Total Business Continuity with Cyberoam High Availability

Transcription

1 White paper Cyberoam UTM Total Business Continuity with Cyberoam High Availability Companies, big and small, must ensure constant availability of their company's network and data and prepare themselves against a wide variety of threats like fire, internet outages, hardware failures, theft, covert access, etc. Cyberoam's High Availability provides an ideal solution by ensuring continuous connectivity at the Hardware, Network as well as Application levels.

2 Contents Need for High Availability... 2 Achieving High Availability through Cyberoam... 4 HA at Hardware Level... 5 HA at Application Level... 6 HA at Network Level... 6 Conclusion... 7

3 Companies, big and small, must prepare themselves against a wide variety of threats ranging from physical (fire, earthquake, floods, internet outages, hardware failures, etc) to human (terrorism, theft, covert access,etc). Need for High Availability One of the biggest challenges faced by Network Managers today is to ensure constant availability of their company s network and data. Companies, big and small, must prepare themselves against a wide variety of threats ranging from physical (fire, earthquake, floods, internet outages, hardware failures, etc) to human (terrorism, theft, covert access, etc). Network disasters can be as simple as an ISP internet connection going down, or catastrophic like a completely fried Perimeter-Firewall or total data loss. Protecting a company s IT infrastructure and having an upto-date high availability plan is an absolute necessity for any company that intends to remain in business and have a decent reputation at that.inspite of being aware of the threats mentioned above, many businesses do not lay importance upon the idea of having a High Availability plan in place. Most have either of the following opinions: It won t happen to us Well, if something can go wrong, it probably will! Hardware components can fail and softwares can crash. There are planned and unplanned outages. As an IT Manager, you can never be sure that it can never happen to your network. We are too small to be affected If your business continuity depends on data availability, no business is too small to have a high availability plan. The ability to recover from a network disaster is an essential component of doing business and staying in business. Although Backup and Recovery is a preferred option, it is way better to not give it a chance at all, i.e., avoiding network crashes. Downtime A common term that we come across with regards to networks is Downtime. It refers to a period when a system is unavailable or when a system fails to provide service or perform its primary function. Planned vs. Unplanned Downtime Planned Downtime is usually the result of some logical, managementinitiated event. It is initiated by the IT Administrator for certain events, such as maintenance, patches to system software or system configuration changes that take effect upon system reboot. Unplanned Downtime, in contrast, is when the event is not controlled by the IT Administrator. Such events range from minor internet outage, corrupted hardware, software crash to major catastrophes like flood, fire, terrorist attack, earthquake, etc. Minor events are less dramatic and easy to plan for as compared to major events. According to Gartner, the average hourly cost of computer network downtime is a staggering $42,000 per hour. Even more, for companies that rely entirely on technology such as brokerage, trading and e- commerce sites, downtime risks can cost millions of dollars. Even an average downtime of 87 hours per year which is 99% up time, can costs companies about $3.6 million annually.

4 The table below lists Availability targets and permitted annual downtime for a network: $42,000 According to Gartner, the average hourly cost of computer network downtime is a staggering $42,000 per hour. Availability % % ("nine fives") 90% ("one nine") 95% 97% 98% 99% ("two nines") 99.5% 99.8% 99.9% ("three nines") 99.95% 99.99% ("four nines") % ("five nines") % ("six nines") Downtime per year days 36.5 days days days 7.30 days 3.65 days 1.83 days hours 8.76 hours 4.38 hours minutes 5.26 minutes 31.5 seconds Networks employing High Availability are less likely to succumb to any of these crises. High Availability systems need to be designed by devoting resources after analyzing downtime scenarios, their probability of occurrence and cost involved to design the system against loss due to unavailability of the system. Achieving High Availability through Cyberoam High Availability (HA) can be defined as the implementation of a system design that ensures a prearranged level of operational performance over a given period of time. Operational performance depends on any hardware, application or system that provides services to the business, its employees and its customers. Downtime occurs if any of these services becomes unavailable. Cyberoam s High Availability solution takes a system s availability beyond just the Hardware level, but also to the Network and Application levels. Cyberoam provides High Availability at different levels in the following ways: Hardware Level - Appliance Clustering - Redundant Power Supply - Hardware Bypass Application Level - Load Balancing Network Level - Multilink Management - 3G and Wimax WAN - VPN Failover

