場次 : C3. 公司名稱 : Radware. 主題 : ADC & Security for SDDC. 主講人 : Sam Lin ( 職稱 ) 總經理

Transcription

1 場次 : C3 公司名稱 : Radware 主題 : ADC & Security for SDDC 主講人 : Sam Lin ( 職稱 ) 總經理

2 L4-L7 ADC (appliance or NFV) and Security service (appliance or NFV ) for (Software Define) Data Center Sam Lin Radware Taiwan

3 SDDC definition Slide 3

4 Data Center Use Case: 1 傳統 server App FW/IPS Alteon ADC Web Alteon ADC -IPS -SLB -GSLB -Caching -SSL DB Slide 4

5 Data Center Use Case: 2 virtual server App FW/IPS Alteon-NG ADC Web Alteon ADC +DDoS +APM +FastView +WAF +SSO DB Slide 5

6 Data Center Use Case: 3virtual network on NFV App Alteon ADC -NFV Web Alteon ADC -NFV NGFW/IPS -NFV DB Slide 6

7 Software Define Data Center use case 4 App Alteon ADC -NFV Web Alteon ADC -NFV NGFW/IPS -NFV Cloud Orchestrator SDN Controller DB Slide 7

8 Alteon-NFV & DefensePro-NFV for Cloud in a Rack Slide 8

9 Radware 2014 Alteon features: 1. SLB 2. SSL 3. Cache 4. APM 5. FastView 6. AS++ 7. VX Hypervisor 8. vdirect 9. Cloud Signaling 10. DDoS 11. BWM 12. WAF 13. SSO 14. GSLB DefensePro 200M-40G #1 DDoS +IPS) LinkProof 100M-16G (#1 線路平衡 ) Alteon 100M-80G (#1Vision L7 Controller) (for Cloud Controller:) (for SDN Controller:) 9

10 Alteon NG ADC for Private/Public Cloud Gartner ADC 2014 Slide 10

11 Alteon Platform Line-Up- Number 1 vision ADC virtualization - for any size data center! Alteon (160)Gbps 1-88 vadcs Alteon Gbps 1-24 vadcs Slide 11

12 Alteon VX - Isolated Resource Customer Managed Customer Monitor Only Provider Managed Global SLB, Security, ITM On Demand Global SLB Services On Demand ITM Services On Demand Security Services Fully featured ADC Health Checks, Layer 7 Configurations, etc. Layer SharePoint 4-7 Services Layer Oracle 4-7 Services Marketing Layer 4-7 Services Applications Vlans, ARP Tables, Virtual Routing and Forwarding Tables IP Network Domain 1 IP Network Domain 2 IP Network Domain 3 Physical Resources (CPU, Memory, SSL) Private: config file Infrastructure 1Gbps logging statistics Private: config file Infrastructure 2Gbps logging statistics Private: config file Infrastructure 2Gbps logging statistics Slide 12

13 Alteon 5208 九大優勢 ADC 市場中最極緻的 Layer 4-7 效能 Default 5G( 可擴充到 10G,20G)throughput ---Alteon 最完整! ADC 市場中,2 個 10G ports 加 6 個 1G ports 及效能 Layer 4 CPS 700K --- 最強大! Default vadc 2 個 ( 可擴充到 24 個 ), 完整獨立且不相互干擾 --- 最特別! 內含 SSL, cache 加速, STP,RIP,BGP,DDoS 防護 含 TCL 語言功能延伸 HTML 加速及網路速度監控功能一年授權 --- 最新穎! 可擴加 WAF 及動態結合中華電信 DDoS 外線防護功能 - 可與雲端控控器整合 --- 最完善! Slide 13

14 NFV-SDN-Cloud Architecture Slide 14

15 ETSI certified NFV Slide 15

16 Proactive SLA Management Breakdown by application, location or specific transaction Monitor application s SLA and user transaction response time Track real user transactions that breach SLAs Real time error detection - tracking proper transaction completion Slide 16

17 FastView Under the Hood Render page for specific browser Transform resources Transform HTML Create acceleration template Slide 17

18 FastView : Page Performance F5 s site more than twice as fast with Radware s FastView More than twice as fast with Radware FastView Slide 18

19 Advanced Data Center 動態配置系統資源 Step #3 當超過管理設定的門檻數值時, vdirect 通知 vcenter 新增 VM, 並自動通知伺服器負載平衡器更改設定 VMware vcenter Orchestrator Data Center Step #2 vcenter Orchestrator 隨時監控應用程式伺服器的 CPU 負載情形. 連線者數量及連線回應時間 Internet Firewall Radware ADC Database Servers Step #1 使用者連線應用程式 Step #4 伺服器負載平衡器便可將流量導引至新增的 VM Step #5 當使用者人數開始減少, 並需等到 Guest OS client 連線最後一筆 session 正常 close 後, vdirect 通知 vcenter 並將會自動回收 WEB/AP 之 Guest OS 及退出 SLB Pool Slide 19

20 Elasticity & Cloud Burst GSLB Data Center A Scale-out To public cloud Data Center B PUBLIC CLOUD vdirect ADC Workflow State Sync Elastically Scale-out On-Prem Applications Slide 20

