secure network and systems
  • Requirement 1: Install and maintain network security controls
  • Requirement 2: Apply Secure Configurations to All System Components
• Protect Account Data
  • Requirement 3: Protect Stored Account Data
  • Requirement 4: Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks
• Maintain a Vulnerability Management Program
  • Requirement 5: Protect All Systems and Networks from Malicious Software
  • Requirement 6: Develop and Maintain Secure Systems and Software
• Implement Strong Access Control Measures
  • Requirement 7: Restrict Access to System Components and Cardholder Data by Business Need to Know
  • Requirement 8: Identify Users and Authenticate Access to System Components
  • Requirement 9: Restrict Physical Access to Cardholder Data
• Regularly Monitor and Test Networks
  • Requirement 10: Log and Monitor All Access to System Components and Cardholder Data
  • Requirement 11: Test Security of Systems and Networks Regularly
• Maintain an Information Security Policy
  • Requirement 12: Support Information Security with Organization Policies and Programs

Build and maintain a secure network and systems

Requirement 1: Install and maintain network security controls

Network security controls include firewalls and other security solutions that inspect and control network traffic. PCI DSS 4.0 requires organizations to install and properly configure network security controls to protect payment card data.

Requirement 2: Apply secure configurations to all system components

Attackers often compromise systems using known default passwords or old, forgotten services. PCI DSS 4.0 requires organizations to properly configure system security settings and reduce the attack surface by turning off unnecessary software, services, and accounts.

Protect account data

Requirement 3: Protect stored account data

Any payment account data an organization stores must be protected by methods such as encryption and hashing. Organizations should also limit account data storage unless it’s necessary and, when possible, truncate cardholder data.

Requirement 4: Protect cardholder data with strong cryptography during transmission over open, public networks

While requirement 3 applies to stored card data, requirement 4 outlines stipulations for protecting cardholder data in transit.

Maintain a vulnerability management program

Requirement 5: Protect all systems and networks from malicious software

Organizations must take steps to prevent malicious software (a.k.a., malware) from infecting the network and potentially exposing cardholder data.

Requirement 6: Develop and maintain secure systems and software

Development teams should follow PCI-compliant processes when writing and validating code. Additionally, install all appropriate security patches immediately to prevent malicious actors from exploiting known vulnerabilities in systems and software.

Implement strong access control measures

Requirement 7: Restrict access to system components and cardholder data by business need-to-know

This PCI DSS 4.0 requirement aims to limit who and what has access to sensitive cardholder data and CDEs to prevent malicious actors from gaining access through a compromised, over-provisioned account. “Need to know” means that only accounts with a specific need should have access to sensitive resources; it’s often applied using the “least-privilege” approach, which means only granting accounts the specific privileges needed to perform a job role.

Requirement 8: Identify users and authenticate access to system components

Organizations must establish and prove the identity of any users attempting to access CDEs or sensitive data. This requirement is core to the zero trust security methodology which is designed to limit the scope of data access and theft once an attacker has already compromised an account or system.

Requirement 9: Restrict physical access to cardholder data

Malicious actors could gain access to cardholder data by physically interacting with payment devices or tampering with the hardware infrastructure that stores and processes that data. These PCI DSS 4.0 requirements outline how to prevent physical data access.

Regularly monitor and test networks

Requirement 10: Log and monitor all access to system components and cardholder data

User activity logging and monitoring will help prevent, detect, and mitigate CDE breaches. PCI DSS 4.0 requires organizations to collect, protect, and review audit logs of all user activities in the CDE.

Requirement 11: Test security of systems and network regularly

Researchers and attackers continuously discover new vulnerabilities in systems and software, so organizations must frequently test network components, applications, and processes to ensure that in-place security controls are still adequate. ge changes; ensure alerts are monitored.

Maintain an information security policy

Requirement 12: Support information security with organizational policies and programs

The final requirement is to implement information security policies and programs to support the processes described above and get everyone on the same page about their responsibilities regarding cardholder data privacy.

Isolate your CDE and management infrastructure with Nodegrid

The Nodegrid out-of-band (OOB) management platform from ZPE Systems isolates your control plane and provides a safe environment for cardholder data, management infrastructure, and ransomware recovery. Our vendor-neutral, Gen 3 OOB solution allows you to host third-party tools for automation, security, troubleshooting, and more for ultimate efficiency.

Ready to know more about PCI DSS 4.0 Requirements?

Learn how to meet PCI DSS 4.0 requirements for network segmentation and security by downloading our isolated management infrastructure (IMI) solution guide.
Download the Guide

Executive summary

• Opengear’s Operations Manager (OM) appliances are NetOps console servers providing out-of-band (OOB) management for remote network infrastructure.
• While OM appliances provide some automation capabilities, especially with the upgraded Automation Edition, they offer limited third-party integrations and end-device automation features.
• The OM2200 and OM1200 both lack integrated branch gateway functionality and have limited security features overall.
• The Nodegrid platform from ZPE Systems overcomes these limitations with vendor-neutral OOB serial consoles and branch services routers.
• Nodegrid enables end-to-end automation through end-device ZTP and unlimited third-party integrations with leading tools like Ansible and Chef.
• Nodegrid also consolidates data center and branch networking functionality like gateway routing, 5G cellular failover, and security to provide all-in-one solutions.

Reviewing the Opengear Operations Manager platform

Operations Manager (or OM) is Opengear’s line of NetOps console servers. OM appliances come with Smart OOBTM for out-of-band management, including automated port discovery and VLAN support. Opengear’s x86 Lighthouse platform supports Python scripts and Docker container deployments for NetOps automation. Lighthouse also supports over 100 power vendors’ equipment, allowing it to monitor and control UPS batteries, PDU outlets, and power load balancing. It’s important to note that, while the standard (Enterprise) edition of Lighthouse supports Python and Docker, customers must upgrade to the Automation edition for zero-touch provisioning (ZTP) or other third-party automation integrations. Additionally, OM solutions do not support 2FA or SAML authentication.

