Cisco ACE XML Gateway Replacement Strategy 11/25/10 3:35 PM

Home Products Security Identity Integration Resources Downloads Company Support Replace
Home »

Cisco ACE EOL: Strategies for selecting a Replacement XML Gateway

» Overview Learn best practices and requirements for replacing End-of-Life (EOL) Cisco ACE XML Gateway with other
» White Papers technologies.
» Data Sheets
XML Gateways are core infrastructure components of modern SOA deployments with their ability to integrate services
» Posters
securely. Typically deployed as hardware appliances, XML Gateways seamlessly control access to services, protect
» Videos
information through data-level encryption, ensure the integrity of a message through signatures, and controls corporate
» Newsletters information flow. This whitepaper highlights the requirements and process for replacing existing XML Gateways,
specifically ones that have published EOL announcements such as Cisco ACE Gateway. However, the requirements
and migration process is applicable whenever a corporation decides to change its XML Gateway vendor.

Here are the top 5 strategic factors that customers must consider while choosing a new XML Gateway appliance as
replacement for their existing technology:

Select a patented product or face replacement issues as the patents are enforced.
Pick an XML Gateway and not a product that is like an ESB/Application server.
Demand an Independent Security Assessment on the ENTIRE XML Gateway.
Validate feature/function availability and innovation leadership.
Demand flexible replacement costs and options.

We will discuss each salient point in further detail.

In 2003, Network Computing published a bake-off between vendors in XML Gateway space. Reactivity (acquired by
Cisco), DataPower (acquired by IBM), Westbridge (acquired by Actional) and a number of other gateway vendors
including Forum Systems, VeriSign and Xtradyne were also a part of the assessment.

Looking back at this vendor assessment, one can see a clear trend: companies such as Cisco and VeriSign that
changed their directions to pursue the pioneer (Forum Systems) eventually gave up on the space. Others like
DataPower that started off as an XSLT network device tried to morph into security and still struggle with their XML
Security Appliance architecture rooted in XSLT transformation.

Although the strategy of a company changing direction to follow a viable market seemed like a good idea at that time, it
had profound future implications on product viability. When a product is not built ground-up to address a specific
market, architectural comprises ensue that result in the demise of such products in the future. The key factor in picking
any technology solution is to identify the leaders and the followers.

New "me too" vendors continue to follow Forum Systems, the leader in the XML Gateway space, by changing their
ESB-like products to look like secure XML Gateways, however, they lack the innovation and intellectual property
established by the leader. See fore example, Forum System Issued Patent 7,516,333 for XML Security Gateway.

Step#1: Select Innovators not Followers

Going with a non-patented XML Gateway means that customers will have to replace their XML Gateways in the future
yet again. Customers tend to select innovative and leading technology providers with defensible Intellectual Property

http://www.forumsys.com/resources/cisco-ace-replacement-program.php Page 1 of 2
Cisco ACE XML Gateway Replacement Strategy 11/25/10 3:35 PM

(IP). They prefer to minimize their risk by avoiding trailing "me-too" technologies that continue to copy the leading
patented XML Gateways. Ask for vendors patents. Forum Sentry is the only XML Gateway Appliance with a published
patent (Patent #7,516,333).

Step#2: Understand XML Gateway vs. ESB

Would you add custom code to your network packet firewall? Then why would you ever consider adding custom code
to your XML Gateway? A clear separation of roles should be enforced between an XML Gateway and an
ESB/Application Server. When replacing Cisco ACE XML Gateway, focus on security. Let the ESBs and Application
Servers run your custom code. If you choose an XML Gateway that allows you to drop jar files, shared objects or any
arbitrary code into its runtime environment, then you have selected and XML Gateway with a flawed security model.
Such XML Gateway architectures can make you feel safe while compromising your corporate infrastructure, especially
your sensitive data.

Review vendors' XML Gateway architecture before replacing the Cisco ACE Gateway. Don't make the same mistake
twice. Cisco's architecture permitted dropping code on the Gateway that resulted in a poor security model. Other XML
Gateway vendors have followed Cisco's XML Gateway architecture that permits adding custom code. IBM DataPower
and Forum Sentry are the only products that do not permit arbitrary code to be dropped into their XML Gateways and
stay true to the XML Gateway roles.

Step#3: Demand Independent Security Assessment

XML Gateways are typically deployed close to the corporate boundary and serve as a centralized conduit for
information exchange between corporations and their trading partners. The nature, volume, and value of transactions
flowing through the XML Gateway requires a high degree of security and reliability. Review vendors independent
security assessment. FIPS 140-2 is the gold standard for independent security assessment. Demand certification details
from vendors. Sticking an HSM crypto card into a hardware appliance and claiming FIPS certification is not sufficient.
The ENTIRE XML Gateway, not just the HSM crypto card should be FIPS 104-2 certified. For any other certification, ask
for the "boundary" of certification. Most vendors have never subjected their entire XML Gateway Appliance to an
independent security evaluation. Forum Sentry is the only product in the industry to have achieved FIP 140-2 security
certification across the entire hardware boundary.

Step#4: Validate Feature Equivalancy

Migration of your policies from the Cisco ACE Gateway to the replacement XML Gateway should be seamless. The
selected XML Gateway should be architected with modular policy design for fundamental constructs such as Keys,
Encryption/Signature Policies, Firewall rules can be readily moved from the ACE Gateway to the selected replacement
platform. The selected gateway should have the same or better functionality than Cisco ACE Gateway.

Selecting patented, industry-leading XML Gateway is paramount. This ensures that there are no functional gaps
between existing and replacement products. XML Gateway companies that continue to innovate and patent their IP are
more sustainable and provide broader features than vendors that follow the leaders.

Step#5: Expect Flexible Replacement Costs

For corporations that have made a bet on technology that has been EOLed, there are a number of costs including: i)
Product Cost ii) Configuration Cost iii) Transition Costs. iv) On-going support and maintenance costs. Replacement
vendors should have flexible pricing models to accommodate your corporate EOL plan.

Select vendors that can work within your budget and time-lines. Vendors should be flexible in reducing your CapEX
expense while working with your planned multi-year support and maintenance budgets. Depending on the complexity of
your policies, vendors should be open to helping you with your migration costs. For a duration, you may be required to
run both Cisco ACE and your new XML Gateway together while you migrate away from the ACE Gateway. Your
selected XML Gateway vendor should provide pricing options to accommodate this transition process.

Summary
XML Gateways are essential components of corporate infrastructure. Choosing the right vendor initially or for
replacement should be a rigorous and methodical process based on key factors as listed above. Without this rigor,
corporations may to choose inferior technology that, in the future, will have to be replaced yet again.

Home | Privacy Statement | Terms of Use | Contact

© 2001-2010 Forum Systems. All Rights Reserved.

http://www.forumsys.com/resources/cisco-ace-replacement-program.php Page 2 of 2