Secure Routing for AI with Cisco Enterprise Networking

Uh, so that in fact, is me. Uh, it's a picture of me 15 years ago when I first joined Cisco, so I apologize for the dated photo. Uh, again, I'm, I'm Rahul sgi, uh, part of the product management team from, uh, uh, the routing and SD wan, uh, business unit, uh, here to talk about, uh, some exciting things that we're doing for ai, for networking and networking for AI when it comes to the WAN networks.

Okay. Um, so yeah, again, please feel free to jump in and ask me questions, uh, throughout the presentation. Uh, really trying to understand in terms of, uh, call out what a customer's looking for when it comes to WAN networks.

Uh, there's definitely some challenges out there in terms of complexity. Uh, you know, customers wanna, uh, give the best, uh, user experience for their end users, and also making sure they're gonna be ready for the AI branches, right? In terms of capacity, uh, in terms of scaling and also security as well.

Uh, they do intend to give the best user experience, uh, with applications that, uh, are being accessed to the branch. And the requirements of, uh, capacity are only growing, right? And complexity also is, is growing.

Uh, so in terms of, you know, what we're looking at from a trend in the industry is networking and security. Were kind of being managed in silos, and we're seeing that that come closer and closer together, right? So, with that intent, we have actually introduced our, uh, new products in 2025 at Cisco live us, uh, called the Cisco Secure Routers, right?

And what these are really meant to do is to bring the, the best of networking that Cisco has to offer, uh, with a best of class of, uh, security as well, all within the same product, right? And, uh, we are able to do that with the introduction of a new processor called Secure Networking Processor. And we are, I'm gonna get into a lot more details of exactly what innovation has gone into it.

Uh, but with that, we are really able to deliver the high throughputs and capacities that are expected for the future, uh, AI branch. Uh, we are able to run in the same box of full stack, uh, security offering on, on box security, uh, which is our, which is our hybrid mesh firewalls. It's an NextGen firewall, uh, that we are able to run at the branch, right?

Because more and more we are seeing, uh, customers want to do local internet breakout or DIA, right? Uh, and then, uh, we are able to offer both our cloud security options as well as unbox security options for such use cases. Uh, the other big shift that's happening is quantum compute is becoming very relevant in the market.

Uh, so quantum computers are expected to be relevant by 2030. There's a lot of industry, specifically public sector, healthcare, retail, uh, and finance customers for whom, you know, making sure that their quantum safe is becoming very critical. Right?

There are recommendations from NIST and other, uh, you know, know bodies in terms of, uh, what are the timelines when customers should start really looking at quantum safe, uh, uh, WAN networks. Uh, so we are bringing in quantum, uh, safe algorithms, uh, what we call PQC post quantum cryptography, uh, into our products with this new portfolio. Uh, both, uh, I, I'll get into a little more details on that as well.

Uh, we do have options to be able to, uh, meet customers who have a completely cloud strategy. So you can deploy a solutions, uh, with cloud management, or we, we are also able to provide on-prem management, uh, for customers who still, uh, where on-prem, uh, makes more sense for them. Uh, in terms of these, uh, new se secure routers.

It's been about six months that we have, uh, launched these, uh, platforms. We have, uh, thousands of, uh, you know, uh, deployments in terms of customers who have deployed thousands of units and hundreds of customers who already put their, put that in their production, right? We're getting a lot of good feedback.

And the reasons for that is almost every customer who's gotten their hands on a secure router, uh, immediately notices that they're getting huge throughput improvements as compared to any of the predict platforms. Mm-hmm. And that's not just for your IPSec, which is almost three x the performance, but also even your security, uh, capabilities, right?

Uh, and we, what we've done is, uh, in terms of security, we are, you're seeing your, we are running a full stack, IPS ideas, URL filtering, amp thread grid kind of a stack, and we are seeing huge performance improvement. Again, going back to that secure networking processor that's helping us do that. Are you gonna explain what you mean by security effect efficacy?

Sure. And also what you mean by three times IP SEC acceleration. Sure.

