LiveAction CyberSecurity Solutions

Transcription

1 LiveAction CyberSecurity Solutions Using visualization and awareness to safeguard your networks Constantly changing network threats are continually upsetting the optimal balance between strong security and convenient user access. And with physical isolation becoming less effective due to the Internet and virtual networking, dealing with and staying ahead of these threats requires a much more dynamic approach. LiveAction software is leading a new breed of interactive cyber defense tools that can track changing security conditions so security staff can respond directly to new threats quickly and decisively especially in virtual environments. Using the same rich visualizations and embedded intelligence that it provides for network management and troubleshooting, LiveAction takes cyber security to a higher level with real-time situational awareness and control, when and where it is needed the most. Key Features and Benefits Real-time traffic visibility and control Fully interactive system topology (multiple devices), device, and interface level views with GEO IP, NSEL, and AVC Visualize and minimize DoS attacks and unauthorized traffic Detect, identify and block offenders Network forensics visualization, analysis and test report documentation Efficient storage, playback and analysis of all flow at 1 M flow/ second without aggregation Remediate malicious traffic on the network Easy to use graphical editors to reroute suspicious traffic to a sensor using PBR, block/drop suspicious traffic using ACL, and mitigate/minimize suspicious traffic using QoS configuration No appliances needed Installs in minutes on a standard laptop, desktop PC, or server

2 Visual Network Surveillance If an intruder can successfully penetrate a firewall or happens to be an employee operating freely from inside the network, the damage may never be found. LiveAction watches the network continuously and shows you what traffic is traversing your topology, interfaces, and tunnels so you can quickly spot unauthorized activity, see the exact path it is taking, and shut it down without disrupting legitimate operations. Support for tactical networks LiveAction simplifies the management of devices on fixed and mobile tactical networks. The software supports Net-Centric solutions including critical communications, resilient networks, Mobile C4I, coalition inter-networking, and computer network defense. Interactive troubleshooting Achieve faster troubleshooting of your network to spot a wide variety of problems from congestion to illicit traffic Starting with the system level topology view you can instantly spot congested devices and interfaces on the network by their amber color. Doubleclicking on these areas provides more detailed information and viewing options for troubleshooting down to the device and interface levels. LiveAction Intelligent, Real-Time Cyber Security What is LiveAction? LiveAction is a modular software tool that combines an extensive device knowledge base with a highly intuitive user interface to simplify network design, deployment, security management, and troubleshooting. It is currently available with technology modules for Cisco quality of service (QoS), NetFlow, NSEL, AVC, Routing, and IP SLA. Unsurpassed Network Situational Awareness and Control Situational awareness involves knowing what is happening on your network and being able to understand and correlate its many components, processes, applications, and data. All of this is essential for effective security management especially when complex technologies and traffic patterns are involved. LiveAction delivers exceptional awareness including rich visualizations of the network topology, devices, and interfaces. In addition to providing fully interactive monitoring and configuration in a single tool, LiveAction will show you the current status of your network with extreme clarity including who is on it, who is trying to get in, how your traffic is traversing the network, what applications are running, and what they are attempting to do. Enhanced Tactical and Enterprise Network Management LiveAction simplifies and automates bandwidth and security management to meet changing mission requirements in bandwidth-limited and coalition-type black core environments. Built-in QoS, PBR, ACL and network management capabilities enable military commanders and their operators to gain visibility and control of tactical networks. You can better secure encrypted networks and improve performance by shaping traffic with easy to apply QoS, Routing and ACL policies while reducing operator training requirements and costly configuration errors. LiveAction improves operator efficiency with advanced visual user interfaces that show real-time unclassified and encrypted traffic. It also protects against DoS attacks and unauthorized traffic by clearly visualizing black list source and destination IP addresses. Coalition interoperability and enclave network management Most networks by their very nature tend to extend beyond physically secure boundaries in order to accommodate outside users, such as coalition partners, utility customers, and remote employees. At the same time, secure enclaves within the network are required to contain sensitive information. When both reside on the same physical or virtual infrastructure, security is essential but can be very difficult to ensure. LiveAction helps secure the network by showing visually how traffic is flowing across various devices and interfaces making it easy to spot and block traffic that shouldn t be in certain areas. Network forensics analysis and test report documentation In addition to live monitoring, LiveAction also provides extensive historical reporting for QoS and NetFlow. When you retrieve historical data, you can see any point captured in the past with full visualizations as if it were still running live. Off-line analysis correlates multiple parallel sources of time-based data to provide a deeper and clearer picture of past events and the conditions that led up to them. Unleash the power hidden inside your routers Until now, some of the best features of your router such as QoS and NetFlow have not been fully accessible due to their sheer complexity and the inefficiencies of using the command line interface. LiveAction changes all of this with a simple but powerful interface that allows IT engineers, to exploit the full potential of these devices to enhance network performance, reliability, and security. Viewing, editing, and creating router configurations is a snap with LiveAction. Create new QoS policies from scratch or choose from an extensive collection of QoS templates based on Cisco and industry best practices. Best of all, you ll never have to use the command line for configuration ever again. Get your IT staff up to speed in record time LiveAction is the first product that makes Cisco routers easy to use. After a simple, few minute installation on a standard PC or laptop, IT professionals, with the proper security credentials, can immediately begin monitoring and configuring Cisco routers and troubleshoot live networks with ease and confidence. This increases the capabilities of less experienced staff while allowing more experienced engineers to operate with greater speed to make better use of their valuable time and expertise. 2

