Reduce Firewall Spend

Centralised east-west firewalls (dedicated security appliances positioned to inspect and enforce policy on internal traffic) impose two costs beyond their purchase and maintenance price: throughput bottlenecks as east-west traffic volumes grow, and operational overhead from the firewall change management process. Each policy change requires a ticket, a review cycle, a change window, and a deployment, a process that takes hours to days for a single rule update and becomes a recurring cost at scale. As workloads move and network segments change, the firewall rule base grows in complexity, and the operational cost of maintaining accurate rules grows with it. The throughput limitation of a centralised appliance also forces capacity upgrades when east-west traffic volumes exceed the appliance's forwarding rate, a hardware procurement cycle that interrupts operations regardless of whether the security policy has changed.

Arista's Multi-domain Segmentation Services (MSS) moves the enforcement point from a centralised firewall to the forwarding ASIC of every EOS switch in the fabric, running on the existing switch hardware without requiring new appliance purchases. MSS policies are defined in CloudVision using identity-aware microperimeters: a workload's allowed communications are defined by its identity classification rather than its IP address or VLAN, which means policies remain accurate as workloads move or are reclassified without requiring firewall rule updates. Policy changes defined in CloudVision propagate across all MSS-enabled switches in seconds. The change management latency drops from hours to near-instant. For branch and edge deployments, Arista's Edge Threat Management integrates UTM (Unified Threat Management) capabilities at the network edge, providing the north-south filtering that complements MSS east-west microsegmentation. The combined architecture aligns with the CISA Zero Trust Maturity Model's requirements for distributed enforcement, identity-aware access, and continuous verification.