So, uh, security efficacy, what we've done is we've gone to a third party vendor, uh, NETEC Open, which is an industry body that certifies, uh, firewalls, you know, not just our product, but all other vendors as well. So we've gone to them and we've asked them to certify our product for IPS ideas and URL filtering, right? So, uh, they've, they basically put it through the basis of, uh, what the security efficacy is, and they give us a score.

2 is the score that this particular product has got, uh, for, uh, IPS ideas and URL filtering. What did you miss on? So I think there are certain, uh, profiles that, uh, they define, like, uh, saying that, Hey, can we find these signatures and those, so that that report is out there on their website, uh, the, the full test report.

So the things that we usually, like anything about 98 or nine, about 98 is kind considered industry standard. Uh, so yeah, there'll always be some things that we're probably not caught upon, and future software releases will, will catch up upon it. Uh, but yeah, it's, it is just a standardized test test that they put our boxes through.

Okay. And then, Uh, and, and about the IP sec. So This is against known threats then?

So, uh, I think we, we are looking for, they're looking for some standard defined ones that we already, because what we have is telos, right? So Cisco Telos is constantly looking at, uh, our entire footprint of customers in terms of threats out there, and they're updating the signatures that we are looking for, right? So any net new signature that comes out is found, even if one customer of Cisco finds it, everybody else is able to leverage it, because now we put it under our, uh, uh, signatures that we, we want to be looking out for.

Okay. So that it's, I think some of us had just had the question on what you were actually measuring for this, but uhhuh, that helps. Okay.

Thank you. Okay. Sure.

Uh, and then I, the IPSec, uh, what we are looking at is for both SD-WAN and routing use cases, so for routing, it's A-D-M-V-P and IPSec Tunnel. Uh, and for sd-wan, it is, uh, our, you know, IPSec tunnel that we built for a full mesh, uh, across all the branches, right? So that IP SEC performance in terms of GPS, uh, uh, throughput is what we are calling out S3 X.

So if, if a particular small branch platform previously did, uh, like 300 MVPs, now we are almost able to do one GBPS for it. Okay? Yeah.

Thank you. Sure. Uh, and then the power consumption, we have made sure that sustainability is a key goal.

Uh, Cisco has some, uh, you know, clear goals for net zero, uh, sustainability by 2030 and 2035. So towards that, we are making sure our products are going to be more efficient from power consumption standpoint, right? If you go by the GBPS per wat, uh, we are able to improve that by a huge amount and also reduce our actual, uh, you know, kilowatt hour that we use, uh, for the products.

And we've brought in a lot of, uh, visibility into our Catalyst SD-WAN manager, where we now have a sustainability dashboard, right? We can tell you exactly, uh, across the portfolio, how much, uh, across your van fabric, how much energy you're, uh, consuming, and then give you good reports, uh, to really be able to understand what your footprints are, and then maybe, uh, even buy, you know, uh, green energy net credits somewhere else, right? Uh, so the next thing I wanna talk about is our secure networking processor.

And again, this is a key innovation that's really driving our, uh, you know, new portfolio of, uh, router, uh, secure routers. Uh, what we have done is previously, uh, we were taking off the shelf CPUs, and now we are actually bringing in, uh, customized, uh, you know, arm processors to be able to build, uh, something for that is dedicated for SD-WAN and security use cases. What that means is that previously we would have to offload certain, uh, you know, cryptographic like encryption and decryption, uh, tasks to something off the CPU, and that would add additional cycles.

Now, we are able to do inline crypto, right? That means we are able to do those functions within the CPU itself, and that helps us accelerate our performance and capabilities. Uh, and like I said, now we are running an integrated firewall, so it's not, it's more native in the way we are running the NextGen firewall stack.

Uh, and we also have on some of the platforms a dedicated AI ML engine, right? And, uh, uh, the hardware is there. We're still trying to come out with the right software capabilities for it.