21 Web Security Complete Web Application Protection Full coverage of OWASP Top-10 by negative & positive security models Protection against dozens of attack vectors listed on WASC Threat Classification Efficient, accurate and difficult to evade out-of-the-box negative security Terminating TCP connections Normalizing client encoded traffic Blocking various evasion technics Slide 21

22 Reservations.com Adaptive Auto Policy Generation (1 of 4) App Mapping /config/ /admin/ /register/ /hotels/ /info/ /reserve/ Slide 22

23 Adaptive Auto Policy Generation (2 of 4) App Mapping Threat Analysis Reservations.com /config/ /admin/ Risk analysis per application-path SQL Injection Spoof identity, steal user information, data tampering /register/ CCN breach Information leakage /hotels/ /info/ Directory Traversal Gain root access control /reserve/ Buffer Overflow Unexpected application behavior, system crash, full system compromise Slide 23

24 Adaptive Auto Policy Generation (3 of 4) App Mapping Threat Analysis Policy Generation Reservations.com /config/ /admin/ SQL Injection Prevent access to sensitive app sections /hotels/ /register/ /info/ CCN breach Directory Traversal ***********945 9 Mask CCN, SSN, etc. in responses. Traffic normalization & HTTP RFC validation /reserve/ Buffer Overflow P Parameters inspection Slide 24

25 Adaptive Auto Policy Generation (4 of 4) Reservations.com App Mapping Threat Analysis Policy Generation Policy Activation Virtually zero false positive Time to protect /config/ /hotels/ /admin/ /register/ SQL Injection CCN breach ***********945 9 Optimize rules for best accuracy /info/ /reserve/ Directory Traversal Buffer Overflow P Add tailored application rules

26 The Reporting Dashboard Slide 26

27 PCI Compliance Summary Report Compliance Status Analysis Info PCI Requirement Action Plan Slide 27

28 WAF service in Carrier 28

29 Attackers Deploy Multi-vulnerability Attack Campaigns SSL Floods Syn Floods HTTP Floods App Misuse Network Scan Intrusions High Bandwidth or PPS Network flood attacks Low & Slow DoS attacks More than 50% of 2013 (e.g.sockstress) campaigns had more than 5 attack vectors. Brute Force SQL Injection Internet Pipe Firewall IPS/IDS ADC Attacked Server SQL Server Volumetric attacks Stateful attacks Application attacks Cross Site Scripting Slide 29

30 DefensePro Platform Line-Up Number 1 in Carrier DPx412 10Gx4+1Gx8+1GSPFx4 4/8/12 Gbps DPx420 40Gx4+10GSPFx40 10/20/30/40 Gbps DP x06 1GSPFx2+1Gx4 100/200/500M/1/2 Gbps Slide 30 * Scheduled for mid 2014

31 DefensePro NG IPS for Private/Public Cloud Slide 31

32 Alteon ADC: DoS Signaling to Local AMS Traffic parameters: Bandwidth PPS, CPS, CEC Total & per service ADC health parameters: CPU utilization Tables capacity utilization Inclusive SSL-based attack mitigation Integrated WAF module AMS mitigates attack DefensePro Firewall Alteon NG Protected online services Alteon Signals to AMS Protected Organization Slide 32

33 ERT and the customer decide to divert the traffic Volumetric DDoS attack that saturates Internet pipe DefensePipe mitigates volumetric attack DoS Signaling to the Cloud Inclusive SSL-based attack mitigation Integrated WAF module Internet pipe is cleaned Pipe is saturated DefensePro Firewall Alteon NG Protected online services Alteon signals to AMS Protected Organization Slide 33

34 CHT MSSP service Slide 34

35 ElasticScale The SDN application that programs the network for scalable L4-L7 application delivery services

36 Elastic Scale SDN Application NBAPI & Orchestration Plug-ins Application Network Anti- Application Distributed ElasticScale Anti-DoS DoS App Mitigation Application Anti-DoS Anti-DoS App App App App Virtualization Manager L4-L7 Drivers Abstraction layer SDN Drivers Application1 IBM Unified SDN Controller Alteon VA Alteon Appliance Application

37 DefenseFlow DDoS The SDN application that transforms the network into a secure monitoring & attack mitigation network

38 Program Network Anti-DoS service provisioning Collect network stats Programmable Probes Analyze & Decide Detection Control Flow diversion and Mitigation Tune the security policy Edge flow counters NBAPI Network DDoS Attack detected!!! Network Application Anti- Application Application Anti-DoS App App Anti-DoS App Application Anti-DoS App Anti-DoS App Adaptive Network Anomaly Attack Area Decision Surface L4-L7 Drivers Abstraction layer Attack Area SDN Drivers IBM Unified SDN Controller Suspicious Area Normal Adapted Area Local flow counters vswitch Traffic parameters Traffic parameters vswitch DefensePro Attack Mitigation Scrubbing Center

39 DefenseFlow Anti-DoS App Attack detected!!! Rest API SDN Controller Tune the security policy and baselines Protected Link Scrubbing Center DefensePro SDN DefenseFlow Network sends back stats We want to Application DefenseFlow instructs protect SDN this to Attack instructs App which tunes Starts! the the DefenseFlow SDN link to send our servers. divert attack traffic to scrubbing Scrubbing Center center back App Monitors statistics Protected Objects Slide 39