Secure Science DMZ using Event-Driven SDN. Technical Solutions Cisco
|
|
- Annabella Rose Strickland
- 6 years ago
- Views:
Transcription
1 Secure Science DMZ using Event-Driven SDN Tae Hwang Technical Solutions Cisco
2 Typical Science DMZ Architecture 1.0 What is the biggest challenge with this architecture? Internet Firewall I2 AL2S/ AL3S Campus Traffic is managed via simple ACL or Flow Rule UC S OK FAIL OK FAIL OK FAIL OK FAIL DMZ Switch UC S OK FAIL OK FAIL OK FAIL OK FAIL DTN/Servers/Storage/perfSONAR 2
3 Science DMZ 2.0 SciPass Operation - Phase 3 n - Phase 2 Bypassing Campus Firewall for Large Flows SDN SOLUTIONS SHOWCASE SDN SOLUTIONS SHOWCASE SciPass Architecture: Combined with Brocade OF Switch (typically), SciPass inserts bypass Bro, PerfSONAR, and SciPass controller (Indiana University) d OpenFlow forwarding rules Traffic not sent to Traffic not sent to Firewall SciPass: Controller 100G Throughput improves 100G SciPass: Controller Feedback 10G OpenFlow Switch 10G 10G 100G Firewall Firewall Feedback 10G OpenFlow Switch 10G 10G 100G PerfSONAR PerfSONAR 3
4 Flow Detection Method IPS//FW/Router Insert whitelist/acl to match a packet with specific header information Data Transfer Node (DTN) Get a notification from DTN that is about to start a data transfer Globus Get a notification from Globus or similar tools. 4
5 FW/IPS Bypass Methods Option 1: Enable OpenFlow feature on Cisco OpenFlow Hybrid Switch Option 2: Use a dedicated OpenFlow Switch if the current device doesn t support OF. Option 3: Use PBR with NXAPI. Option 4: Use VACL and Redirect with NXAPI 5
6 How to Secure Science DMZ and Campus Q. Science DMZ is directly connected to the Internet. How can we secure Science DMZ and the campus? A. Leverage security devices to detect the threats and log threats to Event server, such as Splunk. Necessary actions against the threat are triggered by apps in the event server, actions could be Blackholeling BGP routes on routers, or applying OpenFlow rules on the OF switches, or both. 6
7 Science DMZ Reference Implementa3on Commodity Internet Internet2/AL2S Next Genera=on Firewall Commodity: In- Line Internet 2: In- Line or OOB w/steering BGP Nexus 3K OpenFlow BGP Null Routes High- Throughput Science s DMZ ASR 1K ASR 9K Nexus 9K Flow No3fica3on Ac3ve Blocking Secure Corporate s Compute DTN ASA 5585 Event Correlation Log Storage Auditing Analysis Corporate DC Campus External Services 7
8 Splunk as an SDN Application Logically sits on top of COSC to provide application intelligence Likely already sending events to central logging Has the most informed view of the status of the network, servers, and apps. Provides event correlation Consolidates the number of devices sending REST commands Correlates by severity, rate, and between events Provides for auditing and reporting capabilities Leverage existing skill by writing logic in Splunk search language 8
9 Example Event Actions Real-Time, Immediate Action: e.g. High Priority Event: Block Host Immediately From Real Time With Sliding Window and Threshold: e.g. SYN Attacks: Block host after 100 improper SYNs in 60 seconds From FW Scheduled with Fixed Window: e.g. Block Timeout: Unblock host if it has not been seen in last 24 hours 9 9
10 Globus for Data Transfer A key service in the research networking ecosystem with more than 10,000 active endpoints Software-as-a-Service (SaaS) solution to manage transfers where users can direct requests to transfer or synchronize files and directories between two locations Uses GridFTP to provide secure, reliable, and efficient transfer of data across wide-area distributed networks GridFTP extensions provides parallelism (i.e., the use of multiple socket connections between pairs of data movers), restart markers, and data channel security. GridFTP control plane provides the source and destination information for the flows it sets up Effectively authenticates flows before they bypass security 10