Uh, so in future releases of iOS xe, but able to going to be leveraging that AI ML engine to do inferencing locally, right? The model itself gets built somewhere else, uh, because on the branch, we are not looking to do modeling at the branch with that AI ML engine. Uh, we are only looking to infer existing model that might be coming from somewhere else.

So we're still in some engineering conversations about that, but, uh, the future looks bright for us there because we already have the hardware in it, and we're gonna be leveraging that in future releases. And, And Ray Lui Consulting, the inferencing you're doing there is to improve security, not improve performance. Is that how I, real, real?

So, So we are looking to, looking at networking, uh, traffic, and then see what we can do to improve the performance of the network, uh, of the network. So there's a performance improvement inferencing activity, not just a security analysis inferencing. Yeah.

Yes. I mean, that's some of the ideas that we are working with our engineering and don't have anything yet. Yeah.

We, we probably will come out with some future software release that will have that capability. And, and where does Zero trust figure into all this? It's really, so Zero trust is like native for us, right?

Because, uh, we, we do a lot of capabilities with our trustworthy systems. There's a lot of features in our trustworthy, uh, solutions like, uh, secure Boot, right? And now Secure Boot with, with PQC.

Uh, we also do like runtime defenses, image verification. Uh, we have something called as a secure TAM trust anchor module, uh, that's able to make sure that it is Cisco hardware. It is assigned to, you know, your, uh, you know, the particular, uh, we, we are, we are completely going by zero trust model, and we validate that, uh, you know, that box actually belongs to the customer, right?

So we are, we are able to do multiple things to make sure that it is, uh, you know, fully secure all the way from boot up to the time that we are, we are passing traffic with IPSec on it. So Frederick Van Hern from, uh, hyphens Consulting. So do you also do the other way around from a security perspective, if you see something weird where you kind of squeeze down the pipe and fill, somebody can overwrite and say, mm-hmm.

This is okay, I mean, this, this, this is based on the fact that typically, uh, data Yeah. Loss or data stealing from, from the inside, right? Yeah.

So that, that is essentially like one of the features of our next gen firewall, which is thread grids, right? So you have sandboxing as a feature, right? Uh, what we call a thread grid.

And, uh, that essentially does what you're asking for, right? So if somebody's all just seeing some behavior internally, then you're able to, based on that signature, you're able to right, sandbox that and then take remediation action as to how you want to deal with It. And when you, when you say signature, you mean profile of the data, or could, could that be a rule based where you say, So, so there can be like multiple definitions of it.

Uh, it can be like, you know, particular, uh, layer three, layer four, uh, information, or even layer seven information. So you we're essentially looking at that and then trying to figure out how to do that. Okay.

Okay. Uh, in terms of networking, uh, we have increased our, uh, WAN interface capacities. So the IO side is constantly growing, what used to be a medium branch where one gig interfaces will be enough.

5 gig as well as 10 gig. And then, uh, in the campus, we used to offer gig activity. Now we are looking at 25 gig.

So there's, uh, constantly like a growth in terms of, uh, the IO capacities that customers are expecting off of us for the AI branch. And then we are, we are actually meeting that new standard on all of these routers. Um, uh, in terms of, uh, programmable microcode, there are other features that we have enabled, uh, to make sure that you know, that the CPOs are able to perform a lot better.

Question. Yeah. Is this SOC that we're talking about, or this chip, is that fully Cisco developed, or can you name the partner if you can't name the partner?

That's understandable. Uh, So it's not fully Cisco developed, but it's arm based is what I can call it arm. Okay.

And then we are partnering with somebody else who's helping us build that. Mm-hmm. But, uh, we have Cisco IP in it.

We have a way to influence the IP in it so that it meets our specific requirements of SD WAN and security for this particular portfolio. Thanks. So, uh, the secure networking processor is what drives the 8,100 to the 8,400.

Uh, and we introduced a total of about, uh, 15 different SKUs. Uh, and this is very rare that we refresh our entire portfolio all in one go. Uh, but this is really what we are hoping would drive the, uh, you know, uh, networking for AI for the future branches and campus and data center edges.

