Network Monitoring and Security in Hybrid Networks. Jason Echols

Transcription

1 Network Monitoring and Security in Hybrid Networks Jason Echols

2 The MOST TRUSTED names in networking trust Test Security Visibility Enterprises trust IXIA to: Assess vendor equipment and applications Improve network security posture Improve network and application visibility and performance Service Providers trust IXIA to: Improve and speed service delivery Speed roll out of next gen services Improve network and application visibility and performance Equipment Manufacturers trust IXIA to: Develop next generation devices Speed time to market Improve performance and reliability Chip Fabricators trust IXIA to: Validate protocol conformance Speed time to market

3 3 Topics Industry Data on Change in the Network Network Visibility Challenges Customer ROI Examples Example Network Visibility Architectures

4 4 Growth in the Network Heavy traffic within the data center along with rapid growth. Source: Cisco Global Cloud Index (GCI): Forecast and Methodology,

5 5 Network Bandwidth Growing Rapidly Maximum networking link speeds within data center / core networks 100M 1G 10G 40G 100G 0% 10% 20% 30% 40% 50% Current Planned in 12 months Tools Challenged to Keep Pace! 2014 Enterprise Management Associates, Inc.

6 6 Bring Your Own Device (BYOD) 89% >10% 1 IN 4 Global IT professionals reporting personal devices on corporate networks Percentage of organizations that are fully aware of all the devices accessing their network Employed U.S. adults who have been a victim of malware or hacking on a personal device Image: Milton Security

7 It s More Than Growth, Speed, and BYOD Packet Flow is Changing 7 Regulatory Cloud Wireless SDN Security Mobile 7

8 8 8 Managing Change Requires Visibility Into The Network

9 9 Move towards Customer Service Approach ER >SOLOMONSAMU 成 龙 >ZUKAUSKIENEJAN Internet YOSHIMI>ИМЯ:DUBOVVICTOR> YMANSKIGRAZYNA>STAVENHO Transforms >GLASGOWSCOTL Communications 83>TL > 新 加 坡 ER >SOLOMONSAMU 成 龙 >ZUKAUSKIENEJAN YOSHIMI>ИМЯ:DUBOVVICTOR> Application & Data YMANSKIGRAZYNA>STAVENHO >GLASGOWSCOTL Explosion 83>TL > 新 加 坡 ER >SOLOMONSAMU 成 龙 >ZUKAUSKIENEJAN YOSHIMI>ИМЯ:DUBOVVICTOR> Consumerization YMANSKIGRAZYNA>STAVENHO >GLASGOWSCOTL of IT 83>TL > 新 加 坡 Packet Delivery Application Delivery Customer Service Delivery Network Operations Center Security Operations Center Customer Service Operations Center Late 1990 s

10 10 Tools, Tools and More Tools ER >SOLOMONSAMU 成 龙 >ZUKAUSKIENEJAN Internet YOSHIMI>ИМЯ:DUBOVVICTOR> YMANSKIGRAZYNA>STAVENHO Transforms >GLASGOWSCOTL Communications 83>TL > 新 加 坡 ER >SOLOMONSAMU 成 龙 >ZUKAUSKIENEJAN YOSHIMI>ИМЯ:DUBOVVICTOR> Application & Data YMANSKIGRAZYNA>STAVENHO >GLASGOWSCOTL Explosion 83>TL > 新 加 坡 ER >SOLOMONSAMU 成 龙 >ZUKAUSKIENEJAN YOSHIMI>ИМЯ:DUBOVVICTOR> Consumerization YMANSKIGRAZYNA>STAVENHO >GLASGOWSCOTL of IT 83>TL > 新 加 坡 Infrastructure Management Customer Service Late 1990 s

11 11 Tools Need End-to-End Network Access Production Network Tools Organization SPAN Ports Taps Inline Bypass Campus Remote Office Branch Office Network Management Network Operations Core SPAN Ports Taps Inline Bypass SPAN Ports Taps Inline Bypass This isn t happening! Why? Application Performance Performance Management Security Admin Server Admin Data Center Private Cloud Virtualization Security Intelligence WAN Carrier Networks Wired and Mobile SPAN Ports Taps Inline Bypass Customer Experience Audit & Privacy Forensics