11 OpenFlow Data Flow Steering Base setup depending on mode: Out-Of-Band : <priority>100</priority> <in-port>54</in-port> <output-node-connector>52</output-node-connector> Outside <output-node-connector>25</output-node-connector> In-Band Firewall/IPS: <priority>100</priority> <in-port>54</in-port> <output-node-connector>25</output-node-connector> 52 Inside Out-Of-Band <in-port>25</in-port> <output-node-connector>52</output-node-connector> Bypass operation the same for both modes <priority>200</priority> <in-port>54</in-port> <output-node-connector>52</output-node-connector> Outside Inside In-Band FW/IPS 25 FW/IPS 11
12 Bypass Flows in Tap Switch Flow start notification: Jun 10 10:53:43 localhost splunk_odl_action: log_level=info, action=start, flow= : :42600, status_code=200 Flows added to Nexus 3000: Flow: 4 Match: Actions: Priority: 200 tcp,in_port=54,nw_src= ,nw_dst= ,tp_src=50368,tp_dst=42600 output:52 Flow: 5 Match: tcp,in_port=52,nw_src= ,nw_dst= ,tp_src=42600,tp_dst=50368 Actions: output:54 Priority: 200 Flow stop notification: Jun 10 10:54:51 localhost splunk_odl_action: log_level=info, action=stop, flow= : :42600, status_code=200 12
13 Remotely Triggered Black Hole Routing Static routes added by COSC through Netconf on ASR 9000: router static address-family ipv4 unicast /32 Null0 tag /32 Null0 tag /32 Null0 tag /32 Null0 tag /32 Null0 tag 666 Export the Null routes setting next-hop to black hole IP: route-policy as out if tag is 666 then else endif set next-hop set community (no-export) additive pass pass end-policy Enable urpf on WAN interface on ASR 9000: ipv4 verify unicast source reachable-via any allow-default Route Black Hole IP to NULL 0 on other border routers: ip route Null0 Enable urpf on WAN interface on ASR 1000: ip verify unicast source reachable-via any 13
14 Cisco Open SDN Controller Application 1 Application 2 Application 3 Application 4 Application n Applications REST APIs DLux User Interface BASE NETWORK SERVICE FUNCTIONS Topology Statistics Manager Manager FRM L2 Switch AAA Service GBP Service Host Tracker 3 rd PARTY NETWORK SERVICE FUNCTIONS Service 1 Service 2 Service 3 Service 4 Service n Cisco Open SDN Controller Platform Model Driven Service Abstraction Layer (Plugin Manager, Capacity Abstraction, Flow Programming, Inventory, etc) OpenFlow Interface OVSDB Interface NETCONF Interface BGPLS Interface PCEP Interface OpenFlow Enabled Devices Open vswitches Cisco and 3 rd Virtual and Physical Devices Data Plane Elements 14
15 Splunk Screenshot 1 15
16 Splunk Screenshot 2 16
17 Splunk Screenshot 3 17
Using Event-Driven SDN for Dynamic DDoS Mitigation
Using Event-Driven SDN for Dynamic DDoS Mitigation Craig Hill Distinguished SE, US Federal crhill@cisco.com CCIE #1628 1 Concept and Content Creators The Cisco Engineering Team: Jason King Steven Carter
More informationEvent-Based Software-Defined Networking: Build a Secure Science DMZ
White Paper Event-Based Software-Defined Networking: Build a Secure Science DMZ What You Will Learn As the need to efficiently move large data sets around the world increases, the Science DMZ - built at
More informationOpenFlow: What s it Good for?
OpenFlow: What s it Good for? Apricot 2016 Pete Moyer pmoyer@brocade.com Principal Solutions Architect Agenda SDN & OpenFlow Refresher How we got here SDN/OF Deployment Examples Other practical use cases
More informationOpen SDN Controller Applications
The following topics describe the five applications that Open SDN Controller provides to facilitate the day-to-day administration of your network: BGPLS Manager, page 1 Inventory Manager, page 3 Model
More informationA SECURE SDN SCIENCE DMZ
A SECURE SDN SCIENCE DMZ Indiana University Yuri Kolomiyets Solutions Architect, Corsa Technology A Secure SDN Science DMZ CONTENTS The Approach The Setup The Trial [ 2 ] A Secure SDN Science DMZ The Goal
More informationIPv4 Firewall Rule configuration on Cisco SA540 Security Appliance
IPv4 Firewall Rule configuration on Cisco SA540 Security Appliance Objective The objective of this document to explain how to configure IPv4 firewall rules on Cisco SA540 Security Appliance. Firewall provide
More informationSDN Security BRKSEC Alok Mittal Security Business Group, Cisco
SDN Security Alok Mittal Security Business Group, Cisco Security at the Speed of the Network Automating and Accelerating Security Through SDN Countering threats is complex and difficult. Software Defined
More informationThe information in this document is based on Cisco IOS Software Release 15.4 version.
Contents Introduction Prerequisites Requirements Components Used Background Information Configure Network Diagram Relevant Configuration Verify Test case 1 Test case 2 Test case 3 Troubleshoot Introduction
More informationPradeep Kathail Chief Software Architect Network Operating Systems Technology Group, Cisco Systems Inc.
Pradeep Kathail Chief Software Architect Network Operating Systems Technology Group, Cisco Systems Inc. March 4 th, 2014 2012 2010 Cisco and/or its affiliates. All rights reserved. 1 2012 Cisco and/or
More informationInterchassis Asymmetric Routing Support for Zone-Based Firewall and NAT
Interchassis Asymmetric Routing Support for Zone-Based Firewall and NAT The Interchassis Asymmetric Routing Support for Zone-Based Firewall and NAT feature supports the forwarding of packets from a standby
More informationConfiguring Policy-Based Routing
This chapter contains the following sections: Finding Feature Information, page 1 Information About Policy Based Routing, page 1 Licensing Requirements for Policy-Based Routing, page 5 Prerequisites for
More informationEIGRP Over the Top. Finding Feature Information. Information About EIGRP Over the Top. EIGRP Over the Top Overview
The feature enables a single end-to-end routing domain between two or more Enhanced Interior Gateway Routing Protocol (EIGRP) sites that are connected using a private or a public WAN connection. This module
More informationASA Has High CPU Usage Due to a Traffic Loop When VPN Clients Disconnect
ASA Has High CPU Usage Due to a Traffic Loop When VPN Clients Disconnect Contents Introduction Prerequisites Requirements Components Used Background Information Problem: Packets Destined for a Disconnected
More informationDesign and development of the reactive BGP peering in softwaredefined routing exchanges
Design and development of the reactive BGP peering in softwaredefined routing exchanges LECTURER: HAO-PING LIU ADVISOR: CHU-SING YANG (Email: alen6516@gmail.com) 1 Introduction Traditional network devices
More informationDeploying Cisco ASA Firewall Solutions (FIREWALL v1.0)
Cisco 642-617 Deploying Cisco ASA Firewall Solutions (FIREWALL v1.0) Version: 4.8 QUESTION NO: 1 Which Cisco ASA feature enables the ASA to do these two things? 1) Act as a proxy for the server and generate
More informationStatic and Default Routes
This chapter describes how to configure static and default routes on the Cisco ASA. About, on page 1 Guidelines for, on page 3 Configure Default and Static Routes, on page 3 Monitoring a Static or Default
More informationObjective. Set out to reverse engineer SDN implementations and secure the entire thing.
Objective Set out to reverse engineer SDN implementations and secure the entire thing. Unable to find production implementations aside from intraas ones in big data centers! SDN: More Questions than Answers
More informationCisco Extensible Network Controller
Data Sheet Cisco Extensible Network Controller Product Overview Today s resource intensive applications are making the network traffic grow exponentially putting high demands on the existing network. Companies
More informationPolicy Based Routing:
This chapter describes how to configure the Cisco ASA to support policy based routing (PBR). The following sections describe policy based routing, guidelines for PBR, and configuration for PBR. About,
More informationMAKING THE CLOUD A SECURE EXTENSION OF YOUR DATACENTER
MAKING THE CLOUD A SECURE EXTENSION OF YOUR DATACENTER Bret Hartman Cisco / Security & Government Group Session ID: SPO1-W25 Session Classification: General Interest 1 Mobility Cloud Threat Customer centric
More informationNetwork Layer: The Control Plane
Network Layer: The Control Plane 7 th Edition, Global Edition Jim Kurose, Keith Ross Pearson April 06 5- Software defined networking (SDN) Internet network layer: historically has been implemented via
More informationEnding the Confusion About Software- Defined Networking: A Taxonomy
Ending the Confusion About Software- Defined Networking: A Taxonomy This taxonomy cuts through confusion generated by the flood of vendor SDN announcements. It presents a framework that network and server
More informationNetwork Policy Enforcement
CHAPTER 6 Baseline network policy enforcement is primarily concerned with ensuring that traffic entering a network conforms to the network policy, including the IP address range and traffic types. Anomalous