So, uh, all the way from 8,100 to 8,400, like I said, is being driven by the secure networking processor. The 85 hundreds use a different ASIC that we have been, uh, building in-house. And we've had actually our third generation of it, which is a QFP quantum flow processor.

They also use the same architecture, the same inline crypto engine, uh, and the benefits of, uh, higher levels of throughput. And those go all the way up to 40 giga hundred gig band ports. Uh, a lot of the numbers we have put out here are, uh, you know, testament to, you know, the, the multiplier of throughputs that we are able to deliver on these platforms as compared to, uh, their predecessors.

Uh, again, in terms of, uh, security, the threat protection profile that you're seeing here, that's essentially a measuring of IPS ideas, URL filtering, amp thread grid, all of the features turned on with emix traffic, we're able to do up to 11 GPS of throughput for that and for IPSec, again, all of these numbers are not like inflated 1400 by packet numbers. These are actually I mixed traffic with 502, uh, 12 by packet numbers. So, uh, real performance that we are able to deliver for every location, uh, really, you know, making sure that we are ready for, uh, the AI needs of the future.

So I'll keep going to, uh, more on the security front, what we are doing, uh, within our portfolio. Just waiting for a slide to catch up here. So there are a few things that, uh, we are working on, right?

One is, uh, uh, we are making sure that, uh, we have integrations with, uh, our ours e uh, or U-C-T-N-A, uh, kind of, uh, solutions. So if you're looking for cloud security, then, uh, we are able to integrate that. Uh, we also have integrations with ICE as well as, uh, uh, for STT tagging, uh, along with, uh, our switching solutions, uh, I already mentioned about quantum compute, right?

So, uh, it's really becoming important to solve for that because, uh, there are real risks of harvest now, decrepit later, uh, that customers are being worried about. Uh, so we are making sure if we, we talk about PQC, there are two aspects to it. One is the transport itself, the van transport needs to be secured.

Uh, and then two, it's about the secure boot as in terms of how the box itself is being brought up. And we are able to take care of both quantum resistant WAN transport, uh, including Max SEC as a, as well as IPSec, and then quantum, uh, resistant, secure boot. So how is it doing that?

So is it using Secure boot? Is it using another, is the ASIC using, like, what mechanism is it doing and how does that impact the quantum protection? So one, you need to make sure that the boot, uh, the device coming up at the boot up time itself is safe, and that's where Secure Boot comes up.

So that is doing, so there is something called as a trust anchor module. Mm-hmm. And that needs to be p qc safe.

That means the algorithms that it uses to come up, uh, need to be quantum resistant, right? So that is, uh, very much hardware dependent in terms of how we are, uh, bringing up the box, right? Like, uh, in terms of quantum, uh, you know, transport, the problem with quantum computers is that they cannot break a S 2 56.

Uh, in terms of, uh, the algorithm itself, it's about the key exchanges that are a problem, right? So quantum computers are able to break the key exchange that happens between two ends of a IP SEC tunnel establishment. And, uh, there are new algorithms that NIST has defined, uh, to make that key exchange more secure.

It's called ML chem. That's the new standard for the transport. What we are doing is we're bringing in this new ML chem, uh, for the key exchanges, uh, so that they become quantum safe.

So that's how we are solving for the van transport. Uh, the, uh, in terms of the boot up itself is just the, the, the chip that's on the tam that's on, uh, the box itself that needs to be made quantum safe. Got It.

Is there any trade offs for the quantum adding that protection on the quantum? Um, No. It's about a hardware thing.

So, uh, uh, like there are, the refresh cycle or the infrastructure lifecycle in a WAN network is pretty long, right? So if somebody's putting a box today, uh, in 2026, and they have at least a five to seven year ROI for it, they're gonna be using that box all the way till 2030 or 2032, right? And then if quantum computes become prevalent in 2030, uh, then that's a risk factor.

