SENETAS CN8000 MULTI-LINK 10x10 GBPS ENCRYPTOR FREQUENTLY ASKED QUESTIONS

Transcription

1 SENETAS CN8000 MULTI-LINK 10x10 GBPS ENCRYPTOR FREQUENTLY ASKED QUESTIONS

2 The CN8000 provides multi-port / multi-link, high-density modularity and flexible multi-tenancy capabilities. The equivalent of 10 x 10Gbps encryptors in a single 4u chassis the CN8000 provides up to 100gbps total encrypted bandwidth. But, the CN8000 should not be confused with a 100Gbps encryptor. The CN8000 is also powered by Quantum Random Number Generation for enhanced physical number generation security. The CN8000 is the outcome of years of technology partnering and R&D between Senetas and Swiss Quantum encryption company, ID Quantique (IDQ). > Data centre hubs (data centre interconnect ) within high-density environments e.g. data centre service providers > Large multi-department enterprise environments requiring multi-port, multitenancy, minimum space and flexible operation/configuration; such as hubs at the centre of WANs e.g. major transactions enterprises > Very large scale data networks environments requiring high-density multi-port and multi-tenancy efficiencies e.g. Cloud services and major enterprises. The CN8000 target audience and target market includes the following based on its newly introduced ten port times 10Gbps encryption capability, with the flexibility of genuine secure multi-tenancy operation: CN8000 Frequently Asked Questions

3 FREQUENTLY ASKED QUESTIONS FAQS 1. What is the primary use and environment for the CN8000? High-density sites such as data centre hubs, requiring port density and minimum rack space usage. A key customer criterion is the number of encrypted links for business critical applications. The environment requires multi-port (modularity) and operational efficiencies in additional to best-of-breed data encryption. Other examples are very large scale encryption data network architectures requiring features such as: multi-port efficiencies and separation of duties ; and multi-tenancy capabilities. 2. How does encryption of a total bandwidth of up to 100Gbps differ from a 100Gbps encryptor? Each pair of encryptor ports is independent an individual encryptor with bandwidth speeds of 1Gbps to 10Gbps. The CN8000 is like 10 x 10 Gbps encryptors in one 4u box. There is no aggregation of bandwidth within the CN8000 (back plane). Traffic cannot pass from one encryption card to another. 3. Can the CN800 be configured to provide the capabilities of a 100Gbps encryptor? No. Refer to question Does the multi-link / multi-port CN800 offer multi-tenancy? Yes. Multi-tenancy is a core design feature of the CN8000. This makes the CN8000 an ideal encryption solution in very high-density applications such as Cloud services and data centre hubs. Each port may be assigned to an individual tenant. In multi-tenancy configuration the CN8000 maintains total separation of traffic whether all tenants are within the same customer organisation or completely separate entities. 5. How does the multi-tenancy feature handle the allocation of cards for separate duties / tenants? Each port s card acts as its own independent encryptor. Each offers per card role based access control and configuration. 6. Are the port cards hot-pluggable? Does the CN800 provide multi-tenancy redundancy? No, the cards are not hot-swappable. However, multi-tenancy redundancy is enabled. To enable redundancy in multi-tenancy use, we recommend pre-loading cards in spare ports to provide redundancy to meet tenants redundancy requirements. The CN8000 is designed to enable switch-over to a redundant pre-loaded port should a tenant s port fail. 7. Are the CN8000 ports restricted to 1Gbps and 10Gbps bandwidths? No. An important feature of the CN8000 is its rate-limiting flexibility. Each port may be rate-limited. For example a customer may purchase a 10Gbps port/card and elect to rate-limit that port to 5Gbps. This feature also enables configuration of rate-limited redundant ports where business critical uses require one or more redundant ports. 8. How does the CN8000 s redundancy feature work? Because Senetas built-in design flexibility enables mixed bandwidth speeds among ports, customers simply purchases licences for what they require now and only operate them at the lower bandwidth speed rate-limited. This licence flexibility enables the customer to pay only for what bandwidth it needs and uses now and upgrade its licence/s later if necessary. This feature also enables flexible port redundancy arrangements when required. CN8000 Frequently Asked Questions