More informationProvisioning Overlay Networks
This chapter has the following sections: Using Cisco Virtual Topology System, page 1 Creating Overlays, page 2 Creating Network using VMware, page 4 Creating Subnetwork using VMware, page 4 Creating Routers
More informationSegment Routing On Demand SR Next Hop. Bertrand Duvivier Principal Engineer CKN, March 29 th 2016
Segment Routing On Demand SR Next Hop Bertrand Duvivier Principal Engineer CKN, March 29 th 2016 (from next slide) 2 Network Bandwidth demand in SP s Network demand double every 18 months Compute demand
More informationOpenStack and OpenDaylight, the Evolving Relationship in Cloud Networking Charles Eckel, Open Source Developer Evangelist
OpenStack and OpenDaylight, the Evolving Relationship in Cloud Networking Charles Eckel, Open Source Developer Evangelist Agenda Introduction OpenStack OpenDaylight OPNFV Putting it all Together Conclusion
More informationCisco Nexus Data Broker
Data Sheet Cisco Nexus Data Broker Product Overview You used to monitor traffic mainly to manage network operations. Today, when you monitor traffic you can find out instantly what is happening throughout
More informationInterAS Option B. Information About InterAS. InterAS and ASBR
This chapter explains the different InterAS option B configuration options. The available options are InterAS option B, InterAS option B (with RFC 3107), and InterAS option B lite. The InterAS option B
More informationData Plane Protection. The googles they do nothing.
Data Plane Protection The googles they do nothing. Types of DoS Single Source. Multiple Sources. Reflection attacks, DoS and DDoS. Spoofed addressing. Can be, ICMP (smurf, POD), SYN, Application attacks.
More informationPrepAwayExam. High-efficient Exam Materials are the best high pass-rate Exam Dumps
PrepAwayExam http://www.prepawayexam.com/ High-efficient Exam Materials are the best high pass-rate Exam Dumps Exam : 642-618 Title : Deploying Cisco ASA Firewall Solutions (FIREWALL v2.0) Vendors : Cisco
More informationIntroduction to External Connectivity
Before you begin Ensure you know about Programmable Fabric. Conceptual information is covered in the Introduction to Cisco Programmable Fabric and Introducing Cisco Programmable Fabric (VXLAN/EVPN) chapters.
More informationService Graph Design with Cisco Application Centric Infrastructure
White Paper Service Graph Design with Cisco Application Centric Infrastructure 2017 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 1 of 101 Contents Introduction...
More informationBUCKNELL S SCIENCE DMZ
BUCKNELL S SCIENCE #Bisonet Param Bedi VP for Library and Information Technology Principal Investigator Initial Science Design Process Involving Bucknell faculty researchers Library and Information Technology
More informationDeploying LISP Host Mobility with an Extended Subnet
CHAPTER 4 Deploying LISP Host Mobility with an Extended Subnet Figure 4-1 shows the Enterprise datacenter deployment topology where the 10.17.1.0/24 subnet in VLAN 1301 is extended between the West and
More informationCisco SD-WAN and DNA-C
Cisco SD-WAN and DNA-C SD-WAN Cisco SD-WAN Intent-based networking for the branch and WAN 4x Improved application experience Better user experience Deploy applications in minutes on any platform with consistent
More informationBorder Gateway Protocol - BGP
BGP Fundamentals Border Gateway Protocol - BGP Runs over TCP (port 179) TCP connection required before BGP session Need to be reachable! Path vector routing protocol Best path selection based on path attributes
More informationDNA SA Border Node Support
Digital Network Architecture (DNA) Security Access (SA) is an Enterprise architecture that brings together multiple building blocks needed for a programmable, secure, and highly automated fabric. Secure
More informationInternational OpenFlow/SDN Test Beds 3/31/15
Duke s SDN Journey International OpenFlow/SDN Test Beds 3/31/15 Charley.Kneifel@duke.edu Part 1 Planning Definitions Infrastructure Considerations Use Cases Service Delivery / Management Considerations
More informationEnterprise SD-WAN Financial Profile (Hybrid WAN, Segmentation, Quality of Service, Centralized Policies)
CVP CVP Enterprise SD-WAN Financial Profile (Hybrid WAN, Segmentation, Quality of Service, Centralized Policies) 2018 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information.
