FOUNDATION: NEXT GENERATION ROUTING AND MULTIFUNCTION SWITCHING

Transcription

1 FOUNDATION: NEXT GENERATION ROUTING AND MULTIFUNCTION SWITCHING CISCO BUSINESS SOLUTIONS WORKSHOP FOR RESELLERS 1

2 Agenda Technology Trends Shaping the Business World Cisco Integrated Services Router Solutions Catalyst Intelligent Switching Solutions Ease of Management Summary Question and Answer 2

3 Your Technology Helping You Keep Pace? Pressure to Maintain and Grow Business Improve Operational Efficiency Solutions to reduce operational expenses and protect assets Collaborative tools to improve employee productivity Improved total value from network solution Protect and Increase Top-Line Growth Customers are increasingly interested in internet-based services Customer service needs to deliver rapid and dependable response Your company needs technology agility to keep pace with competition also offering new services 3

4 Getting the Best Value for Your Infrastructure Investment Today s network deployments are expected to last longer than ever before Today s deployments are critical for tomorrow s success Enable new application deployments PoE, 10/100/1000 Effective investments today provide greater long-term value Minimize network disruptions Avoid unnecessary downtime Leverage investment more effectively THE NETWORK IS THE FOUNDATION INVEST IN TECHNICAL SOPHISTICATION 4

5 Traditional Business Solution Security Content Delivery Voice Services Data Local Connectivity Firewall, IDS and VPN Appliances Content Engine Hybrid/Key System Branch Access Router LAN Switch 5

6 Cisco: Integrated Systems Integrated Services Embedded Security Voice Ready Video Integration 6

7 Applications and User Access New Demands on Networks Even in Small Offices 60% 50% 40% 30% 20% 10% Firewall IDS/IPS Virus Scanning Remote Access VPN Wireless LAN Smallest Companies Planning to Deploy Security Basics, Wireless LAN over Next 12 Months 0% >100 Employees Employees Source: Cisco Sponsored Survey; May

8 VoD Idle Aire (File title: idleair_final.wmv) 10593_01_2005_G_c2 NDA Cisco Confidential 8

9 CISCO INTEGRATED SERVICES ROUTERS 9

10 Cisco s New Integrated Services Routers Secure, Concurrent Services at Wire Speed! Up to 5X Service Density, 7X Performance, 4X Memory! 3800 Series 2800 Series Embedded Security, Tightly Integrated with Voice Backward Compatibility with Existing Router Modules for Solid Investment Protection Integrated Services Routers 1800 Series Plus Headroom to Grow! Industry-Leading Network Availability and Resilience 10

11 WHAT S NEW IN INTEGRATED ROUTER SECURITY 11

12 Cisco Integrated Security on Integrated Services Routers Merging Best-of-Breed Network Security Technology with Over 20 Years of Routing and IP Services Expertise An Industry First Routing Technology Leadership 20 Years of Routing & IP Services Expertise Security Technology Leadership Best-of-Breed Security Trust and Identity Leverage the network to intelligently protect Endpoints Secure Connectivity Secure and scalable network Connectivity VPN Concentrator Cisco Firewall Cisco ISR & Mid Range Routers Network Foundation Protection Prevent, Protect and Police the network infrastructure from attacks Threat Defense Prevent and respond to network attacks and threats such as worms Cisco IDS Sensors Cisco IOS VPN Network Security Standard on Every New Router for End-to-End Network Protection 12

13 Cisco IOS IPS New Features and Engines All Inline! String Engines enable custom matching of any string in the packet Customize signatures for quick reaction to new threats 400 worm and attack signatures added nearly 1200 total signatures from which to dynamically select NEW ATTACK PREVENTION ENGINES TCP String UDP String ICMP String Trend Micro CISCO CONFIDENTIAL 13

14 Companies Are Opening Port 80 Attacks Enter Through Web-Enabled Applications Internet access 98% Internal Users 75% of successful attacks against Web servers are entering through applications and not at the network level. Rich media 43% IM traffic 43% Web enabled apps 55% Web services 43% Port 80 Internet 80 HTTP 64% of enterprises have opened Port 80 on their firewalls for their growing web application traffic Source: Aug 2002 InfoWorld/Network Computing survey of IT Professionals John Pescatore, VP and Research Director, Gartner, June

