Service Providers trends & F5 Networks SP s portfolio overview

Transcription

1 Service Providers trends & F5 Networks SP s portfolio overview

2 Attacks from Internet Data Growth / IoT Regulations / Services DDoS protection L4-L7 security Traffic shaping Scalability, IPv4/v6 Traffic policing URL filtering Network Consolidation Competition, Profitability Today s ISP trends F5 Networks, Inc 2

3 Loadbalancing LTM Web FW ASM CGNAT IPv4, IPv6 Network FW AFM DNS DNS Traffic policing PEM Cloud scrubbing Silverline Signalling proxy Diameter, SIP, Radius, HTTP, LDAP, What F5 does for SPs? Access Control APM F5 Networks, Inc 3

4 PEM CGNAT DNS Silverine TMOS Full proxy architecture irules Programibility Analytics Statistics, logs,... IPv6 Native support Power HW Community devcentral.f5.com Virtualisation vcmp, VMware, Openstack, and our TREASURES under the surface F5 Networks, Inc 4

5 PEM F5 Networks, Inc 5

6 Context-Aware and Policy-Driven Traffic Steering What is context? SUBSCRIBER APPLICATION RAT TYPE 2G 3G 4G LOCATION DEVICE TYPE CONGESTION How does the steering platform learn about context? PCRF Diameter Gx GGSN/PGW RADIUS 3RD PARTY TOOLS Custom API DATA PLANE PEM/DPI Module F5 Networks, Inc 6

7 Subscriber awareness with PEM OCS AAA Radius PCRF Gy Gx Radius PGW/ GGSN/ BNG RTR Data Internet Data Center Video Optimization Transparent Caching Parental Controls WAP Gateway F5 Networks, Inc 7

8 PEM for Fixed Line / WiFi Policies and Subscribers Detection and identification using DHCP DHCP AAA Syslog Subscriber identity extracted from DHCP Option 82 (IPv4) / Option 37 (IPv6) Support of DHCP snooping / DHCP relay DHCP, Radius Fixed Broadband BRAS /BNG RTR BIG-IP PEM Internet Detection and Authentication using Radius PEM as Radius client initiates Access- Request for particular subscriber Radius Accounting for the reporting F5 Networks, Inc 8

9 Policy Action: Traffic Steering and Service Chaining Use Case: Ability to steer traffic through different value added services and network elements Intelligent traffic steering to VAS servers Service Provider VAS Video Optimization Parental Control Control Plane PCRF AAA Leverage subscriber/application awareness for steering Steering on Response Analyze response and apply steering policy for flow/ transaction Emma John Subscriber http http (3G) GGSN PGW BNG Radius Paul User Service Policy John Paul Video Optimization LTE bypass Parental Control No Video Optimization Always Parental Control Yes Radius Diameter Gx Other API In ternet Customer Benefit: A fixed or mobile solution for optimizing subscriber and application traffic through VAS and network elements based on subscriber profile F5 Networks, Inc 9

10 Bandwidth and QoE management PER-SUBSCRIBER BANDWIDTH CONTROL Gold Subscriber (20 Mbps) Silver Subscriber (10 Mbps) Bronze Subscriber (5 Mbps) PCRF PGW/GGSN VIPRION PER-SUBSCRIBER PER APPLICATION BANDWIDTH CONTROL Gold Subscr total (20 Mbps) Even if subscriber is entitled for more by subscriber bandwidth policy his P2P traffic gets reduced to configured value (512kbps) Gold Subscr p2p (512 kbps) App p2p total (500 Mbps) PGW/GGSN VIPRION

11 URL Categorization for filtering & parental control URL Filtering Custom [irule] Built-in Webroot DB (20M most popular) Cloud-based Webroot (400M) DB lookup Custom DB (few M) SNI based URL categorization for HTTPs 1. Trying to access blocked URL PGW/ GGSN RTR 3. Access Denied 2. Integrated Webroot URL Filtering / Blacklist Internet F5 Networks, Inc 11

12 Application Classification : DPI engine OTT MONETIZATION & FLEXIBLE CHARGING PCRF Analytics Gold Subscr total (acct only) OTT Service (acct + DSCP mark) Gx Syslog/IPFIX PGW/GGSN RADIUS Accounting (Subscriber discovery) VIPRION SPECIALIZED SERVICE (MNO BRAND) Subscription models / bundles for OTT or specialized service Bundled into subscription for a lower fee OTT traffic excluded from volume bundle OTT traffic marked/tagged for differential treatment at radio layer

13 Classification: Encrypted traffic handling HTTPS/SSL SNI /Common name based classification Support for behavioral classification Pattern based matching, signature creation SSL certificate lookup (domain string lookup inside SSL) SSL flow bundling ability to correlate parent/child SSL flows for an application/protocol partial SSL handshake scenario where parent flow certificate is not transmitted to child SSL Non-HTTPS (Skype, BitTorrent, ) Support for pattern based signatures along with behavioral capabilities For example, Skype - source IP/port, supernodes etc. F5 Networks, Inc 13

14 Content Insertion CONTENT INJECTION / AD INSERTION 1. Content being sent back to subscriber; data maxed out 3. Subscriber realizes they have maxed out data BNG/BRAS 2. Javascript insertion about quota max Internet HTTP header enrichment for subscriber identification Content insertion (javascript) into HTTP payload to enable In-browser notifications Toolbar insertion Ad insertion F5 Networks, Inc 14