4 9. Must all CN8000 ports operate at the same bandwidth / speed 1Gbps or 10Gbps? No. Senetas built in flexibility enables mixed bandwidth speed requirements. Each port may operate at different bandwidth speeds. This also applies to ports that are rate-limited. Keep in mind that the CN8000 is like 10 x 10 Gbps encryptors in one 4u box. 10. What interfaces are supported by the CN8000? Currently the CN8000 supports: 1Gbps to 10Gbps Ethernet. And it supports rate limiting flexibility. Soon the CN8000 will also support Fibre Channel: a) 1/2/4GFC; and, b) 8GFC. 11. What is the difference between SFP and SFP+ interfaces? SFP supports up to 1Gbps Ethernet and 4GFC Fiber Channel. SFC+ supports all Ethernet speeds and all protocols, including up to 10GFC Fibre Channel. 12. Does the CN8000 support copper interfaces? Yes. Copper SFC. 13. What is Quantum Random Number Generation? Base on Quantum mechanics, Quantum Random Number generation (QRN) is, simply put, built into the CN8000 hardware to generate random cryptographic keys. Using a Quantum mechanics based generator (rather than other physical generators), the CN8000 maximises the true randomness of the numbers generated. 14. What is the CN8000 s maximum power consumption when running all 10 X 10Gbps encryption cards simultaneously? 300w. The CN8000 provides efficiencies when compared to 10 x 10Gbps individual encryptors in addition to a 60% space saving. 15. Is the CN8000 managed by the same Senetas CM7 software as with all other CN series encryptors? Yes. Senetas CM7 functionality is identical in all CN series encryptors. 16. Does the CN8000 have the same interoperability with all other Senetas CN series encryptors - e.g. the CN6000 and CN4000 series encryptors? Yes. Interoperability is totally consistent throughout all CN series encryptors. Interoperability is a core Senetas design feature. 17. What, if any, power supply redundancy is provided in the CN8000? Is it hotswappable? Yes. Dual power supply redundancy is provided. This feature is on-site user-replaceable, hot-swappable AC power supply ( pull and swap power supply unit). 18. Are the CN8000 cooling fans hot-swappable? Yes. Dual fan unit redundancy is provided in the CN8000. This feature is on-site user-replaceable and hot-swappable. 19. What certifications does the CN8000 hold? FIPS (140-2 Level 3) and Common Criteria (EAL2+) are pending in progress (at time of publication). They are scheduled for certification in Q What rack space does the CN8000 use? 4U rack space. This represents a significant 60% rack space saving compared to compact 10 x 10Gbps slim-line encryptors. CN8000 Frequently Asked Questionss

5 21. Does the CN8000 operate with the same / similar set-and-forget simplicity as the other Senetas CN series encryptors? Yes. Of course there are additional configuration requirements to single port CN series encryptors, but once configured, the CN8000 installation is set and forget like all CN series encryptors. 22. Does the CN8000 hardware provide a management interface? Yes. The CN8000 has a built in LCD front screen tailored to CN8000 s modularity features, for the usual operational status and alarms. 23. Is the CN8000 tamper proof like the other Senetas CN encryptors? Yes. Like the other Senetas CN series encryptors, the CN8000 is built to tamper proof requirements of FIPS Level 3 requirements. IMPORTANT NOTES - DATA PLANE AND CARDS 1. CN8000 data plane does not enable aggregation of two or more ports / cards data encryption: There is no data plane between the ports / cards on the CN8000 s back plane There is no data traffic between or among any of the ports / cards. 2. CN8000 PCIe card (FPGA based interface cards) may be changed on-site: The cards are on-site upgradable / changeable, BUT only by Senetas accredited technicians. The cards in each port are NOT hot-pluggable for upgrade / change (add or remove) actions. To add or remove cards while the CN8000 is on and operating will destroy the card and likely damage the whole encryptor. 3. CN8000 port/card redundancy is achieved by pre-loading unused ports, which will then be available as redundant ports should circumstances require. 4. Senetas recommends the pre-loading of at least one unallocated port to enable redundancy convenience. The card may be rate limited while in a redundant state. 5. KEYWORD SEARCHING: Highlighted in bold. SENETAS CORPORATION LIMITED ABN info@senetas.com CN8000 Frequently Asked Questionss