More informationChapter 5 Network Layer: The Control Plane
Chapter 5 Network Layer: The Control Plane A note on the use of these Powerpoint slides: We re making these slides freely available to all (faculty, students, readers). They re in PowerPoint form so you
More informationBrocade Flow Optimizer
DATA SHEET Brocade Flow Optimizer Highlights Helps improve business agility by streamlining network operations via policy-driven visibility and control of network flows Provides distributed attack mitigation
More informationSecuring BYOD with Cisco TrustSec Security Group Firewalling
White Paper Securing BYOD with Cisco TrustSec Security Group Firewalling Getting Started with TrustSec What You Will Learn The bring-your-own-device (BYOD) trend can spur greater enterprise productivity
More informationBGP Support for IP Prefix Export from a VRF Table into the Global Table
BGP Support for IP Prefix Export from a VRF Table into the Global Table This feature allows a network administrator to export IP prefixes from a VRF table into the global routing table. Finding Feature
More informationExamTorrent. Best exam torrent, excellent test torrent, valid exam dumps are here waiting for you
ExamTorrent http://www.examtorrent.com Best exam torrent, excellent test torrent, valid exam dumps are here waiting for you Exam : 400-251 Title : CCIE Security Written Exam (v5.0) Vendor : Cisco Version
More informationCisco Open SDN Controller 1.2 Administrator Guide
First Published: September 16, 2015 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883
More informationProgrammableFlow: OpenFlow Network Fabric
ProgrammableFlow: OpenFlow Network Fabric Samrat Ganguly, PhD NEC Corpora)on of America Page 1 Introducing ProgrammableFlow Software Defined Network Suite First OpenFlow-enabled network fabric Design,
More informationETSI FUTURE Network SDN and NFV for Carriers MP Odini HP CMS CT Office April 2013
ETSI FUTURE Network SDN and NFV for Carriers MP Odini HP CMS CT Office April 2013 Challenges and Opportunities Reduce Capex/Opex Challenges Innovation at devices and OTT side Number of devices explode
More informationMPLS VPN over mgre. Finding Feature Information. Last Updated: November 1, 2012
MPLS VPN over mgre Last Updated: November 1, 2012 The MPLS VPN over mgre feature overcomes the requirement that a carrier support multiprotocol label switching (MPLS) by allowing you to provide MPLS connectivity
More informationCisco Cloud Architecture with Microsoft Cloud Platform Peter Lackey Technical Solutions Architect PSOSPG-1002
Cisco Cloud Architecture with Microsoft Cloud Platform Peter Lackey Technical Solutions Architect PSOSPG-1002 Agenda Joint Cisco and Microsoft Integration Efforts Introduction to CCA-MCP What is a Pattern?
More informationVendor: Cisco. Exam Code: Exam Name: Implementing Cisco IP Routing (ROUTE v2.0) Version: Demo
Vendor: Cisco Exam Code: 300-101 Exam Name: Implementing Cisco IP Routing (ROUTE v2.0) Version: Demo DEMO QUESTION 1 Refer to the exhibit. The DHCP client is unable to receive a DHCP address from the DHCP
More informationImplementing VXLAN. Prerequisites for implementing VXLANs. Information about Implementing VXLAN
This module provides conceptual information for VXLAN in general and configuration information for layer 2 VXLAN on Cisco ASR 9000 Series Router. For configuration information of layer 3 VXLAN, see Implementing
More informationOpenDaylight: Introduction, Lithium and Beyond Colin Dixon
OpenDaylight: Introduction, Lithium and Beyond Colin Dixon Technical Steering Committee Chair, OpenDaylight Senior Principal Engineer, Brocade Some content from: David Meyer, Neela Jaques, and Kevin Woods
More informationEvolution of Data Center Security Automated Security for Today s Dynamic Data Centers
Evolution of Data Center Security Automated Security for Today s Dynamic Data Centers Speaker: Mun Hossain Director of Product Management - Security Business Group Cisco Twitter: @CiscoDCSecurity 2 Any
More informationVirtualized Network Services SDN solution for service providers
Virtualized Network Services SDN solution for service providers Nuage Networks Virtualized Network Services (VNS) is a fresh approach to business networking that seamlessly links your enterprise customers
More informationBROCADE CLOUD-OPTIMIZED NETWORKING: THE BLUEPRINT FOR THE SOFTWARE-DEFINED NETWORK
BROCADE CLOUD-OPTIMIZED NETWORKING: THE BLUEPRINT FOR THE SOFTWARE-DEFINED NETWORK Ken Cheng VP, Service Provider and Application Delivery Products September 12, 2012 Brocade Cloud-Optimized Networking
More informationConfigure IOS XR Traffic Controller (XTC)
IOS XR Traffic Controller (XTC) provides stateful path computation element (PCE) functionality by exting the existing IOS-XR PCE functionality with additional capabilities. The current IOS-XR PCE function
More informationVirtualized Network Services SDN solution for enterprises
Virtualized Network Services SDN solution for enterprises Nuage Networks Virtualized Network Services (VNS) is a fresh approach to business networking that seamlessly links your enterprise s locations
More informationThe Next Opportunity in the Data Centre
The Next Opportunity in the Data Centre Application Centric Infrastructure Soni Jiandani Senior Vice President, Cisco THE NETWORK IS THE INFORMATION BROKER FOR ALL APPLICATIONS Applications Are Changing
More informationASA/PIX Security Appliance
I N D E X A AAA, implementing, 27 28 access to ASA/PIX Security Appliance monitoring, 150 151 securing, 147 150 to websites, blocking, 153 155 access control, 30 access policies, creating for web and mail
More informationCentinel: Streaming Data Handler. April 20 th, 2016
Centinel: Streaming Data Handler April 20 th, 2016 1 An Overview 2 Centinel: Streaming Data Handler Aim of Centinel is to asssist operators by providing visibility into OpenDaylight management software
More informationIdentity Firewall. About the Identity Firewall
This chapter describes how to configure the ASA for the. About the, on page 1 Guidelines for the, on page 7 Prerequisites for the, on page 9 Configure the, on page 10 Monitoring the, on page 16 History
More informationIntroduction to Segment Routing Santiago Álvarez, Distinguished Technical Marketing Engineer BRKRST-2124
Introduction to Segment Routing Santiago Álvarez, Distinguished Technical Marketing Engineer BRKRST-2124 Agenda Technology Overview Use Cases A Closer Look to Control and Data Plane Traffic Protection
More informationCisco Nexus Data Broker for Network Traffic Monitoring and Visibility
Guide Cisco Nexus Data Broker for Network Traffic Monitoring and Visibility Solution Implementation Guide 2015 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information.
More informationCisco ACI Multi-Pod/Multi-Site Deployment Options Max Ardica Principal Engineer BRKACI-2003
Cisco ACI Multi-Pod/Multi-Site Deployment Options Max Ardica Principal Engineer BRKACI-2003 Agenda ACI Introduction and Multi-Fabric Use Cases ACI Multi-Fabric Design Options ACI Stretched Fabric Overview
More informationVeč kot SDN - SDA arhitektura v uporabniških omrežjih
Več kot SDN - SDA arhitektura v uporabniških omrežjih Aleksander Kocelj SE Cisco Agenda - Introduction to Software Defined Access - Brief description on SDA - Cisco SDA Assurance - DEMO 2 New Requirements
More informationThe IINS acronym to this exam will remain but the title will change slightly, removing IOS from the title, making the new title.
I n t r o d u c t i o n The CCNA Security IINS exam topics have been refreshed from version 2.0 to version 3.0. This document will highlight exam topic changes between the current 640-554 IINS exam and
More informationConfiguring Policy-Based Redirect
About Policy-Based Redirect, on page 1 About Multi-Node Policy-Based Redirect, on page 3 About Symmetric Policy-Based Redirect, on page 3 Policy Based Redirect and Hashing Algorithms, on page 4 Policy-Based
More informationCisco SD-WAN. Securely connect any user to any application across any platform, all with a consistent user experience.
Cisco Securely connect any user to any application across any platform, all with a consistent user experience. Introduction Moving applications to the cloud requires faster, more reliable connectivity.