15 HTTP Header Enrichment 1. Subscriber sends HTTP request GGSN/PGW BNG/BRAS 2. BIGIP intercepts HTTP request and adds custom header based on pre-configured policy Internet HTTP Full-Proxy mode allows for Header insertion both in request and response Custom header name completely configurable Clear-text and hashed/encrypted header content Conditions to decide when to insert header fully configurable, example Based on destination IP address, URI, (list of destinations) Based on user-id (under PCRF control) F5 Networks, Inc 15

16 Classification: Mobile device and Tethering detection Reports Device-Type & OS for each subscribers Identifies the type of Mobile device connected to the network. Uses the Mobile device s (unique) Type Allocation Code (TAC) retrieved from RADIUS Acct START The Service Provider can use it s own database provisioned on Big-IP platform Determined by parsing the UA string Determined by TCP Fingerprinting Tethering Ability to detect tethering based on TTL today In next release Ability to detect tethering based on enhanced algorithms like TCP fingerprints, UA, #Connections, BW etc. F5 Networks, Inc 16

17 Charging/Quota Management Quota Management / Pre-paid charging use cases per Sub / App Gy AVPs / Volume and time based quotas / quota replenishment / quota breach License based Gx / Gy Policy and Subscriber Management OCS PCRF AAA/HSS PGW/ GGSN RTR BIG-IP PEM Internet F5 Networks, Inc 17

18 F5 Approach to reporting/analytics/logging F5 provide on Box reporting to show local analytics Approach to external analytics is to provide the information to external 3 rd parties vendors implementing this function F5 data export can be done leveraging on different protocols F5 has partnership with several vendors for analytics SYSLOG IPFIX RADIUS GX PGW/ GGSN RTR BIG-IP PEM Internet F5 Networks, Inc 18

19 PEM Wide range of use cases Per-subscriber Application & URL Bandwidth Control & Filtering TCP-friendly rate limiter Separate up/down rates Highly scalable solution TCP Optimization as a bonus Subscriber Application Analytics Subscriber ID / Rate Plan Charging rules Application Usage Reporting Intelligent Traffic Steering & Service Chaining to VAS Steer traffic based on subscriber profile to Value Added Services & Optimization Services Intelligent Service Chaining Online Charging (Gy) Flexible rating group definitions based on applications and/or URI Redirect or block upon quota expiration URL Filtering & Parental Control Government lists Per-subscriber parental control opt-in/opt-out service For HTTP & HTTPS OTT Identification & Monetization Per-subscriber OTT application detection Per-OTT bandwidth, marking and charging rules Header Enrichment & WAP offload HTTP HE for content-based charging WAP GW bypass/offload and replacement Content Injection / Toolbars Java-script based content injection Targeted advertisements Lightweight BRAS/BNG DHCP-based BNG model for wifi and wireline deployments Radius AAA client F5 Networks, Inc 19

20 Case study Tier1 operátor v Polsku Rodičovská Kontrola PEM Mobile Client Access Network ICAP calls Gx INTERNET Scenár nasadenia - Rodičovská kontrola ako platená služba - Riešenie tiež pre business zákazníkov - Whitelisting on-line bankingov - Load balancing ICAP serverov Symantec DB PCRF RIEŠENIE F5 - PEM s integráciou Gx do Optenet PCRF - Reportovanie vadných URL pomocou ICAP - irules pre detekciu SNI z SSL prevádzky

21 Case study Poskytovateľ DSL a VoIP služieb LTM & PEM & AFM Mobile Client Access Network INTERNET - Scenár nasadenia - SIP Load balancer / proxy - Inteligentný traffic shaping - Carrier-grade Firewall SIP 1 SIP 2 PRÍNOSY - Úspora US$150,000 na CAPEX (konkurenčné riešenie US$250,000) - Úspory na OPEX - konsolidácia (správa, trénink)

22 DNS AFM CONS CGNAT Consolidate with F5 Networks, Inc 22

23 Consolidating SP s security BEFORE F5 Firewall Network DDoS Application DDoS Web Access Management Load Balancer DNS Security Load Balancer & SSL Web Application Firewall WITH F5 Consolidation of firewall, application security, and traffic management Protection for networks and applications Fewer devices translates to lower latency for subscribers

24 Consolidating SP s security BEFORE F5 Firewall Network DDoS Application DDoS Web Access Management Load Balancer DNS Security Load Balancer & SSL Web Application Firewall WITH F5 Consolidation of firewall, application security, and traffic management Protection for networks and applications Fewer devices translates to lower latency for subscribers

25 Consolidating SP s service functions BEFORE F5 PGW/ GGSN DPI, Parental Control, CG-NAT Firewall WITH F5 Consolidation of security, address, and traffic management Protection for mobility and core infrastructure with user awareness High scale for the demands of 4G and IPv6 deployments

26 Consolidating SP s service functions BEFORE F5 PGW/ GGSN DPI CG-NAT Firewall WITH F5 PGW/ GGSN Consolidation of security, address, and traffic management Protection for mobility and core infrastructure with user awareness High scale for the demands of 4G and IPv6 deployments

27