15 Cisco IOS Application Firewall Get Control of Port 80! I am http web traffic honest! Payload Port 80 Server Farm Corporate Office Enables application inspection and control of tunneled traffic Convergence of Cisco IOS Firewall and Inline IPS technologies Control misuse of port 80 by rogue applications apps that tunnel traffic inside http to avoid scrutiny Example: Instant messaging and peer-to-peer applications such as Kazaa Manage bandwidth consumption through usage policies Protocol anomaly detection services 15

16 USB Ports Removable Credentials First Routers in the Industry with USB Ports USB ports integrated into all Cisco ISRs Initial support for secure token and FLASH memory Provisioning secure configuration distribution Drop-ship router to location Provision boot-strap into token, send token to location Plug token into router, turn router on, router loads off bootstrap, router uses configuration on token or downloads configuration Distribution and storage of VPN credentials (preshared keys and/or certificates) Leverages etoken technology for highly secure and removable credentials Bulk flash for image distribution/storage as alternative to compact flash deployment GE Power af GE HWIC HWIC HWIC HWIC VPN NME EVM AIM AIM USB USB 2 USB Ports on 3800, 2851, 2821, 2811 Models 1 USB Port on 2801,

17 Easier to Install and Maintain: Cisco Router and Security Device Manager (SDM) v2.1 Intuitive, Web-Based Device Management Tool for Cisco Routers Featured on Routers Cisco SDM Express Consumer-friendly interface for quick router setup SDM on PC Resellers can manage Cisco routers without SDM image on flash Three new IPS signature engines PPPoA configuration xdsl deployments Available in six languages (Q2 CY 05) Miercom broadly endorses a slick software tool for configuring and monitoring your Cisco routers. It works, it s free, and it s from Cisco. ED MIER, MIERCOM 17

18 SMALL BUSINESS SERIES (SB 100 SERIES) 10593_01_2005_G_c2 NDA Cisco Confidential 18

19 Small Business Access Router Portfolio 3800 Series Cisco Integrated Services Routers Performance and Services Density Highest Density and Performance for Concurrent Services 2800 Series Embedded, Advanced Voice, Video, Data and Security Services High Performance Integrated Security and Data Secure Broadband Connectivity 1800 Series 800 Series Small Business 100 Series Office Size Enterprise Branch Office Small Branch Small Remote Offices Teleworker Single Site Small Business 19

20 Small Business 100 (SB100) Series Broadband Access for Small Business Networks Affordable Cisco router for data-only applications in small businesses offices up to five users Cisco SB106 Shown Secure connectivity with integrated stateful firewall DSL/Cable ADSL, ADSL over ISDN or Ethernet WAN Interface Models: SB 101 (100MB Ethernet) SB 106/SB 107 (DSL) 10/100 MB Ethernet Switch Stateful Firewall 4-port 10/100 MB Ethernet switch Simple setup and remote management capabilities of Cisco IOS software Console Port/Virtual AUX Connects to PC or Modem for Configuration ISDN Port (106 Only) ISDN Line for Out-of-Band Management DSL WAN Port or Ethernet WAN Port Connects to SP Network or DSL/Cable Modem 20

21 NEW MODELS AND SERVICES IN CISCO INTEGRATED SERVICES ROUTERS CISCO CONFIDENTIAL 21

22 Cisco Integrated Services Routers The Right Router for Every Office Markets Enterprise Medium Business Small Business Performance and Services Density 3800 Series Highest Density and Performance for Concurrent Services 2800 Series Embedded, Advanced Voice, Video, Data and Security Services High-Performance Integrated Security and Data Secure Broadband and Wireless Connectivity 1800 Series Modular Fixed New Models for Small Offices 800 Series Office Size Enterprise Branch Office Small Branch Small Remote Offices Teleworker Single-Site Small Business 22

