ConSentry Networks

» see consentry.com as it lived, on the wayback machine

~ the goodbye ~

Network access control arrived as a category around 2003, and the idea behind it was reasonable. A device plugging into the corporate network should have to prove something about itself before the network carries its traffic: who the user is, whether the machine is patched, what it is allowed to reach. ConSentry Networks was founded in Milpitas, California that same year, by Mario Nemirovsky and by Jeff Prince, who had co-founded Foundry Networks before it.

What ConSentry built was not a box you bolted on beside the network. The company put the enforcement into the switch itself, selling LANShield switches and LANShield controllers with custom multi-core silicon that could read the username, the device, the application at layer seven and the destination for every flow, and apply policy to all of it at up to ten gigabits per second. On the engineering merits this was the right place to do the work, since the switch is the first device that sees every packet a machine sends.

It also meant the sale was enormous. To buy into ConSentry, a customer had to replace access switches that were working perfectly well, or install an entire extra layer of switches in front of the ones they had, purely to get the access controls distributed. The company was asking a network manager to rip out infrastructure on the strength of a feature, against incumbents who sold the infrastructure itself. Over six years ConSentry borrowed 80.4 million dollars to keep making that argument, the last 9.4 million arriving in January 2009.

~ the chronicle ~

~ the pitch that kept changing ~

ConSentry started out selling the thing the category was named after, and then spent years walking away from the name. As network access control got harder to sell on its own, the marketing shifted to user and application control, which is a description of the same silicon pointed at a different buyer's anxiety. Tim Greene's obituary in Network World is blunt about why that never worked: the company faced an uphill battle against every major switching vendor, and nothing about the repositioning changed the size of the purchase order.

Meanwhile the feature was being absorbed. Cisco and Juniper built access control into their own network devices, which turned a startup's whole product into a checkbox on a line item the customer was already buying. Enterasys did the same. From that point the dedicated vendors were selling against hardware their buyers had decided to purchase anyway, with the contested feature already in the box.

~ the day ~

On 20 August 2009 the employees were told and started clearing out their offices. Nemirovsky, reached that evening, said it was a sad day and that he had no information about what would happen to customers holding support contracts. He hoped they would get support. Network World tried the rest of the management team and got nobody. Several of the voicemail boxes were already full, and the main line had no receptionist answering it.

~ the rest of the category ~

ConSentry was not alone, and the list around it is the actual story of network access control. Lockdown Networks and Cayman Systems had already folded. Mirage Networks was bought by TrustWave earlier that year. Vernier Networks gave up on the name entirely and became Autonomic Networks. Nortel had a NAC offering, and by August 2009 it was tangled in Nortel's bankruptcy. The concept survived; almost nobody who set out to sell it as a product did.

This is the part of the internet I have only ever been downstream of. In 2009 I was finishing at university on a TTNet line, and the switches this company wanted to replace sat in buildings I had no reason to enter, enforcing policies on employees I was not one of. Eighty million dollars and six years of engineering went into a box, and the people whose traffic it was built to inspect never learned the box existed.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »