Core and data center applications are the strengths of Arista products. The distribution layer is also a good fit. For the access layer, it would be more of a niche product.
It's very well suited for geographically dispersed organizations, where deploying and managing remote firewalls and other network security functions aren't practical. Once deployed, and the deployment isn't difficult after planning and understanding the data flows of the IoT devices, the system is easily managed and flexible. You're able to allow front line operations people to add devices into a role without sacrificing the integrity of the security model.
It's pretty darned good for a new company. We had to hash through a couple of instances that no one had ever run into, but once we got to the right person on the engineering team, they were able to work through the solution pretty quickly. The nice thing is, unlike Cisco, once you fix something, you don't find three new things that have to be changed.
I have used the Catalyst 6500 series in the past. From my point of view, the Arista surpasses the Catalyst on just about every front. Originally we were planning on implementing the Nexus 7000/7700 series switches for our core. Though a little more feature rich, it did not provide features we needed that the Arista did. The Nexus also was a confusing and complex platform to work with. Also, the Nexus was a significantly more expensive solution. Although very happy with the Arista switches we may evaluate the Aruba HPE 8400 chassis-based switches along with Arista switches in the future.
The cost and complexity vs. ISE is as different as Uber and Lift are from trying to take a taxi in Duluth, Minnesota. The complexity of Cisco's IoT security is a joke. It was going to take us over a year just to deploy all the Cisco equipment, and that was if we could have gotten it all working together. We got the entire project deployed in just under 3 months, and that includes working out all the bugs and logistics. Honestly, I don't think all the Cisco parts would have ever been running like Cisco promised it would. It's just way too complicated.