23 ISR Fixed-Configuration Wireless Routers Product Comparison Price Cisco 1800 Series Cisco 870 Series Cisco 850 Series Broadband Performance Stateful inspection firewall & IPSec 3DES/AES VPNs 4-port 10/100 switch b/g with single fixed antenna Cisco SDM & IOS for set up & management Stateful inspection firewall, IPSec 3DES or AES VPNs, IPS, Antivirus/NAC b/g with multiple replaceable antennas Advanced QoS features Software & Memory Upgrades 4-port 10/100 managed switch Up to 3 VLANs, external POE Cisco SDM & IOS for set up & management High Performance Broadband performance Stateful inspection firewall, IPSec 3DES or AES VPNs, IPS, Antivirus/NAC Integrated ISDN, analog modem, or Ethernet backup port for redundant WAN links and load balancing a and b/g with multiple replaceable antennas 8-port 10/100 managed switch, internal power supply, PoE Up to 8 VLANs Cisco SDM & IOS for set up & management Value (Feature, Performance) 23

24 KEY SERVICES FOR THE SMALL OFFICE CISCO CONFIDENTIAL 24

25 Key Services Business-Class Broadband Integrated DSL or External Modem or Metro Ethernet External POTS Back Up and Out of Band Management Optional PSTN Backup Network Integrated POTS/ISDN Back Up and Out of Band Management Internet WAN 2 Cisco 1800 Cisco Port Switch SP Network Load Balancing and Failover WAN 1 8 Port Switch DMZ for Servers DMZ for Servers Cisco IOS Software for Reliability and Remote Troubleshooting 25

26 Integrated Security Services in the Small Office Router enforces Firewall, Antivirus, URL Access Policies at the Small Office Antivirus Policy System Corporation Internet Deep Packet Inspection Firewall For Managed Firewall Service Remote Office User Authentication with 802.1x Cisco 800/1800 N2H2/ Websense URL Policy Server SP Network IPSec VPN High-Speed Encryption for Managed IPSec or AES VPNs Inline IPS Inline Threat Containment - Create Zones of Protection Cisco SDM Used for Setup and Monitoring of Security Policy 26

27 Key Services Secure Wireless LAN Enterprise-Class Wireless LANs at the Remote Site b IP phones Cisco 800/1800/2800/3800 HQ Router b/g Client or a* WAN Link IP Phone 10BaseT/100BaseTX PC Clients *802.11a not supported on Cisco 800 Single Device for WAN and WLAN Reduces Hardware Cost and Deployment Cost WLAN Set Up Simplified with Cisco SDM WLAN, WAN, and Local Authentication for a True Enterprise Class Wireless Solution at the Remote Office Visibility and Control through the Remote Management Features 27

28 Key Services Voice for Small Remote Office or Teleworker Advanced application support (voice, video) Centralized management IT managed security policies Apps Voice Video IP Phone Cisco 800/1800 VPN Headend Router Broadband Internet MPLS/Encrypted VPN Tunnel Corporate Network Wireless Call Manager Corporate pushed security policies (not usermanaged) Corporate phone, toll-bypass, centralized voic Integrated security and identity services Optional Secure Wireless LAN 28

29 VoD Idle Aire (File title: IDLE AIRE.wmv) CISCO CONFIDENTIAL 29

30 Integrated Systems Approach Enabling Growth and Customer/Partner Success IP Communications Mobility Availability/ Resiliency Predictable INTELLIGENT Performance SWITCHING AND Integrated Security ROUTING Enhanced Manageability High Availability Delivery Optimization Self-Defending Network 30

31 CATALYST INTELLIGENT SWITCHING PRODUCT UPDATE CISCO CONFIDENTIAL 31

32 The Evolution of the Network Technology Trends Converged networks driving requirements for: PoE, 10/100/1000 connectivity SECURITY Security everywhere Easier management New and growing application deployment with increased unpredictable and time sensitive traffic patterns Longer investment protection VOICE Networks are lasting longer than before VIDEO DATA SAN 32 S 2

33 Future Cost Assessment The Cost of Purchasing Future-Ready Technology Is Lower than Upgrading Later Cost to Purchase Non-PoE Card Today Cost to Purchase PoE Card Today Cost to Upgrade to PoE Card Tomorrow $5,500 $7,500 $13,000 36% More 170% More Things to Consider Beyond Purchase Cost: Reinstallation and configuration Network disruption Missed opportunities Future trade-in value 2x Cost to Upgrade Later 33

