SCHEDULE

Cisco Cloud Networking, supercharged

Home » Blog » Cisco Cloud Networking, supercharged
Portrait of Goran Martić. Goran Martić Instructor
14 September 2026

Isovalent is now under Cisco umbrella – what does it mean?

We are witnessing the merging of compute and networking in various forms and technologies. Network function offloads on smartNICs, in-networking computing (AI collective operations done on “smart” switches), and edge computing in 5G mobile (app/data processing on base stations). Given that Cisco is traditionally strong in networking (both enterprise and data centre), you are in the right place if you are interested in how Cisco is responding to this growing trend – especially with all the new and old cybersecurity challenges. 

Cisco acquired Isovalent back in 2024, a leader in high-performance cloud-native networking. Now, the dust is starting to settle, and we can see the intent behind the acquisition and how it’s shaping Cisco’s portfolio. 

Note: Isovalent pioneered kernel-level, high-performance networking and security for containerised, Kubernetes, and multi–cloud environments. Rather than using traditional user-space sidecars or iptables rules (which introduce massive CPU overhead at scale), Isovalent’s stack leverages Linux kernel programmability. 

First, we need to understand eBPF (extended Berkeley Packet Filter), an underlying new-generation technology powering all new product innovations. eBPF is a new Linux kernel technology that allows custom code to execute safely directly inside the kernel without changing the kernel source code or loading kernel modules. It acts as a sandbox inside the operating system kernel, granting deep, real-time access to network traffic, system calls, and process execution. Without going into details of eBPF programme loading and execution, some of the placement eBPF hooks (execution points) in the context of networking are illustrated on the figure below with a “Bee ePBF” symbol.

 

Isovalent is offering three major standalone, independent products: 

  • Cilium: A CNCF-graduated container network interface (CNI) and service mesh built on top of eBPF. It handles pod-to-pod networking, load balancing, multi-cluster connectivity, and L3–L7 security policy enforcement with near-zero latency penalty. Major hyperscalers (GKE, EKS Anywhere, AKS) use Cilium as their underlying network layer. 
  • Tetragon: An eBPF-based security observability and runtime enforcement tool. It monitors kernel-level events (process execution, file access, namespace escapes, network sockets) to detect and block security threats in real time without waiting for user-space intervention. 
  • Hubble: An observability platform for Cilium that visualises service dependencies, network flows, and HTTP/gRPC/Kafka application metrics in real time. 

 With this knowledge under our belts, let’s investigate how this technology shapes Cisco’s portfolio; specifically, how these products enable Cisco to extend its protection and network management from the network itself all the way to the application level.  

  1. Cisco Security Cloud & multi–cloud Defence
  • Kernel-level Zero Trust: Isovalent provides Cisco with deep runtime security via Tetragon. Security teams can enforce zero-trust policies and prevent zero-day execution at the Linux kernel level, complementing perimeter firewalls and cloud security gateways. 
  • Unified policy enforcement: Connects traditional Cisco firewall/micro–segmentation policies with Kubernetes namespace and pod-level policies across hybrid and multi–cloud environments.

    2. Hybrid & multi–cloud networking (Cilium Mesh + Cisco ACI / Nexus) 

  • Underlay to overlay alignment: Isovalent brings native BGP, IPv6/SRv6, and high-throughput routing directly into Linux hosts. This enables seamless pairings between Kubernetes pods running Cilium and enterprise data centre switching fabrics (Cisco Nexus, Cisco ACI) or Cisco SD-WAN overlays. 
  • Sidecar-less service mesh: Traditional service meshes (like Istio using Envoy sidecars) consume significant memory and CPU per pod. Isovalent provides eBPF-based ambient service mesh capabilities, saving up to 80–90% of infrastructure overhead in large-scale Cisco enterprise deployments.
 

    3. Deep observability (Splunk, ThousandEyes, AppDynamics) 

  • Telemetry without agents: eBPF streams low-level kernel and network telemetry without requiring heavy user-space monitoring agents. 
  • Correlated insights: Integrating Isovalent’s eBPF telemetry with Splunk and ThousandEyes gives platform operations and SecOps unified visibility from the network wire up to the container application protocol (L3 to L7). 

    4. Cisco Hypershield & “live protect” (Zero-day vulnerability mitigation)

  • Live Protect: Using Isovalent Tetragon (eBPF runtime security) alongside Cisco Live Protect, dynamic eBPF-based shields can be deployed directly to the switch infrastructure to protect the switch itself from possible exploits. 
  • Instant CVE patching: When a critical privilege escalation or infrastructure vulnerability is disclosed, SecOps can push compensating eBPF rules to the switch/host layer instantly. 
  • No reboots required: Mitigates zero-day threats in real time without waiting for full NX-OS software upgrades or disruptive reboot cycles.
 

If that wasn’t enough for you, we have one more thing to call out before you leave regarding traditional and cloud-native networking unification. It simplifies application migrations — Isovalent Network Bridge (a VM deployed on existing vSphere clusters) allows you to easily migrate application VMs from traditional VMware environments to other hypervisors (KubeVirt supported for now) or Kubernetes clusters (including Red Hat OpenShift), without changing a single IP address! Furthermore, you can connect K8S workloads with your NX-OS BGP EVPN fabric using VXLANs to provide external connectivity.  

Note: For more details about the scenario, visit https://isovalent.com/blog/post/isovalent-networking-for-virtualization-migrate-vms-without-breaking-the-network/.  

OK, enough talk. Ready to get your hands dirty? Head over to Isovalent labs (which are well made, by the way) and pick any from a dozen of labs to test the game-changing technology. If you are a Cisco partner, you can also look up a “Master Isovalent Networking for Virtualization with OpenShift” lab in a dCloud portal – this one focuses on the latest scenario we mentioned, migrating VMs using Isovalent Bridge and peering K8S cluster (OpenShift) with NX-OS fabric using VXLAN. Happy (secure) networking!