More informationCarrier SDN for Multilayer Control
Carrier SDN for Multilayer Control Savings and Services Víctor López Technology Specialist, I+D Chris Liou Vice President, Network Strategy Dirk van den Borne Solution Architect, Packet-Optical Integration
More informationCisco Virtual Topology System (VTS)
Cisco Virtual Topology System (VTS) Cisco Knowledge Network Presentation Vijay Arumugam and Palak Desai Product Management, Cloud and Virtualization Feb 3, 2016 Agenda Trends and Challenges in SP market
More informationCompare Security Analytics Solutions
Compare Security Analytics Solutions Learn how Cisco Stealthwatch compares with other security analytics products. This solution scales easily, giving you visibility across the entire network. Stealthwatch
More informationGRE Tunnel with VRF Configuration Example
GRE Tunnel with VRF Configuration Example Document ID: 46252 Contents Introduction Prerequisites Requirements Components Used Conventions Configure Network Diagram Configurations Verify Troubleshoot Caveats
More informationCVP Enterprise Cisco SD-WAN Retail Profile (Hybrid WAN, Segmentation, Zone-Based Firewall, Quality of Service, and Centralized Policies)
CVP CVP Enterprise Cisco SD-WAN Retail Profile (Hybrid WAN, Segmentation, Zone-Based Firewall, Quality of Service, and Centralized Policies) 2018 Cisco and/or its affiliates. All rights reserved. This
More informationGlobalNOC Services Update Internet2 Global Summit
GlobalNOC Services Update 2015 Internet2 Global Summit Annual Report http://globalnoc.iu.edu/annual-report/2014/ 4/28/15 Service Desk Year in Review: Welcomed ARE-ON and OSHEAN to the GlobalNOC Family
More informationConfiguring Policy-Based Routing
25 CHAPTER This chapter describes the tasks for configuring policy-based routing (PBR) on a router and includes these major sections: Overview of Policy-Based Routing, page 25-1 Policy-Based Routing Configuration
More informationCableLabs update for ODL Advisory Group
CableLabs update for ODL Advisory Group Chris Donley May 21, 2015 Cable Television Laboratories, Inc. 2015. Do not share this material with anyone other than CableLabs Members, and vendors under CableLabs
More informationAlgoSec: How to Secure and Automate Your Heterogeneous Cisco Environment
BRKPAR-2488 AlgoSec: How to Secure and Automate Your Heterogeneous Cisco Environment Edy Almer How to Secure and Automate Your Heterogeneous Cisco Environment Yogesh Kaushik, Senior Director Cisco Doug
More informationMassimiliano Sbaraglia
Massimiliano Sbaraglia Printer Layer 2 access connections to End-Point Layer 2 connections trunk or layer 3 p2p to pair distribution switch PC CSA PVST+ or MST (Spanning Tree Protocol) VLANs LapTop VoIP
More informationConfiguring Policy-Based Routing
CHAPTER 28 This chapter describes the tasks for configuring policy-based routing (PBR) on a router and includes these major sections: Overview of Policy-Based Routing, page 28-1 Policy-Based Routing Configuration
More informationDDoS Protection in Backbone Networks
DDoS Protection in Backbone Networks The Czech Way Pavel Minarik, Chief Technology Officer Holland Strikes Back, 3 rd Oct 2017 Backbone DDoS protection Backbone protection is specific High number of up-links,
More informationLocation ID Separation Protocol. Gregory Johnson -
Location ID Separation Protocol Gregory Johnson - grjohnso@cisco.com LISP - Agenda LISP Overview LISP Operations LISP Use Cases LISP Status (Standards and in the Community) Summary 2 LISP Overview 2010
More informationConfiguring Policy-Based Routing
CHAPTER 17 This chapter describes how to configure policy based routing. This chapter includes the following sections: Information About Policy Based Routing, page 17-1 Licensing Requirements for Policy-Based
More informationKillTest. 半年免费更新服务
KillTest 质量更高 服务更好 学习资料 http://www.killtest.cn 半年免费更新服务 Exam : 642-618 Title : Deploying Cisco ASA Firewall Solutions (FIREWALL v2.0) Version : DEMO 1 / 9 1.On the Cisco ASA, tcp-map can be applied to
More informationMPLS VPN Explicit Null Label Support with BGP. BGP IPv4 Label Session
MPLS VPN Explicit Null Label Support with BGP IPv4 Label Session The MPLS VPN Explicit Null Label Support with BGP IPv4 Label Session feature provides a method to advertise explicit null in a Border Gateway
More informationMigration from Classic DC Network to Application Centric Infrastructure
Migration from Classic DC Network to Application Centric Infrastructure Kannan Ponnuswamy, Solution Architect, Cisco Advanced Services Acronyms IOS vpc VDC AAA VRF STP ISE FTP ToR UCS FEX OTV QoS BGP PIM
More informationECMP Load Balancing. MPLS: Layer 3 VPNs Configuration Guide, Cisco IOS XE Release 3S (Cisco ASR 900 Series) 1
Equal-cost multi-path routing (ECMP) is a routing strategy where next-hop packet forwarding to a single destination can occur over multiple "best paths" which tie for top place in routing metric calculations.
More informationEnterprise. Nexus 1000V. L2/L3 Fabric WAN/PE. Customer VRF. MPLS Backbone. Service Provider Data Center-1 Customer VRF WAN/PE OTV OTV.
2 CHAPTER Cisco's Disaster Recovery as a Service (DRaaS) architecture supports virtual data centers that consist of a collection of geographically-dispersed data center locations. Since data centers are
More informationSDN/DANCES Project Update Developing Applications with Networking Capabilities via End-to-end SDN (DANCES)
SDN/DANCES Project Update Developing Applications with Networking Capabilities via End-to-end SDN (DANCES) Kathy L. Benninger Manager of Networking Research PSC Bettis Briefing 15 September 2015 Agenda
More informationINTRODUCTION 2 DOCUMENT USE PREREQUISITES 2
Table of Contents INTRODUCTION 2 DOCUMENT USE PREREQUISITES 2 LISP MOBILITY MODES OF OPERATION/CONSUMPTION SCENARIOS 3 LISP SINGLE HOP SCENARIO 3 LISP MULTI- HOP SCENARIO 3 LISP IGP ASSIT MODE 4 LISP INTEGRATION
More informationHuawei CloudEngine Series. VXLAN Technology White Paper. Issue 06 Date HUAWEI TECHNOLOGIES CO., LTD.
Issue 06 Date 2016-07-28 HUAWEI TECHNOLOGIES CO., LTD. 2016. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of
More informationConfiguring Policy-Based Redirect
About Policy-Based Redirect, page 1 About Symmetric Policy-Based Redirect, page 8 Policy Based Redirect and Hashing Algorithms, page 8 Using the GUI, page 9 Using the NX-OS-Style CLI, page 10 Verifying
More informationThe UniNet Express Lane Services
The UniNet Express Lane Services Assoc. Prof. Vara Varavithya and Peeranon Wattanapong KMUTNB 1 Contents Introduction Problems Motivation Body of Knowledge Contributions Software-Defined Networks Research
More informationNetwork Infrastructure Filtering at the border. stole slides from Fakrul Alam
Network Infrastructure Filtering at the border maz@iij.ad.jp stole slides from Fakrul Alam fakrul@bdhbu.com Acknowledgement Original slides prepared by Merike Kaeo What we have in network? Router Switch
More informationConfiguring Policy-Based Routing
35 CHAPTER This chapter describes the tasks for configuring policy-based routing (PBR) on a router and includes these major sections: Overview of Policy-Based Routing, page 35-1 Policy-Based Routing Configuration
More informationMPLS VPN--Inter-AS Option AB
The feature combines the best functionality of an Inter-AS Option (10) A and Inter-AS Option (10) B network to allow a Multiprotocol Label Switching (MPLS) Virtual Private Network (VPN) service provider
More informationUnicast Reverse Path Forwarding Loose Mode
The feature creates a new option for Unicast Reverse Path Forwarding (Unicast RPF), providing a scalable anti-spoofing mechanism suitable for use in multihome network scenarios. This mechanism is especially
More informationibgp Multipath Load Sharing
This feature module describes the feature. This feature enables the BGP speaking router to select multiple ibgp paths as the best paths to a destination. The best paths or multipaths are then installed
More informationCisco recommends that you have basic knowledge of Performance Routing (PfR).
Contents Introduction Prerequisites Requirements Components Used Background Information Passive Monitoring Active Monitoring Hybrid Mode Configure Network Diagram Relevant Configuration Verify Passive
More informationClean Pipe Solution 2.0
Clean Pipes 2.0 1 Clean Pipe Solution 2.0 Executive Summary...3 Best Current Practices...5 Network Infrastructure BCPs...5 Host Based BCPs...5 Dedicated DDoS BCPs...6 Cisco Clean Pipes Solution Overview...6
More informationR&E ROUTING SECURITY BEST PRACTICES. Grover Browning Karl Newell
R&E ROUTING SECURITY BEST PRACTICES Grover Browning Karl Newell RFC 7454 BGP Operations & Security Feb, 2015 https://tools.ietf.org/html/rfc7454 [ 2 ] Agenda Background / Community Development Overview
More information