34 A Glimpse into the Future The Ethernet Powered Organization Wireless Access Points Fire Protection IP Integrated Video Surveillance Power over Ethernet (PoE) Is the Ability to Deliver Regulated -48V DC Power over a Standard Copper Ethernet Cable Resilient, Available IP Network with Scalable Power Delivery Powered IP Telephone Building Access Control Cisco Products Support Both the Pre-Standard Inline Power AND the IEEE 802.3af Standard 34

35 LAN Access Trends Application Ready Desktop Connectivity: 10/100/1000 and PoE Strong adoption of 10/100/1000 and PoE 10/100/1000 has already crossed over 10/100 on modular platforms Cisco has shipped over 25 million PoE ports to date Widest range of 10/100/1000 and PoE options Why 10/100/1000 and PoE Minimal price premium over non-poe, 10/100/1000 switches PCs ship with 10/100/1000 NICs IP-Tel and increase in new PoE end devices Longer investment protection Cross Portfolio 10/100/1000 and PoE Catalyst 6500 Catalyst 4500 Catalyst 3750/3560 GbE IP Phone NEW NEW 35

36 FIXED AND STACKABLE SWITCH UPDATE CISCO CONFIDENTIAL 36

37 Most Complete Line of Fixed Configuration LAN Products in the Industry PRICE-PERFORMANCE Full Layer 3 Routing Layer 2 Intelligent Services Catalyst 2950 NEW Catalyst 4948 Catalyst 3750 Catalyst 3550 and 3560 Catalyst /100 wire speed switching Fixed uplink and GBIC-based gigabit connectivity Basic through advanced intelligent services Stackable GE and 10/100/1000 configurations Cisco StackWise technology Enterprise-class intelligent Layer 3/4 services Single mgmt interface with auto configuration Power over Ethernet (PoE) configurations 10/100/1000 and GE configurations Enterprise-class intelligent Layer 3/4 services Power over Ethernet (PoE) configurations 10/100/1000 wire speed switching Advanced intelligent services 10/100/1000 wire speed switching Rack-optimized server switching Jumbo frame support Dual, hot swappable, internal power supplies Hot swappable fan tray Catalyst 2940 Low-density, standalone, managed 10/100 switching Small form factor for deployment outside the wiring closet Basic services FUNCTION, FLEXIBILITY, SCALABILITY 37

38 Cisco Catalyst 3750 and 3560 Series Enterprise-class services Wire-speed switching and routing Power over Ethernet support Cisco StackWise Technology (3750 Series only) Fault-tolerant, bidirectional 32-Gbps stack interconnection Automated configuration and management Single network instance (IP, SNMP, CLI, Spanning-Tree Protocol, VLAN) Master/secondary architecture with master failover Cross-Stack EtherChannel, cross-stack QoS Next generation in stackable switching Optimized for Gigabit Ethernet IPv6-capable in hardware Innovative Stacking Sets New Standards for Resiliency and Management 38

39 CATALYST 4500 SERIES CISCO CONFIDENTIAL 39

40 Catalyst 4500 Evolutionary Architecture Backward Compatibility SAME LINE CARDS Extended Lifecycle Layer2 10/100/ GbE SSO Development PoE L2/3/4 40

41 Why Buy a Modular Switch? Innovative Security Stronger Protection Against Security Threats that Can Adversely Affect Business Reliability/Availability Maximize Network Uptime and Ease Serviceability Flexibility and Scalability Broad Range of Options with Headroom for Future Growth Ease of Use Minimize Complexity Resulting in Lower Opex Investment Protection 41

42 INTELLIGENT SECURITY FEATURE CISCO CONFIDENTIAL 42

43 Catalyst Integrated Security NETWORK SECURITY CHALLENGES INTEGRATED SECURITY Internal and External Attacks Denial of Service Attacks Trust and Identity Management Authenticate, Authorize, and Audit Loss of Privacy (Packet Sniffing) Impersonation (Identity Spoofing) SOLUTION Threat Defense Control Network/ Application Access Internal Attack Mitigation Bringing Down the Network Secure Connectivity Protect Traffic Across Untrusted Networks Data Theft 43

