P2P Traffic Manager. L7 Internet Security. IP Appliance Products

Transcription

1 IP Appliance Products P2P Traffic Manager L7 Internet Security Headquarter 13 Fl., Eunsung Bldg., 53-8 Cheongdamdong Kangnamgu Seoul, Korea Tel Fax R&D Center 34 Gajeongdong, Yuseonggu, Daejeon Korea Tel ~2 Fax Japan Branch Shinkasumigaseki Bldg., 18F KIICA-TOKYO, Kasumigaseki, Chiyoda-ku, Tokyo Tel Fax Copyright ARA Networks Co., Ltd. All Rights Reserved.

2 P2P Traffic Manager Introduction As P2P applications and sites become increasingly popular, ISP s are faced with bandwidth issues resulting in deteriorating performance of mission critical business applications. PPTM was specifically designed for the broadband service provider s backbone network. It utilizes ARA s proprietary technology, the NMP(Network Monitoring Platform), which identifies, detects and controls P2P traffic using L7 traffic classification mechanisms. Real-time L7 Monitoring/Control Designed for 10G Backbone Network Supporting Asymmetric Network Traffic Identification using L7 Signature

3 Products Overview High Performance 10G POS/Ethernet Broadband service providers have adopted 10GE/POS backbone networks to handle rapidly increasing Internet traffic and demand for quality of service. PPTM supports 10GE/POS and provides a valuable solution to alleviate this pressure. The graph on the following page shows the correlation between throughput and CPU usage utilizing ARA s PPTM. The results show that CPU usage remains relatively low as throughput increases. Control Traffic Control for Various P2P Applications PPTM uses advanced application signatures and behavioral recognition methodologies to auto-detect a wide variety of P2P applications, enabling providers to set policies that monitor, control subscriber activities and control P2P applications. Asynchronous Traffic Control Major service provider networks are prone to asymmetric routes caused by inbound and outbound traffic from the subscribers. Specific identification becomes difficult due to these asymmetric routes. PPTM can overcome these challenges with a unique traffic identification technology that ensures accurate protocol identification without affecting the network routing. Network Fail Safe Operation PPTM uses tap-mirroring topology, which is not only cost-effective, but offers more comprehensive protection than simple hardware replication and bypass systems. Outline traffic capture capability ensures the continuation of the subscriber s traffic without interruption even in the event of system failures. ARA-PPTM <1st Control> - edonkey: 230M - Bit Torrent: 20M - ClubBox: 20M <2nd Control> - edonkey: 0M - Bit Torrent: 20M - ClubBox: 0M Access Control Signal Copied Packets Clients Switch TAP Router Internet Support for Various Network Interfaces Service providers utilize additional network lines to brace for potential traffic spikes as the number of internet users continue to grow at a fast pace. PPTM not only supports 10G, but also 622M, 1G and 2.5G as well.

4 Monitoring Utilizing advanced DPI technology, PPTM can identify various applications. The administrator is able to detect heavy users, monitor traffic pattern and trace the network behavior so that the network is efficient and healthy. PPTM enables the delivery of fair and equitable service levels to the subscribers, ensuring that all users receive high-quality web sessions without being over-whelmed by high bandwidth subscribers. Traffic Information PPTM traffic information analyzes inbound and outbound bandwidth usage by each P2P protocol. This creates clear reporting of the current network conditions. Inbound and Outbound Traffic PPTM charts P2P bandwidth per P2P protocol by time of day. Current Top Bandwidth Abuse PPTM provides information about the top ports and IP s according to P2P usage enabling the service provider to take timely action. Daily Outbound Bandwidth Usage PPTM analyzes daily outbound bandwidth usage per P2P protocol, which enables efficient network management.

