IF-MAP Overview. Jan Ursi Technical Director EMEA Infoblox Inc. All Rights Reserved.

Transcription

1 IF-MAP Overview Jan Ursi Technical Director EMEA

2 IF-MAP: A Powerful New Standard IF-MAP = Interface to Metadata Access Points An open protocol standard published (free) by the Trusted Computing Group Available since April, 2008 Version 2.0 released August, 2010 Pub/sub database - Like Facebook for IP devices and systems Supports a wide array of applications: Multi-Vendor Network Security (NAC) Compliance Management Asset Management Smart Grid Network Automation / Cloud Computing Could do for data sharing what IP did for connectivity

3 The Integration Challenge Supply Chain Mgmt Smart Grid CMDB AAA SIEM Network Location Switches Routers ERP Building Controls Factory Controls Infrastructure Management Network Security DNS, DHCP Asset Mgmt IPAM CRM HR Applications SNMP, Syslog, Netflow Custom Integration API s, Scripts Complex Costly Brittle High Maintenance 2010 Infoblox Inc. All Rights Reserved.

4 From Integration to Orchestration with IF-MAP Supply Chain Mgmt Smart Grid CMDB SIEM Switches AAA Routers Network Location ERP Building Controls Factory Controls Infrastructure Management Network Security DNS, DHCP Asset Mgmt IPAM CRM HR IF-MAP Protocol (Publish, Subscribe, Search) Applications IF-MAP Server Automatically aggregates, correlates, and distributes data to and from different systems, in real time 2010 Infoblox Inc. All Rights Reserved.

5 Today, Systems Share the IP Network, But Don t Share Data Network Security Physical Security Network Location Provisioning, Visualization & Analytics (Management) Decisions (Control) Sensors & Actuators

6 IF-MAP Doesn t Replace Existing Systems & Applications It Enables Them to Easily Share Data Network Security Physical Security Network Location Provisioning, Visualization & Analytics (Management) IF-MAP Server Decisions (Control) Sensors & Actuators

7 Many New Applications are Emerging Just the Tip of the Iceberg Physical Network Security Cyber/Physical Security IT Automation (CyPhy) Provisioning, Convergence Visualization & Analytics Don t allow users Track the location and status of all IT assets to connect to the (Management) MAP network if they haven t badged Database into the building Decisions Don t allow a (Control) wireless device to connect if its located outside of the building (IPs, MACs, devices, hardware, VMs, apps, users, etc.) in real time Allocate assets on the fly, dynamically reprovision data centers Asset Management Cloud Computing Federate authentication and authorization status across private & public clouds Move computing workloads to the cloud when prices drop Sensors & Actuators

8 Vendor Support for IF-MAP is Growing Vendor Product/Function IF-MAP Client IF-MAP Server Byre Security SCADA Security X Now Great Bay Endpoint Discovery X Now Hirsch Electronics Physical Access Control X Now Infoblox DHCP Server (NIOS) X Now Infoblox Orchestration Server (IBOS) X Now Juniper Infranet Controller (Policy Server) X X Now Logisense Registration Portal, Billing System X Now Lumeta Network Discovery & Leak Detection X Now Mikado NAC Solution X H1-11 NCP VPN Client X H1-11 Open Source IF-MAP Client Stack (PERL) X Now Open Source IF-MAP Client Stack (C++) X Q1-11 Open Source IF-MAP Server (Omapd, Irond) X Now Open Source SNMP/IF-MAP Bridge X Now Q1 Labs SIEM X Q1-11 Avail

9 Some Infoblox IF-MAP Projects Large Aircraft Manufacturer (In Production) Security for factory control (SCADA) traffic over wireless factory network Firewall configurations loaded dynamically from IF-MAP server Uses firewall/vpn gateways from Byres Security (Tofino) Software Development Company (In Production) Network access control without software agents on endpoints Uses Infoblox DHCP server, Juniper UAC, Juniper firewalls Las Vegas Hotel and Casino (In Production) Differentiated IP services for every room (3000 Juniper firewalls) Uses Infoblox DHCP, Juniper UAC and firewalls (3000), Logisense registration/billing portal Global Bank (Starting Rollout) Dynamic, secure desktops deploying to 8000 users Uses QIP DHCP, Juniper UAC and firewalls JANET - National ISP for Higher Education in UK (Pilot) Federation of authentication data for EDUROAM service Uses IF-MAP federation Real-Time CMDB (Pilot) Real-time discovery of devices joining the network Uses Infoblox DHCP, IF-MAP client and OneCMDB (Open Source CMDB)