So that's why it becomes important to, for them to think about, uh, saying that, Hey, whatever infrastructure I'm putting in today, and the hardware is ready to be able to meet the needs of what will happen in 2030, Right? And it has no impact on the speed of the network or anything else, then, So the ML chem, uh, algorithm is more heavier in the things that the, uh, platform needs to do, right? That's why the more beefier product, right?

So that it can meet that requirement of more heavy lifting to, uh, implement that new ML chem algorithm. So yeah, we do expect that even with that algorithm, we're still gonna be able to deliver high levels of throughput then as compared to the existing platforms. Cool.

Okay. Cool. Thanks.

Okay, I'll keep going here. Um, okay. My next slide is around, uh, quantum compute.

2 is, uh, um, going to be kind of a requirement for a lot of the public sector customers. Uh, and we'll be able to support EC as well, uh, along with this and, uh, the device to device communication, we are not only talking about, uh, between devices, but even the communication between the Catalyst SD-WAN manager and the device, uh, which is a TLS two, uh, today, will also have to be secured as well, right? So we, we are making sure every aspect of it is covered.

So the next thing I'll talk about is SS e uh, our secure SD-WAN solution, like I said, uh, provides a full on box security. Uh, but at the same time, we are able to provide the cloud security as well with the SSE solution or security services Edge solution. And all, um, being monitored by a thousand is, so, uh, this is an, uh, Cisco and Cisco end-to-end solution.

Uh, we also support other third party vendors, uh, with other SSE vendors. Uh, but at the same time here, uh, we are able to, uh, for customers who have a smaller branch, uh, with a lighter footprint, uh, if they want to go with cloud security, then we are able to offer that. Okay?

Uh, I wanna move in terms of, uh, the operational aspect of, uh, AI for networking, right? How do we bring in AI tools to help, uh, the network admins or the, uh, SecOps person in a company, uh, to better manage the network? Uh, so the first thing I wanna talk about is branches code.

Uh, this is something called, is what we call as Unified branch. We are actually recommending Cisco validated designs, uh, to be able to do easier deployment, right? So most customers or partners that are implementing for customers have A-C-I-C-D pipeline, right?

So they build scripts, uh, with Ansible or Terraform, and then they want to be able to scale the deployment pretty quickly, right? If, if they want to deploy a hundred branches, it should not be a six months effort. It should be in days and not in, uh, months.

Mm-hmm. Right? So what we are able to do is, um, based off our, you know, Cisco validated designs, we are able to, uh, recommend a full stack solution of, uh, routing, switching and wireless, where you can quickly build scripts, uh, to automate all of that, uh, with, you know, uh, things like Ansible and Terraform.

That's one way to do it. The other one is to use workflows, which Shai was talking about. So within our own, uh, management solutions on the Meraki dashboard or on the Swan Manager, uh, we are able to offer, uh, you know, workflows that can quickly deploy, uh, hundreds of branches at a time, right?

And it has integrations with the AI assistant. If you go to the AI assistant and say, I want to deploy, uh, five branches right at New York, at San Francisco, Chicago, Boston, uh, and selected Dallas. So now you're able, it's quickly able to ask you the right set of questions in terms of what inputs you want to give for those, uh, you know, van deployment.

And then once you say that, okay, I have two van transports and, uh, two, uh, service side, uh, uh, links, and then I want these features enabled, it'll ask you a set of questions. And once you've input that, uh, it's able to quickly just deploy it to all the sites, right? So there's a lot of automation and simplification of operations, both for Day Zero and Day N that we are able to do, uh, using, uh, uh, these AI tools.

And then the Cisco validated designs with Unified Branch, uh, the unified management is about these secure routers are able to be managed both by the Catalyst SDWAN manager, which is a lot more, has a lot more richness in the networking stack we have to offer. Uh, and then, uh, we are also able to offer this with our, uh, Meraki dashboard as well, uh, where we are able, it's a lot more simpler, but we are able to offer a full stack story, uh, and also have end-to-end assurance, right? Visibility is super critical, being able to troubleshoot and find where the problems are.

Uh, so we are, we are giving you that full visibility into the network when it comes to the end-to-end, uh, multi-layer assurance. Uh, we are, excuse me, uh, gimme a second. Uh, yeah.