44 Why Is Trust and Identity Important? Authorized User Corporate Resources Si Si STOP Si Tailgater/ Unauthorized User What if someone tailgated into the building? What if they connected to the network? What if they had were infected with a virus that could bring down the network? What if they had malicious intent? What if a trusted employee had malicious intent? 44

45 First Line of Defense and Segmentation 802.1x Trust and Identity How It Works: Each person trying to enter the network must receive authorization based on their personal username and password Authorized User X Valid Credentials Finance Network Marketing Network Identity-Based 802.1x Authentication Guest User Invalid/ No Credentials Guest Network Internet 45

46 Self-Defending Networks: Network Admission Control (NAC) NEW Key element of the Cisco Self-Defending Network Initiative Enforces access policy based on endpoint security posture Focused on limiting damage through quarantine and remediation Integration with Symantec, Network Associates, Trend Micro, and IBM Hosts Attempting Network Access Cisco Network Access Device Cisco Policy Server Vendor Application Policy Server Antivirus Client Cisco Security Agent Cisco Trust Agent Security Credential Checking IBM Tivoli Client Security Policy Enforcement Security Policy Creation AV Policy Evaluation 46

47 Layer 2 Attacks Is This Your Weakest Link? APPLICATION PRESENTATION SESSION Security Operations Normally Work with Layer 3 and Higher Protocols Most Are Not Aware of Layer 2 Technology And Terminology 4 TRANSPORT NETWORK DATA LINK PHYSICAL! BUT, The Network Is Only as Strong as the Weakest Link Compromise Layer 2 and Other Layers Can Be Compromised as Well 47

48 Layer 2 Attacks There Are Lots of Tools Out There!!! 48

49 Port Security Protects Against MAC Address Flooding Attacks 00:0e:00:aa:aa:aa 00:0e:00:bb:bb:bb Only 3 MAC Addresses allowed on the port: Shutdown X X Problem: Thief can plug a device onto the wire before the switch port and gain access to the network Solution: Port Security Limits the number of devices that can use that port. Thief can not gain access 10593_01_2005_C_c2 49

50 DHCP Snooping DHCP Snooping Enabled DHCP Request Si DHCP ACK X DHCP Server What It Does: Switch forwards only DHCP requests from trusted access ports, drops all other types of DHCP traffic Allows only designated DHCP ports or uplink ports trusted to relay DHCP Messages DHCP Client Rogue Server (Pretends to Be the DHCP Server) Builds a DHCP binding table containing client IP address, client MAC address, port, VLAN number Benefit: Eliminates rogue devices from behaving as the DHCP server 50

51 Dynamic ARP Inspection IP: MAC: Not by my Binding Table My GW Is I m Your GW: What It Does: Gratuitous ARP to Change End Device MAC to ARP Tables Maintains a binding table containing IP and MAC address associations dynamically populated using DHCP Snooping Benefit: Ensures integrity of user and default gateway information such that traffic cannot be captured CISCO CONFIDENTIAL 51

52 EASE OF MANAGEMENT CISCO CONFIDENTIAL 52

53 Device Management made easy Switch Device Manger Basic monitoring and configuration of the switch. Graphical device management provides real-time views of the configuration and performance conditions for switch. Cisco Network Assistant Cisco Network Assistant is an entry-level network management tool optimized for SMB networks Centralized management of Cisco switches, routers and access points Smartports Preconfigured macros on a per-port basis Ability to create customized macros 53

54 In Closing Connect the Value of the Network to Enabling the Organization Sell Solutions, Not Point-Products Focus on the value of the network, enabling applications, and the benefits of Intelligent Service Focus on reducing complexity Leverage Cisco resources, technology innovation and leadership Complete end-to-end product portfolio Emphasize ease of adding services over time, no need for forklift upgrade 54

55 Q AND A CISCO CONFIDENTIAL 55

56 CISCO CONFIDENTIAL 56