5 High Availability at Hardware Level Appliance Clustering Cyberoam offers High Availability at the hardware level through Appliance Clustering. In this, two appliances are configured to function as a single appliance. These appliances, one Primary and one Auxiliary, are physically connected over a dedicated HA link port and share a Virtual MAC Address. HA can be configured in Cyberoam in 2 modes: Cyberoam offers High Availability at the hardware level through Appliance Clustering. Active-Active Mode In this mode, both the Primary and Auxiliary appliances process traffic. When traffic enters the network, it is forwarded to the clustered appliance which owns the virtual MAC address, i.e., the Primary Appliance. Primary Appliance acts as a load balancer and takes decisions for forwarding traffic to the Auxiliary Appliance for processing. Auxiliary Appliance takes over in case Primary Appliance fails. Active-Passive Mode If configured in this mode, the Primary Appliance processes the entire traffic while Auxiliary Appliance waits in a ready mode to take over control in case Primary Appliance or any of the monitored links fail. Auxiliary Appliance monitors the primary appliance through the dedicated HA link and if it does not receive any communication within a pre-configured time, the primary appliance is considered to have failed. In this case, Auxiliary appliance takes ownership of the virtual MAC address from primary appliance, and becomes primary appliance temporarily. Primary appliance automatically takes over from the Auxiliary appliance once it restarts functioning. Switch Secondary Cyberoam DMZ Port C Internet Switch Dedicated HA Link Port Switch Primary Cyberoam LAN Port C Cyberoam HA Implementation Redundant Power Supply Cyberoam high-end appliances are available with redundant power supply for hardware high availability. The appliances include two power

6 supplies within the unit, each of which is capable of powering the entire system by itself. If for some reason, any one of the power supplies fails, the other seamlessly takes over to prevent loss of power for the appliance. Hardware Bypass When Cyberoam is deployed in Transparent Mode, Hardware Bypass can be configured to ensure hardware availability in an event of hardware failure or a software malfunction. In Hardware Bypass Mode, the interfaces of the appliance get bridged and the traffic flows uninterrupted resulting in high uptime. Cyberoam s Multilink Management provides automatic load balancing and failover features when two or more Internet links are provisioned. High Availability at Application Level Load Balancing When deployed in an Active-Active HA cluster, both the Primary and Auxiliary appliances process traffic, while the Primary Appliance is in charge of balancing network traffic among the two units. This enables improved performance levels, enhanced availability and improved scalability of the system. Also, in Active-Active cluster, Cyberoam enables device failover, link failover and session failover. High Availability at Network Level Multilink Management With increased popularity of cloud computing, most businesses run their mission critical operations over the Internet. Such businesses understand the importance of having fast, stable and redundant connections. With only one Internet link, they are vulnerable to the link being a single point of failure and face significant downtime. Cyberoam s Multilink Management provides automatic load balancing and failover features when two or more Internet links are provisioned. Cyberoam automatically senses load on each link and dynamically balances the load. Cyberoam uses weighted round robin method for load balancing. Along with load balancing between two or more ISP links for enhanced performance, Cyberoam s Automatic Failover automatically detects a failed gateway and redirects traffic to alternate surviving gateway. Cyberoam continuously checks the health of each gateway, and detects failure in real time. Dynamic allocation makes sure if failover should occur, the traffic is diverted to the available gateways, resulting in high availability. 3G and WiMAX WAN Cyberoam supports Wireless WAN connections 3G and WiMAX, to ensure secure connectivity in remote locations which may not have wired WAN connectivity available. The Wireless WAN connections are managed through Multilink Management module and offers automatic failover from wired WAN to Wireless WAN, hence ensuring high availability for internet.

7 Cyberoam Product Portfolio Unified Threat Management(UTM) VPN Failover Cyberoam is a VPNC certified VPN server that communicates with most third party VPN servers, and offers VPN high availability by way of VPN failover. VPN failover enables continued connection with internal resources on a planned or unplanned outage. When you have two or more WAN links configured, VPN tunnels can automatically fail over to a backup or available WAN interface in the event of a failure. You can also configure VPN tunnels to fail over to a backup endpoint, if the primary endpoint becomes unavailable. On Cyberoam, VPN failover can occur on any of the below two events: 1.Internet link is down. Cyberoam automatically detects when a WAN link goes down through its Multilink Manager and fails over the VPN to available WAN link. 2.When the VPN endpoint is not available. With Cyberoam, you can also configure a WAN link to fail over to a VPN connection. The VPN connection becomes active only when the WAN link is detected to be down, ensuring high availability by redirecting mission critical traffic to the tunnel. Conclusion VPN Failover Cyberoam Endpoint Data Protection Data Protection & Encryption Application Control Device Management Asset Management The availability of network and resources is critical for efficient business continuity. If the network or service is unavailable, the business can lose revenue, creditability and opportunities. Cyberoam s High Availability solution mitigates the effects of a hardware or software failure on any business IT operations and maintains the availability of network so that the perceived downtime for users is minimized. References Wikipedia Cyberoam documents Cyberoam website Microsoft Toll Free Numbers USA : India : APAC/MEA : Europe : C o p y r i g h t E l i t e c o r e Te c h n o l o g i e s Pvt.L t d. Al l R i g h t s R e s e r v e d.cyberoam &Cyberoam logo are registered trademarks of Elitecore Technologies Ltd. /TM: Registered trade marks of Elitecore Technologies or of the owners of the Respective Products/Technologies. Although Elitecore attempted to provide accurate information, Elitecore assumes no responsibility for accuracy or completeness of information neither is this a legally binding representation. Elitecore has the right to change, modify, transfer or otherwise revise the publication without notice.