When it comes to the Multier Assurance, we are able to, uh, irrespective of where you're consuming your, uh, applications from, uh, you know, able to kind of, you know, uh, give you the assurance, uh, for your entire VAN network, uh, for time cycle. I'll, I'll move into some quick examples, right? So we do have a few, uh, ways that we are using that AI tools, uh, to help our network admins and SecOps admins to get, to have to better manage the network.

The first one is called Predictive Path recommendations. PPR, uh, what we are doing is we are looking at the network behavior, uh, of the van transports, uh, over a period of time, let's say we, we look at the last 30 days of data, and then we can recommend as to what is the best transport that you have, uh, between your internet and MPLS, uh, for a particular time of the day. Let's say there's a particular event being planned for, uh, you know, at, at one of the sites, right?

So if a CEO is giving, uh, you know, uh, uh, an all hands delivery at a particular site, then they can actually look at historical performance of the different transports for that particular site, and then select what is the most optimal path for it, right? So essentially analyzing data and then bringing recommendations to, uh, the network admins in terms of what would be the, uh, best path to take at a particular time of the day for our, or for a particular application. Uh, again, it's only recommending, it's not changing it, it's up to the network admin to take that call.

Uh, again, another modeling that we do with AI tools is bandwidth forecasting. We're able to, uh, look at historical performance of how the bandwidth at a particular site is constantly growing, uh, and then based off that recommend saying that, Hey, you need to upgrade your circuits, your van circuits, uh, from one gig to let's say two gig or to 10 gig or whatever, right? So, uh, again, we are able to use these tools, uh, to recommend, uh, you know, to analyze the data and then recommend what's the best thing to do for the VAN Network.

Uh, and lastly is animal detection. We are looking at multiple, uh, attributes that are, that are being monitored for the network in terms of, uh, um, you know, your round trip time or jitter or loss. We are looking at, we are looking at all of these attributes and saying, whenever you see an ly it, it, it basically, uh, sends, uh, error or, uh, or a message to the network admin saying that you are seeing some behavior that is not normal, right?

So let's say at one at my New York site, I am, uh, seeing jitter to be higher than what it's been for the past 30 days, and that's an annually. And it immediately alerts saying that, Hey, there's something wrong at the site in terms of its behavior. Uh, you should go investigate it further.

Right? And in terms of troubleshooting itself, uh, Shio was talking about the AI assistant, uh, uh, that that is something really powerful in terms of troubleshooting and even o even opening up attack case, right? So you can, you can ask the AI assistant to open up attack case.

So, um, that's Ray Lu Silverton Consulting, all these features are part of the AI assistant. So a lot of them are integrated to AI assistant. Um, but the AI system can be a separate thing that you do a lot more.

Uh, things with, uh, these, some of the, some of the times they're just alerts on your dashboard, uh, the, the animal detection or PPR, uh, predictive recommendations. Uh, so you can directly go into the dashboard and then, uh, use those recommendations. But, uh, the AI assistant is also integrated in a way where if you go ask it, what's wrong with my, uh, New York site?

And it's gonna be using some of these recommendations and data to give you those results. And, and how is that factored into, uh, hyper fabric? Does hyper fabric work in this environment as well?

Or, so Not, not specifically hyper fabric. Uh, so this is not connected directly to that. The recommendations are local within the Catalyst SD-WAN Manager.

Okay. And this is my last slide. Um, I'll just sum it up.

We, we are looking to, you know, help simplify the VAN operations by bringing the right AI tools for networking, uh, in terms of the Cisco validated designs with, uh, uh, the right workflows and also the other AI tools I spoke, I spoke about, uh, we are, uh, wanting customers to be ready for, uh, AI with the right networking products, including the, uh, secure routers, uh, for the, uh, branch networks. And then, uh, essentially reduce risk at every layer by having all the right security controls, including PQC, secure Boot, uh, you know, all the other IP SEC funnels on box security. I think so.