12 New Needs to Solve the Tools Problem Production Network Tools Organization Campus Remote Office Branch Office Visibility Needs End-to-End Visibility Tool access to any point in the network Network Operations Scalability Scales to fit the needs of any network Performance Management Core Manageability Flexible macro-level management Security Admin Data Center Private Cloud Virtualization Control View exactly the information you need Reduce Costs Reduce tool costs & administrative burdens Server Admin Audit & Privacy WAN Carrier Networks Wired and Mobile Forensics 12

13 Benefits of Visibility Architecture Deployment Security Services Firm Challenge: Before we deployed the Ixia solution, we were collecting TCP dumps to UNIX boxes and using custom scripting to try and compare traffic on each side of the firewall Ultimately, we took service penalty hits because it took a long time to identify and resolve the issue. IT Manager Hard ROI (5yr. Vs $150k solution) Reduced cost of instrumentation per Site (4:1) $200,000 Reduced SLA penalties $50,000 TOTAL Hard ROI $250,000 Soft ROI 13 Escalation staff can cover more incidents per engineer Reduces future costs for access and instrumentation, reduces penalty risk for service failures

14 Benefits of Visibility Architecture Deployment University of Texas Challenges: Volume was really becoming an issue and dropping packets was simply not acceptable - CISO Lost data from overloaded switches Rapid Growth with mandated monitoring 750,000 Devices on state networks Hard ROI (5yr. Vs $700k solution) Reduced costs in IDS Monitors (4:1) Elimination in Smaller Sensors $216,000 Reduced Rack Space and Power $300,000 TOTAL Hard ROI $846,000 Soft ROI 14 $320,000 Reliable support for increasing volumes of data, inc. 40G Can add new tools without stressing or endangering primary monitoring

15 Visibility Components and Sample Architectures 15

16 What is a Tap?

17 What is a Packet Broker?

18 Visibility Architecture Designs Medium Enterprise Large Enterprise Carrier Networks

19 Medium Enterprise Design Monitoring Tools Network Visibility Management Network & App Performance Security Intelligence NTO 2113 Packet Broker Protocol Analyzer Servers with Phantom Tap Network Taps Campus Cloud Branch Core Data Center

20 Large Enterprise Design Monitoring Tools Protocol Analyzer Network Performance Application Performance Security Intelligence VoIP Monitor Network Visibility Management Servers with Phantom Tap NTO 5288 Packet Broker NTO 7300 Packet Broker Net Optics Taps Campus Cloud Branch Core Data Center

21 Carrier Design Monitoring Tools Probe Probe Probe Network Performance Application Performance Security Intelligence LTE Monitor Network Visibility Management NTO 7300 NFV Environments GTP Session Controller NetOptics Taps MME PCRF HSS AS SLF SGW PGW EPC IMS

22 22 Summary Focus on Improved Visibility for Improving Customer Service IT Evolving Customer Service Approach Eliminating Visibility Blind Spots Scalable, end-to-end network, application and user visibility Integrated virtual & physical solution Fail-safe, inline security The Answer: Ixia s Visibility Architecture ER >SOLOMONSAMUEL>D 成 龙 >ZUKAUS KIENEJANINA>UPATIONCONTRACTOR>SALARY$54GRANT BOB>KIMMINJUN> SCOVERCARD >ST AVENHDE5010CC>SCHODERJURGEN>MOBINAUSTALLIA> HYPOTHEKENZAHLUNYOSHIMI>ИМЯ:DUBOVVICTOR>NUM

23 Thank you

24 Inline Bypass Design Normal Operation Traffic routes through IPS Monitored with custom heartbeat Switch programmed to fail open/closed Managed via CLI, Web, etc. Optional NPB to route through multiple security devices Bypass Switch IPS Security Monitoring Tool Bypass Mode Traffic bypasses the IPS Security tool(s) can be replaced/upgraded without interruption Bypass Switch IPS Security Monitoring Tool (down/removed/upgrading)

25 Virtualization Design (detail)