3 Rich visualizations, live data flows, multiple levels of detail all in REAL TIME Topology Level LiveAction generates amazingly clear and detailed topology views of your network allowing you to see not only your devices but their interfaces as well. Observe device interconnections, network flows, interface bandwidth, congestion, and much more all in real time. Device Level Dive deep into the setup and activity within your Cisco switch or router. See flows and routes entering, traversing, and exiting the device. View the whole picture or filter down to troubleshoot Interface Level Need even more detail? Click down to the interface view and observe actual traffic in real time and identify the type, source, and amount of traffic. See the effects of your device configuration Historical tracking for forensics analysis and reports Capture and retrieve traffic data for QoS and NetFlow. View by previous dates, zoom in for details, replay NetFlow events exactly as they happened. 3

4 LiveAction Features Flow LiveAction Flow starts with a network topology view that provides a unique end-to-end flow visualization of live traffic across the network. Users can quickly drill down to individual devices or interfaces for more detail on flow characteristics such as IP addresses, DSCP values, byte rates and count. This makes it easy to visualize trouble spots on the network and gain a better understanding of traffic patterns. Cisco Performance Routing Cisco Medianet performance monitoring Cisco Application Visibility and Control Cisco ASA network security event logging Topology-based traffic flow view Supports NetFlow v5/v9, IPFIX, sflow, and J-Flow Aggregate flow or individual flow views Display end points as host IP address, host name, application port name or number Ability to filter flows Start, stop, and pause flow data Adjustable flow polling rates Flow graph by port, source or destination address Built in DNS name resolution Historical views, reporting, and playback Flow dashboard QoS Configure LiveAction QoS Configure enables IT engineers to create, edit, and apply QoS policies for Cisco routers and Layer 3 switches on live networks with consistency and confidence. Use the QoS wizard and built-in templates to apply policies based on Cisco best practices or use the QoS GUI editor to create and edit your own policies from scratch. Cisco Medianet Cisco Application Visibility and Control Full MQC QoS configuration support including WRED, CBWFQ, and Priority Queueing Read existing QoS policies inside routers Apply or remove QoS configurations across multiple interfaces Push policies to multiple devices Hierarchical policy creation for advanced configurations Custom NBAR and NBAR2 based matches including high level attributes, HTTP URL, MIME, HOST and RTP protocols Built-in ACL editor CLI command preview Built-in rules for QoS settings that highlight violations Graphical inbound/outbound QoS editors System-wide QoS audit QoS Monitor LiveAction QoS Monitoring provides the ability to track QoS performance on a per-class basis in real-time or for historical time periods. Engineers can gain a deep understanding of traffic and QoS behavior using LiveAction s application (NBAR), class or queuing views. Monitoring and alerting of priority queue drops provides proactive notification of potential voice quality issues. Cisco Medianet Cisco Application Visibility and Control Rate-based NBAR graphs Pre- and-post-qos graphs Peak and average rate statistics Class and interface drop graphs Congestion indicators Built-in CBQoS MIB viewer Custom NBAR definitions GRE tunnel visualization Automatic QoS graph resync on policy changes Unknown port discovery View QoS graphs across routers Historical views and reporting Low level graphs of CBQoS statistics 4