Opengear OM2200

The Opengear OM2200 Operations Manager model is designed for data center and high-density use cases. It features 16, 32, 48 serial and 24 serial/Ethernet mixed port configuration options, with an optional global LTE-A Pro cellular module. The OM2200 provides five regional options for dual AC power as well as a dual DC power cord model.

Click here to see a complete Opengear OM2200 Operations Manager product SKUs list.

OM2200 Pros:

• Plenty of RAM and storage space
• Many options for power and serial port configurations
• Uniquely broad support for 3rd-party power equipment
• Some NetOps automation capabilities

OM2200 Cons:

• Requires upgraded software licenses for ZTP and most 3rd-party automation
• No 2FA or SAML 2.0 support
• No managed USB serial ports
• No 5G support

Opengear OM1200

The Opengear OM1200 Operations Manager model is meant for small edge deployments. The compact chassis supports 4 serial, 8 serial, and 8 serial/8 Ethernet port combinations. It provides OOB and failover access via dual Ethernet (SFP Fiber is available on the 4E and 8E models) as well as an optional global LTE-A Pro cellular module.

Click here to see a full list of Opengear OM1200 Operations Manager product SKUs.

OM1200 Pros:

• Compact size
• Cost-effective range of port configurations
• Supports 3rd-party power equipment, Docker, and Python

OM1200 Cons:

• Requires upgraded software licenses for ZTP and most 3rd-party automation
• No 2FA or SAML 2.0 support
• It doesn’t have gateway routing/SD-WAN capabilities
• No 5G support

Opengear Operations Manager limitations

Both the OM2200 and OM1200 models suffer from similar limitations regarding automation, especially with the base version of the Lighthouse software. Even the upgraded Automation Edition, which unlocks ZTP and RESTful APIs, doesn’t provide much automation for end devices beyond running Python playbooks. This limits operational efficiency, slows down new deployments, and impedes the team’s ability to quickly rebuild core infrastructure after a failure or ransomware attack. Another issue with the OM1200, in particular, is that while its compact size will save space in your edge data center and branch office rack, it’s still a single-purpose device. That means you still need to purchase separate solutions for gateway routing, switching, and/or edge compute. These additional devices take up space, cost extra money, and require time to configure and manage.

Opengear alternatives from ZPE Systems

ZPE Systems provides an alternative option for NetOps-enabled OOB console servers called the Nodegrid solution. All Nodegrid devices run on the open, Linux-based, x86 Nodegrid OS which supports VMs and Docker containers to run your choice of third-party automation, software-defined networking/SD-WAN, and security applications. Nodegrid’s robust, onboard security protects lost or stolen devices with features like TPM 2.0, encrypted SSD, UEFI BIOS, secure boot, and geofencing. Nodegrid can also extend ZTP and other automation to legacy and mixed-vendor end devices for end-to-end network infrastructure automation. Try ZPE’s product selector to see which of Nodegrid’s serial consoles or integrated branch routers is right for your deployment. Below, we review the two models that serve as direct replacements for the Opengear OM1200 and OM2200 solutions.

Nodegrid Serial Console Plus (NSCP)

The Nodegrid Serial Console Plus (NSCP) is an alternative to the OM2200 for data center and high-density deployments. The NSCP connects 16, 32, 48, or 96 (Patent No. 9,905,980) serial devices, all in a standard 1U rackmount chassis. Dual SFP+, dual Gigabit Ethernet, and optional Wi-FI and 4G/5G LTE modules provide secure Gen 3 OOB management access and failover, ensuring blazing fast speeds and high performance. Plus, the NSCP comes with two managed USB 3.0 ports for additional flexibility.

Click here to see a complete list of Nodegrid NSCP product SKUs.

Nodegrid Net Services Router (NSR)

The Nodegrid Net Services Router (NSR) is an alternative to the OM1200 for edge data center and branch office use cases. The NSR is a modular, compact device that can deliver gateway routing, switching, serial console, and compute capabilities all in a single appliance. Gen 3 OOB and network failover are provided out of the box via dual SFP+ and dual Gigabit Ethernet ports, with optional modules for WiFi and dual-SIM 5G/4G LTE. Additional NSR modules include:

• 16-port GbE Ethernet
• Storage
• 16-port Serial (for console server capabilities)
• 16-port USB serial
• Compute
• 8-port PoE+
• M.2 Cellular/Wi-Fi/SATA
• 16-port GbE Ethernet SFP
• 8-port Ethernet SFP+

Click here to see a complete list of Nodegrid NSCP product SKUs.

Key takeaways:

While the OM1200 and OM2200 provide OOB management with some automation, they have serious limitations that negatively impact operational efficiency. Nodegrid is an Opengear alternative providing a vendor-neutral OOB management platform that delivers unlimited automation, enhanced security, and all-in-one networking for ultimate operational efficiency.

Trade in to get a discount on Opengear alternatives

If you’re ready to replace end-of-life devices from Opengear or other vendors, now’s your chance to get a discount. Visit our trade-in page to get your trade-in offer.
Get Trade-In Offer

See Nodegrid’s Opengear Alternatives in action

Reach out today to view a demo of Nodegrid’s Opengear alternatives in action.
Request a Demo

Opengear OM2200 – Product SKU’s:

Opengear OM1200 – Product SKU’s

Nodegrid Serial Console Plus – Product SKU’s

Nodegrid Net SR – Product SKU’s