The company Basis, a leader in the Russian market for dynamic IT infrastructure management software (part of RTK-TSOD Group), has released a new version of the first domestic standalone solution for organizing software-defined networks. In addition to migration without connection interruption, the release significantly reworks the network security model: dynamic security groups, rule and policy schedules, change versioning, and traffic mirroring have been introduced.
<b>Migration without connection interruption</b>
Basis SDN 1.3 preserves network connections when migrating a virtual machine from one hypervisor to another – to do this, simply enable session state control in security rules (stateful access lists). Application and service isolation rules continue to apply. In practice, this means that compute nodes can be serviced during working hours without weakening network protection or disrupting user services. Additionally, support for extended DHCPv4 and DHCPv6 options has been added, which automatically assign network settings to virtual machines upon startup – meaning machines can be deployed en masse, without manual network configuration for each.
<b>Segment becomes a security object</b>
The network segment in 1.3 is a full-fledged object of the security model: upon its creation, a linked security group is automatically formed, which replicates the composition of the segment's logical ports and is not available for editing. The configuration cannot diverge from the actual network composition, and the segment is ready for use in rules, policies, and mirroring sessions immediately after creation. In a number of foreign solutions, the lifecycles of the segment and the group are separated, and after deleting a segment, empty “orphaned” groups remain, which have to be cleaned manually – this problem is avoided by design here.
Service groups and security groups have received a hierarchy with five levels of nesting by default. One group can be part of several parent groups without duplicating entries, and navigation works in both directions: the administrator sees both the composition of the group and all groups where it is used – meaning they can assess the scope of an change before applying it. For each logical port, the system shows which nested group it is inherited from.
<b>Dynamic groups: new machines automatically fall into the right rules</b>
The composition of a security group can now be formed automatically based on selection criteria. The constructor is three-level – condition, condition group, condition set; conditions are combined with logical “AND” and “OR”, and any of them can be marked as an exception in the same window. Selection is based on attributes of logical ports and segments, as well as virtual machine names, with support for string comparisons and regular expressions. A typical scenario: “all machines in prod-segments whose name ends with Web, except for the PCI DSS segment” is set once – and the administrator no longer needs to manually add each new VM to the required groups.
<b>Schedules without cron</b>
Security rules and policies can be assigned an action schedule based on intervals configured in a separate constructor. The time zone is explicitly set, the system does not allow overlapping intervals to be combined in one schedule, the logic is inverted with a single switch, and a schedule assigned to a policy is inherited by all its rules. Access for contractors only during working hours or seasonal services that must be open on schedule are configured in advance – without daily manual intervention and without knowledge of cron syntax.
<b>Change history: “was – became” for each rule</b>
Every change to rules and policies is recorded in a general timeline with the author and time. When saving, you can add a title and comment – for example, a Service Desk ticket number. Versions are compared in a tabular “was – became” view or in JSON representation with highlighted changes. For incident analysis and network configuration auditing, this answers the question “who, when, and what changed” without searching through logs.
<b>Traffic mirroring for IDS</b>
Mirroring sessions direct a copy of virtual machine traffic to a logical port within the Basis SDN infrastructure or to an external device using GRE or ERSPAN protocols – this is how intrusion detection systems are connected to a growing infrastructure. The source can be not only a separate port, but also a security group, including a dynamic one: the setup is performed once, and new machines are automatically mirrored based on selection criteria.
“Analysts at TMT Consulting, in their research, named Basis the most prominent Russian developer of a standalone product in the SDN segment. And this is despite the fact that we only launched Basis SDN last year. However, during this time, we have done a lot of work, significantly improving the functionality of the solution, as promised in the roadmap. We are now developing Basis SDN towards automating network operations and network security. In version 1.3, we focused on simplifying administrators' work and reducing the number of manual actions when changing infrastructure,” comments Dmitry Sorokin, Technical Director of Basis company.
<b>Part of a unified ecosystem</b>
Basis SDN works in conjunction with the virtualization platform Basis Dynamix Enterprise, which in 2025 took first place in the CNews, TAdviser, and Computerra ratings, and with other products of the Basis ecosystem – from virtual environment protection to storage. All solutions are built on their own codebase, included in the register of Russian software, and certified by FSTEC of Russia at trust level 4; the ecosystem operates in Gosoblako, Gostech, and Gosuslugi, in the infrastructure of government agencies and major corporations. According to iKS-Consulting, Basis leads the dynamic IT infrastructure management software market with a 19% share.
You can learn more about Basis SDN and the entire Basis product line and request a demonstration at basistech.ru.
erid: 2VtzqwWS781
Advertisement. OOO “Basis” INN 7731316059