5 LAN LiveAction LAN is a technology module that provides real-time Layer 2 visualizations for networks, including trunk interfaces, port channels, VLAN associations and bandwidth percentages. VLAN trunk, port channel names VLAN associations within a device VLAN highlighting through a network Input/Output bandwidth of each VLAN and port interface Spanning Tree Protocol visualization and reporting Find IP/MAC addresses Trunk and access bandwidth information through network polling Layer 2 QoS statistics including CoS, DSCP and IP precedence Dropped packets, interface warnings through network polling at the VLAN level Routing LiveAction Routing provides real-time routing visualizations for Cisco networks that can identify reachability problems, routing loops and asymmetric paths that can affect traffic quality. In addition, the module s policy-based routing viewer/editor provides a high degree of control over traffic policy allowing users to route traffic easily and predictably over user-specified paths. System topology view of active routes Device route table views in graphical and tabular form Virtual routing and forwarding tables Export - Exports route, route table, device forwarding tables to CSV files Troubleshooting - Shows routing loops and asymmetric routes, unstable conditions, black holes, error summarizations Policy-based routing (PBR) - Configuration/ Editing of PBR and Set statements, edit existing route map configurations, check for compliance with PBR rules, displays PBR usage, displays static routes and PBR issues, exports route map statistics IP SLA LiveAction IP SLA makes Cisco IOS IP SLA operations easily accessible for generating and monitoring synthetic network traffic to baseline network performance, test policy changes, or proactively monitor key network paths. Synthetic traffic types include data (HTTP, FTP, DNS, DHCP) and voice that can be used to measure latency, loss, jitter, and mean opinion core (MOS) for VoIP. Its highly interactive graphical interface delivers the functionality and flexibility of IP SLA features without the need to learn and use Cisco device command lines. Test Types: DHCP, DNS, ICMP Echo, FTP, HTTP, Jitter, UDP Echo, video Latency, MOS performance measurements, loss, jitter, DHCP: destination, source, circuit ID, remote ID, subnet mask IP SLA VO (video operations) for Medianet IP SLA topology view (real-time) Set up responder at destination Edit, save, delete test configurations Export to CSV file Historical reporting Large-scale wizard-based IP SLA provisioning in full-mesh and hub/spoke configurations IP SLA dashboard 5

6 Devices Supported Cisco Series Routers 800, 1700, 1800, 1900, 2600, 2600XM, 2800, 2900, 3600, 3700, 3800, 3900, 7200, 7600, ASR 1000 Series, CSR 1000v NetFlow-only for Cisco ASR 9000 and CRS-1 Recommended IOS versions 12.3 or higher or 15.0 or higher for use with the software. (IOS XE or higher for ASR 1000 series). Earlier IOS versions may work but are not officially supported. General release IOS versions are recommended, although early and limited release versions will also work. Cisco Series Switches Catalyst 2960-X, 3560, 3750, 3850, 4500, and 6500 Series Switches Cisco Catalyst 3850, 4500, 6500, and Nexus 1000v Series and 7000 Series Switches Some aspects of QoS can be set up on Layer 3-routable interfaces and VLANs (no Layer 2 QoS configuration) NetFlow can be used with Catalyst 6500 and 4500 switches. Please consult Cisco s feature navigator for specific hardware requirements. MQC-based QoS configuration on Catalyst 4500 and Nexus 7000 Cisco Security Devices Cisco ASA 5500 Series running 8.3, NetFlow Secure Event Logging Cisco ASR 1K Zone-based Firewall High Speed Logging Non-Cisco Devices (Flow analysis only) Alcatel, Extreme, Brocade, Hewlett-Packard, Juniper, NetVanta, and nprobe System Requirements Network connection Server and client PC operating system (Windows) 64-bit Server 2003 SP2, Server 2008 R2, Windows 7 Professional and Ultimate CPU 2+ GHz minimum, quad-core recommended System RAM 8 GB or more recommended Disk space 1.5 TB or more recommended Contact ActionPacked Networks LiveAction, Inc West Bayshore Road Palo Alto, CA 94303, USA Phone: sales@liveaction.com Web site: liveaction.com What users are saying about LiveAction... This tool is great for applying QoS consistently and immediately validating the results. I have tested a lot of products that did NetFlow. This one is the easiest, most straightforward, and it gives the most information. The visualization is great! You can make changes in real time and see the results. If you run or need to run QoS on your network, I could not possibly give any other product for QoS management a higher recommendation than LiveAction. Copyright 2016 LiveAction, Inc. All rights reserved. LiveAction, the LiveAction logo and LiveAction Software are trademarks of LiveAction, Inc. Other company and product names are the trademarks of their respective companies. 6 B A-0813