10 IF-MAP Protocol Overview

11 Unique Characteristics Cited by IF-MAP Supporters 1. Open, standard protocol 2. Lightweight, easy to implement 3. No global schema supports emergent structures 4. Pub/sub paradigm

12 IF-MAP Components IF-MAP Client(s) IF-MAP Server employeeattribute = active User Name = John Doe distinguishedname = C=US, O=myco, OU=people, CN=12534 Department = Sales failed-login-attempts = 3, login-status = allowed role = access-finance-serverallowed 3 MAP Client Operations: Publish Subscribe Search 3 MAP Server Objects: Identifiers Links Metadata

13 IF-MAP Access Operations Publish: Tell others that <metadata > Clients store metadata into MAP for others to see Example: Authentication server publishes when a user logs in (or out) Search: Tell me if match(metadata pattern) Clients retrieve published metadata associated with a particular identifier and linked identifiers Example: An application can request the current physical location of the user Subscribe: Tell me when match(metadata pattern) Clients request asynchronous results for searches that match when others publish new metadata Example: Tell me when any user s status goes from employee to terminated

14 IF-MAP Server Objects Identifiers Links All objects are represented by unique identifiers Connote relationships between pairs of identifiers Metadata Attributes attached to Identifiers or Links Typical Data Types: Identifiers: Identity, IP address, MAC address, Session ID, Device Metadata: AAA info (authenticated, role, capabilities/policies) Device info (AV running, OS level, screen size, etc.) Event info (unauthorized access attempt, etc.), Layer 2 info (port, VLAN), location, etc. Many others, plus user-defined

15 Basic Components of MAP Content Identifiers Metadata Link

16 IF-MAP Use cases

17 Use Case Solution for Policy-Based Remote Access User= John Windows 802.1X Client 00:11:22:33:44:55 1- Endpoint plugs-in 2- SW sends EAP Start 3- Supplicant sends credentials 9- SW opens port Endpoint requests DHCP 14- Endpoint generates traffic Infobox HA Pair DHCP/DNS Appliance 11-DHCP sends MAC-IP metadata to MAP identity = John MAP Database Accessrequestmac MAC = 00:11:22: 33:44:55 IP-MAC Cisco 3750 Switch 8- UAC sends RADIUS accept to SW Juniper SSG Firewall 4- SW sends RADIUS Credential to UAC 13- UAC activates L3 access on FW. Private Applications Juniper IC 4000 UAC 5- UAC does Auth. Lookup IF-MAP 6- UAC publishes To MAP Infobox HA Pair MAP Server 7- UAC subscribes to MAP 12-MAP sends IP- MAC to UAC AAA Authenticatedas CHANGE? CHANGE! Accessrequest = 113:3 Capability = access-privateapplications IP=

18 Use Case Integrated Network / Physical Security Solution Secure Zone 1 Zone 2 location = Zone 12 MAP Database Access Request Hirsch System (Physical Sensor) Publish: John in Zone 1 Publish: John in Zone 2 identity = John authenticated Cisco 3750 Switch Juniper SSG Firewall Policy Violation: Access Cut Off Classified Network Grants Access Request Juniper IC 4000 UAC Appliance Infoblox MAP Server Publish: John is Authenticated; Session ID 113:3 Subscribe: Changes to Session 113:3 Subscription Update: John in Zone 2 Publish (delete): John is Authenticated Hirsch UAC Employee Card MAP publishes Subscribes grants reader updates system (John) requests connects leaves access publishes firewall UAC to the to enters Zone the the for about to update policy the 1, access MAP zone to while corporate the update classified to the server to 1 location the to still MAP block the to MAP logged the network server access change MAP in CHANGE? CHANGE! Accessrequest = 113:3

19 Use Case: Real-Time CMDB MANAGED NETWORK MAC = 00:11:22: 33:44:55 IP-MAC DISCOVERY SENSORS / AGENTS Infoblox DHCP Server Publish IP= IP= IP-MAC Discovery Engine Topology Builder CMDB SERVER Discovery Results Update CMDB Invoke Discovery CMDB MAP Client Infoblox MAP Server MAP Database MAC = 00:11:AA: 33:44:55 IP-MAC MAC = 00:11:11: 33:44:55 IP=

