Ranch Networks for Hosted Data Centers Internet Zone RN20 Server Farm DNS Zone DNS Server Farm FTP Zone FTP Server Farm Customer 1 Customer 2 L2 Switch Customer 3 Customer 4 Customer 5 Customer 6 Ranch Functionality Provided The diagram shown above illustrates a portion of a Hosted Data Center which contains the servers of 6 of the Hosted Data Center s customers as well as servers of the Hosting Company themselves. Using the RN20 in this type of shared network environment allows a single device to be leveraged across multiple customers, so that each customer appears to have their own virtual Data Center. In this scenario, each of the Hosted Data Center s customers receives the following value-added services from the Hosting Company: - Security i. Firewall and Denial of Service attack protection from both the Internet and other Data Center customers ii. Fully secured three-tier website architecture. Web servers, Application Servers, and Database Servers can be separated into different Secure Zones for each customer. iii. User access to different portions of the customer s Virtual Data Center can be restricted
iv. Authentication and Authorization can be enabled so that per-user Username and Password must be entered before the user is allowed to enter the Data Center. Once approved, the user s access is limited to the permissions set in their Profile, which can be either a Group Profile or an Individual Profile. Permissions within these Profiles can be limitations based on any firewall rule (source or destination zone, source or destination IP address or port number, etc.). v. VPN (available in 2Q04) site-to-site based on SSL. - Overlay without reconfiguration i. Ranch products can be added as an overlay to upgrade an existing Data Center without needing to (1) rewire the Data Center to achieve Secure Zones, or (2) reconfigure IP addresses. This is possible due to the Virtual Zones and Split Subnetting features included in all Ranch devices. - Virtualization i. It is not necessary for all the servers of a particular Data Center customer to be all physically located together. Their servers can be anywhere within the same RN20 network but logically they will all appear as part of the same Virtual Data Center. ii. Because of Virtualization, Moves/Adds/Changes within the Data Center are much easier they can often be handled through the Ranch Configuration GUI without any rewiring, reconfiguration, or physical movement of devices within the Data Center. If one customer needs greater server capacity but another needs less, the server can be moved from one customer to the other logically rather than physically. iii. Processing power within the Ranch device will be automatically allocated to customers based on their real-time traffic demand, up to the designated bandwidth allocation available to each customer. - Quality of Service i. Each Data Center customer gets their own guaranteed bandwidth ii. Within this bandwidth, customers can prioritize different types of traffic, and guarantee this bandwidth if desired (for example, for a specific application) iii. Full support for end-to-end QoS can be provided by (1) setting TOS or DiffServ priority for outgoing traffic and (2) classification and prioritization of incoming traffic based on TOS or DiffServ. - Load Balancing i. Each Data Center customer can have Load Balancing for multiple server groups (up to a total of 1024 server groups per Ranch device) ii. Common Load Balancing algorithms such as Round Robin, Weighted Round Robin, and Least Connections are provided. iii. Persistency can be provided via: Cookie, SSL, Client IP HTTP, HTTPs, FTP (active and passive) - Health Monitoring
i. All servers within each customer s Virtual Data Center can be monitored at Layers 2, 3, or 4. If the server fails, an SNMP alarm/trap and/or Syslog message is sent to the Data Center administrator. ii. Web (HTTP) and FTP servers can be monitored at Layer 7 iii. An HTTP server can be requested to perform a database query into another server. If this database query is not successful an alarm will be sent. - Multicasting and Switching i. Layer 2-4 Switching is provided with VLAN support. ii. Multicasting is based on RFC 1112/2236/2933 and is hardware assisted to provide up to 1 Gbps of Multicast traffic. - Accounting i. All Ranch devices have the ability to count packets and bytes so that network usage can be monitored or charged back to users. Traffic can be classified for Accounting purposes based on Source or Destination Zone, Source or Destination IP Address, Source or Destination Protocol Port, or other Protocol information. The number of packets (or bytes) corresponding to the classification specification are then counted. An external Accounting, Billing, or Network Management System can query the Ranch device periodically in order to read the counters and bill (or measure) users accordingly. Over a thousand Classification Categories can be defined. Monitoring of network usage can thus be performed by customer, application, user (or group of users), server (or group of servers), or network segment Remote Management All Ranch Networks products are remotely manageable through two means: a Web-based GUI (Graphical User Interface) and SNMP. In January 2004 Ranch will be adding a third method of Remote Management which will be a PC-based tool. This tool will allow RN devices to be easily configured using a Drag and Drop user interface. The tool will also store Configuration Files for multiple RN devices, thus serving as a central repository for all Config Files. The Advantages of This Approach This Ranch solution is advantageous over other alternatives in the following ways: - Lower Capital Expense: The cost of purchasing the separate products required to perform a similar set of functions is much more expensive. (up to 5-7 times more expensive depending on vendors and products used) - Lower Operating Expense: The cost of maintaining the separate products required to perform these functions is similarly much more expensive. These costs include vendor maintenance, software support, and technical support,
internal staff time, training time, installation and configuration time, per-user licensing fees as users on the system increase, and network monitoring costs. - Ease of Upgrade: Ranch devices can be easily added as an overlay to upgrade an existing Data Center without needing to (1) rewire the Data Center to achieve Secure Zones, or (2) reconfigure IP addresses. This is possible due to the Virtual Zones and Split Subnetting features included in all Ranch devices. - Higher Reliability: The presence of multiple devices instead of one decreases the reliability of the system since more boxes means more cables, more connectors, more power supplies, more fans, and more electronic components. The greater the number of these components, the more likely there will be a system failure. Increased Reliability and Performance Firewall Bandwidth Manager Load Balancer Switch Servers Traditional Approach Enterprise LAN Ranch Approach Enterprise LAN RN20 - Higher Performance: When a packet needs to traverse multiple devices, each device must process the packet up and down its own TCP/IP stack. With Ranch Networks patent-pending Single Pass Packet Scanning technology, each packet is only processed once, regardless of how many services (security, bandwidth, etc.) are applied to it. - Lower Complexity: Fewer boxes means less network complexity and fewer opportunities to make mistakes. Training can be standardized on a single user interface, rather than multiple. Providing redundant configurations in far easier.
Example Target Customers - Hosting Data Centers - Internet Service Providers (ISPs) - Telecom Service Providers (Telco s, LECs, IXCs, MSOs) - Managed Service Providers (MSPs) - Application Service Providers (ASPs) - Disaster Recovery Centers