See More East-West Traffic with Asimily Edge on Cisco Catalyst Switches

Security teams want deeper visibility into east-west traffic without taking on more hardware to manage. With Asimily Edge on Cisco Catalyst switches, they get less to operate and more to see: one fewer data collection appliance to own and maintain, and an additional source of east-west traffic that reduces blind spots across IoT, OT, IoMT, and IT.

Now, the Asimily Edge collector software runs as a containerized application on supported Cisco Catalyst switches through Cisco IOx application hosting. By using deep packet inspection of mirrored traffic within the switch, Asimily gains richer, more granular telemetry at the point where devices connect.

Why Flow Data and SNMP Fall Short

Many teams collect east-west data through NetFlow, sFlow, and Simple Network Management Protocol (SNMP) walks. Each adds its own useful insight, but none is the same as raw network traffic. Asimily thrives on more data to do everything the platform does from inventory through to segmentation orchestration. Flow records summarize that two devices talked. SNMP polls report device and port status at intervals. Richer data leads to faster updates when devices change and more intelligent recommendations for all of Asimily’s other capabilities such as Threat Detection, Configuration Control, and many others.

Flow export also takes work. Each switch model needs its own export configuration, and every network refresh can change it.

What Asimily Edge Does Inside the Switch

The Asimily Edge IOx application receives mirrored traffic from a Switched Port Analyzer (SPAN) session on the switch and processes it locally. It then sends the results to the customer’s Asimily portal. When the application starts, it enrolls itself with the customer’s tenant and appears on the Edge dashboard, typically within minutes.

Asimily Edge is the same data collector in every form: a physical appliance (Asimily customers’ most favored option), a virtual machine or Docker container, and now an IOx application. The result is one telemetry pipeline and one inventory across all three. That detail helps Asimily classify each device, understand how it communicates, and recommend segmentation policy that restricts it safely.

With SPAN traffic, Asimily gets the richest information: access to potentially every network packet that can be analyzed with deep packet inspection. This helps provide a safely gathered device inventory, stronger threat detection, and identification of exploitable vulnerabilities. SPAN traffic is preferred over alternatives like sFlow, which provides only sampled network data, and NetFlow, which provides only aggregated data. So where the application is installed, teams do not need to build flow export policies for each switch model to get traffic details from that switch.

Why One Early Customer Asked for It

One of the early adopters was an advanced customer who had an acute need due to a planned restructuring of its network. The restructuring was changing how traffic reached Asimily, and an assessment the year before had recommended ways to increase visibility. Some east-west traffic never left its network segment and therefore was unavailable to Asimily.

When Asimily partnered with them to deploy the IOx application, it offered a more direct path to better data with lower effort and cost. The customer’s team is deploying it on its switches and expects more granular telemetry to fill gaps in network traffic. Its network engineers also asked pointed questions about footprint, updates, and security review. The answers appear below.

Deploy on One Switch or Many

Teams can install the application on a single switch through the switch web interface or command line, or deploy it to many switches at once from Cisco Catalyst Center. Each switch needs a SPAN session pointing at the application, and the application needs outbound access to Asimily.

The application’s resource defaults come from its package and can be adjusted from the switch command line for a specific model.

Asimily Edge IOx Application Resource Defaults

Resource	Default
CPU	2,100 CPU units
Memory	1,024 MB
Disk	25,000 MB

How Telemetry Sources Compare

How do the common ways of collecting east-west data compare?

East-West Telemetry Sources Compared

Source	What It Shows	Typical Setup	East-West Detail
NetFlow or sFlow	Summary records of which devices talked and how much	Flow-export configuration per switch model	Summary only
SNMP walks	Device and interface status, polled at intervals	Credentials and polling schedules per device, only for devices that can withstand SNMP traffic	Limited
SPAN to an Asimily Edge appliance	Mirrored traffic analyzed by a separate appliance or virtual machine	SPAN design and collector placement	Detailed
SPAN to Asimily Edge inside the switch	Mirrored traffic analyzed on the switch itself	One SPAN session and the IOx application	Detailed

Common Questions From Network Teams

How Is Asimily Edge Kept Up to Date?

The Asimily software inside the container updates automatically, without manual steps. The container itself changes rarely, though a switch upgrade may call for reinstalling it.

Can It Run Alongside Other Switch Applications?

Yes, provided the combined needs fit the app-hosting quota IOS allocates on the switch. In one worked example, Asimily Edge and Cisco’s ThousandEyes agent together needed about 3,950 CPU units and 1.5 GB of memory, typically well within the default quota on Catalyst 9300 platforms.

How Can We See What It Uses?

IOS reports the app-hosting quota, what remains, and the application’s allocation and live use. In the lab, Asimily Edge operates optimally with the default allocated resources. It also drops to zero CPU usage when the switch needs its resources for its primary routing activity.

Which Switches, and How Many at Once?

Supported switches follow Cisco’s IOx platform support matrix. Teams can install on one switch or push to many from Cisco Catalyst Center, after configuring SPAN on each switch.

What Changes for the Security Review?

Cisco IOx application hosting manages application security at the Cisco level, and Asimily applies the same hardening it uses on its hardware Edge, including secure communication with the cloud. Only specific outbound connections are required, not broad internet access.

See It in Your Network

Better telemetry helps at every step, from discovery to the segmentation policy that follows. Request a demo to see Asimily Edge running inside your Cisco Catalyst switches.