5 Utility PPTM provides detailed insight and analysis of the network traffic. It is a highly scalable system that uses a single, easy-to-use GUI to deliver unsurpassed network analysis suitable for short-term network troubleshooting or for long-term trend and usage analysis. Building Policies Configuration management is centralized allowing such capabilities as managing the traffic limits per P2P protocol. This enables rapid deployment of services and automatic distribution of configurations. In multiple PPTM settings, a global management tool can be used to access configurations and policies. Active Alarm An active alarm system can be set to trigger any abnormal events such as SNMP traps. Immediate notification via can invoke corrective action before problems become costly. Reporting Long-term reporting capabilities evaluate trends and assist in accurate capacity planning for the service provider. Data report viewing include customizable features such as sorting by time parameters, choosing graph or table formats, filtering and drill-down levels to view additional data. Sniffer The administrator can capture packets and save to files. The traffic can then be analyzed through packet tools such as Ethereal (

6 L7 Internet Security Introduction Conventional security products such as Firewall are not capable of detecting and blocking protocols that use random ports and proxies. As a result, demand for more advanced security products to deal with these types of challenges have grown. ARA s security management tool, TS(Traffic Sentinel), uses L7 analysis to identify traffic. The TS & PPTM combined is designed for enterprises who are concerned with the risk of privileged information being leaked and for those who are looking to provide Internet filtering services to their end customers creating potential new revenue streams. ARA s TS provides detailed traffic reporting, web logging analysis and abnormal traffic detection to help the administrator recognize potential harmful attacks and illegal Internet access. The administrator can then implement plans of action to prevent costly and irreversible damage. Supports All PPTM Features & Enhanced Security Security for Corporate Confidential Materials Protection from Internet attacks Blocking Non-Business Internet access Real Time Monitoring

7 Internal Information Security Monitoring and Logging TS manages web, P2P and instant messaging access to prevent privileged information from being leaked outside of the enterprise boundaries. TS uses sophisticated DPI(Deep Packet Inspection) technology in addition to L7 traffic analysis, provided by PPTM, to create exceptional performance and protection. TS enables detailed log analysis of web, P2P and instant messaging activities. Real-time traffic monitoring TS provides real time network monitoring. This enables the network administrators to take timely action against specific activities and events. The user friendly controls allow the administrator to view information is easy to read formats. Web Traffic Control Many enterprises control their network with Firewall, which does not restrict traffic using port 80. Various types of traffic such as P2P and instant messaging can pass through port 80, evading Firewall. TS provides: URL Filtering Proxy Detour Blocking ACL Control by Time and User Group Web Mail Filtering Web Mail File Attachment Control Web Access and Filtered Log and Search P2P Traffic Control There are various P2P applications such as web folder accessing using random port numbers. TS identifies and controls all such traffic using L7 analysis. TS provides: P2P Application Blocking: For example, edonkey, Bit Torrent, Winny, Gnutella, etc. Web Folder File Transfer Blocking Inbound/Outbound Traffic Bandwidth Control Random Port Protocol Blocking Application Access and Filtered Logging and Search Log Analysis Report Provides the network administrator the ability to log detailed activities of users. Provides analysis of logs and helps the administrator set optimal management policies. Provides summary reports. Provides web/application access analysis. Provides web/application category analysis based on web/application DB. Provides web site access statistics. Provides application usage statistics. Provides log analysis report in web/excel format. Instant Messenger Control Although corporations may have strict guidelines for instant messaging usage, there is still the threat of proprietary information from being leaked out. TS provides: File Upload/Download Control File Transfer Logging Detour Connection Blocking (Proxy)

8 Deployment Example Internet Specifications Model P1000 P2500 P10000 ARA-PPTM ARA-PPTM Operating System CPU Memory HDD NIC NMP OS Dual Processor Dual Processor Dual Processor 4G 4G 8G 73G*2 73G*2 73G*2 1G 2.5G POS 10G E/POS Copied Packets Access Control Signal Functions IP, PORT, Appliaction-based real-time traffic analysis L7 Packet Inspection Analysis and control of P2P and web folders Control on the profile basis of users, times and P2P protocols Network alarm FPC (Full Packet Capture) TCP Block URL Filtering ARA-TS TS100 TS250 TS500 TS1000 NMP OS Single Processor Single Processor Dual Processor Dual Processor Workgroup Switch Backbone Switch TAP Firewall Router Internet 2G 73G*2 100 Client 2G 4G 73G*2 144G*2 250 Client 500 Client 4G 144G*2 Unlimited Access Control Signal Copied Packets Web Protocol Access Control (URL Filtering) - Web Catagory, Web Mail, Web Folder Application Protocol Access Control - P2P, Messenger, Webhard, HTTP Tunnel Traffic Monitoring Network Sniffer ARA-TS