20 Use Case: SCADA Security IP-based industrial control traffic shares the general IT network in the factory Endboxes provide VPN/firewall security Endbox configurations dynamically loaded from MAP server based on user, role, etc. Provisioning Client

21 Use Case: Federated IF-MAP Servers for UK EDUROAM Service Enables login at remote universities / research centers using home login credentials Serves 1.9 million users across 850 locations Enabled today using RADIUS Proxy Service provider (JANET) maintains database of roaming activity Univ A JANET Univ B Bbaker, Roaming from University D OK! Radius Server Radius Server Radius proxy Radius Server Radius Server Univ C Roaming Users Jsmith@univB.edu Bbaker@univD.edu Univ D

22 IF-MAP Federation for Next Gen EDUROAM Service Local RADIUS servers replaced by RADSEC servers RADSEC servers communicate directly no need for proxy JANET no longer sees RADIUS transactions, no view of who is roaming IF-MAP Federation provides a solution: -Local RADSEC servers publish user/location data to local MAP server -JANET s central MAP server subscribes to changes on university MAP servers Univ A Univ B Jjames, Roaming from University B OK! RADSEC IF-MAP Client Jjames@ Jjames@ univb.edu univb.edu JANET Local IF-MAP Server RADSEC RADSEC RADSEC Univ C Local IF-MAP Server Central IF-MAP Server Federation Subscriptions Local IF-MAP Server Univ D

23 IF-MAP has Applications in Cloud Computing and IT Orchestration Infrastructure 2.0 Working Group has been discussing the impact of virtualization & cloud computing on the network Members include equipment vendors, cloud providers and end users Infoblox, Cisco, Google, Microsoft, F5, Citrix, Bechtel, Boeing, NASA Developing an inter-cloud registry service based on IF-MAP Ongoing project at Open Cloud Consortium in Chicago Co-sponsored by Cisco CTO s office and UCS group More info at

24 Inter-Cloud Registry Helps Cloud Providers and Users to Match Workload Needs with Cloud Assets member of Cloud member of member of Virtual Network member of Virtual Network assigned to Virtual Machine Virtual Machine assigned to assigned to MAC Address IP Address assigned to assigned to Virtual Machine runs on assigned to MAC Address IP Address MAC Address IP Address

25 The Vision: IF-MAP Supports Data Exchange Among Infoblox, and Other Vendors Products Visibility Applications Infoblox DDI Provide DDI service Detect IPs Core Services DNS / DHCP / IPAM IF-MAP Orchestration Communicate / Take Action Closed Loop Automation Infoblox NCCM Check Infrastructure Infrastructure Recognize change 25

26 Resources

27 Infoblox NIOS Appliances Support IF-MAP Dynamically updates IF-MAP server when IPs are allocated, renewed, or released by NIOS DHCP server Infoblox NIOS Appliance Other systems can subscribe to updates and take action in realtime (e.g. discovery, configuration, scanning, open/close ports, etc.) Unique to the Infoblox DHCP server (today) DHCP Lease Information (IP, MAC, Start, Duration, etc.) IF-MAP Server

28 Infoblox Orchestration Server (IBOS): The World s Most Powerful IF-MAP Server Fully compliant with TCG standard Proven interoperability with other IF-MAP compliant products Unique Infoblox capabilities IF-MAP 2.0 compliant Lossless HA Fine-grained client authorization Data browser, extensive logging IF-MAP Federation Custom Identifiers Infoblox Orchestration Server Network Security Physical Security Network Location IF-MAP Client Systems

29 Resources Documentation & Freeware 3 minute video on IF-MAP on Orchestration/IF-MAP Solutions page on infoblox.com IF-MAP community Web site Includes links to open source IF-MAP servers and other resources Information about Infranet Controller: us/en/products-services/security/uac/#overview Complete protocol specs, information on TPM, TNC, Trusted Storage and related topics Infoblox IF-MAP Starter Kit: Free for 90 days, $995 in the US for perpetual license, 18% annual support VMware IF-MAP appliance Client simulator Open-source client stacks (PERL, java, C++) Open-source SNMP-MAP Bridge