Huawei Agile Controller. Agile Controller

Transcription

1 Huawei 1

2 1 Product Overview Product Features is the latest user-centric and application-based, automatic network resource control system developed by Huawei. This system is positioned as the "Smart Brain" of a Agile network. Inspired by the idea of centralization in Software-Defined Networking (SDN), the dynamically adjusts network and security resources across the entire Agile, enabling networks to be more agile for services. Policy delivery Service flow WAN/Internet Policy execution point HQ access: R&D, sales, and visitor Redefines Networks By Concentrating on Service and Experience Shifting the focus from technologies, devices, and connectivity to users, services, and experiences, the provides a 5W1H-based policy matrix featuring scenario awareness, implementing a consistent experience over the entire network. A user can enjoy the same experience on the Agile network anywhere; regardless of access location, or terminal device. Data Center , ERP, and codes Branch access: R&D, sales, and visitor WAN/Internet Internet: R&D and sales Big Data Analytics-based Full-Scale Security Collaboration Shifting from single-point security protection to full-scale security collaboration over the entire network and leveraging Big Data analytics, the detects security threats taking a holistic perspective of the entire network in order to assist users in quickly identify network risks, and proactively implements defense solutions.

3 Centralized Control and Flexible Adjustment of Resources of the Entire Network Shifting from static and manual network configuration to dynamic and automatic network deployment, the Agile Controller controls resources on the entire network in a centralized manner and can flexibly adjust network resources based on services. For example, the Agile controller can establish a temporary group, guarantee a high-quality experience for VIP users, identify high-risk assets, and deploy stricter security policies. Core Functionalities Product Openness The connects to existing devices and service systems through multiple interface modes such as Web Service API, SQL, and Syslog, implementing system integration while improving new service provisioning efficiency and overall network operation and maintenance (O&M) Provides a unified policy engine and executes unified access policy across an entire organization, implementing authentication and authorization based on users, access time, access locations, device types, device resources, and access modes (5W1H). Provides full-life-cycle guest management, supports a personalized Portal login interfaces, pushes personalized webpages based on terminal IP address range and location, improving the enterprises' brand presence and reducing the IT O&M pressure. Provides rights planning modes for the policy matrix and implements automatic deployment and state monitoring on the network based on 5W1H policy control, ensuring consistent policies and allowing users to enjoy a consistent service experience with the freedom to move as they please. Provides user group-based QoS policy planning. When network resources are limited, VIP user experience is guaranteed as their data is preferentially forwarded. Provides service orchestration capabilities, virtualizes security devices into a security resource center, and diverts user traffic to the security resource center for processing, improving security resource efficiency and enhancing the security protection capabilities of the entire network. 2

4 Leverages Big Data analytics, collects and performs an association analysis on security events from across the entire network, displays the security states of the entire network, provides a security association function, aids users in quickly identifying network risks, and proactively executing security and defense solutions. 3 Operating Environment Configuration Requirement Networking Service Management Server (SM & SC) Security Collaboration Server (SV & iradar) CPU 2 x hexa-core 2 GHz 2 x hexa-core 2 GHz Memory 16 GB 32 GB to 64 GB Storage 600 GB 4 T or more Note: The service management servers (SM & SC) are used to run access control, guest management, ubiquitous service, and service orchestration functions while the security collaboration servers (SV & iradar) are used to run the security collaboration function. The has no special networking requirements. It works properly as long as the physical server on which it runs is reachable. The is usually deployed in the data center zone. AR Branch network Agile core Agile aggregation Converged access L2 SW Campus egress AR LSW Branch network WAN/Internet NGFW/SVN AP L2 SW LSW LSW AP LSW Internet access Data Center Server NMS

5 List of Specifications Function User authentication Policy engine Network Admission Control (NAC) Guest access management Smart terminal identification Ubiquitous service Specifications Based on the system's built-in account authentication Microsoft Windows Active Directory (AD) authentication Third-party LDAP association authentication Mobile certificate authentication Anonymous authentication: Administrators can open anonymous authentication in specified network zones. If terminal users select the anonymous authentication mode, they do not need to enter a password. Supports rule-based, multi-dimensional authentication policies; supports authorization of different policies based on different department identities, device types, access time, and access modes. Pushes different web authentication pages to accommodate different conditions (including terminal access locations, device types, and wireless access SSIDs). Compliance check: Includes security evaluation and system configuration. Limits access to protected resources for terminals that do not meet compliance requirements. Automatically isolates terminals that do not meet compliance requirements. Troubleshoots terminal faults in a one-click manner. Authorizes access range based on users and prohibits unauthorized access. Guest account creation and self-registration Guest account notification (through webs, s, or SMS messages) APIs for guest account addition, deletion, and modification User-defined registration and authentication pages. Supports PCs, smart terminals (mobile phones and tablet PCs), IP phones, and network printers. Supports a variety of operating systems (OSs) including Windows, Linux, MAC OS, Android, ios, and Windows Phone. Supports device identification in multiple modes (SNMP, User-Agent, DHCP, and MAC OUI). Unified policy configuration and management Inter-user group policy elements and authorization rule configuration Matrix policy template configuration Deploys a user group policy matrix on the entire network. Automatically deploys policies for newly added devices. Monitors policy states on the entire network. Guarantees a high-quality access experience for VIP users. 4

6 List of Specifications 5 Function Service orchestration Security collaboration Operable and maintainable report System management Networking mode Specifications Service orchestration resource management Service flow definition Service chain orchestration Service chain state monitoring Collects security logs and supports Huawei and third-party standard interfaces, including Syslog, SNMP, FTP/SFTP, OPSEC, and ODBC interfaces. Association analysis of security events: Presets association policies in the system and supports the user-defined function of association analysis rules. Security event association: Notifies administrators of new security events by sending alarms through s or SMS messages. Security state display: Includes security states on the entire network, Top N highly risky assets, and security threat degree on the entire network. Presets commonly used report templates and trend reports, for example, a sign-in activity report. Supports user-defined reports or obtaining reports from the security resource center. System running state monitoring: If the server fails, the system will send server alarms through various means including dialog box pop ups . Diagnoses client faults online and handles client faults in a centralized manner. Remote data backup Centralized networking: applicable to networking environments where the number of terminals is relatively small with clearly defined network layers. Distributed networking: applicable to networking environments where multiple branches exist or the number of terminals is fairly large

7 Ordering Information Description Quantity Remarks 1.1 Software 's access control feature 1 Optional. Provides the user access control function. License based on the number of 's access control terminals 's guest management feature 1 License based on the number of 's guest management accounts 's ubiquitous service feature 1 's service orchestration feature 1 's security collaboration feature 1 License based on the number of 's security collaboration events Stair-based Stair-based Stair-based Divided into multiple stairs: 200, 500, 1000, 2000, 5000, 10,000, and 50,000. Optional. Provides the full-life-cycle guest management function. Divided into multiple stairs: 200, 500, 1000, 2000, 5000, 10,000, and 50,000. Optional. Provides the user group-based policy matrix and QoS policy deployment function. 1.2 Centralized hardware deployment (number of users 10,000; number of logs 2500 EPS) Optional. Provides the function of diverting user traffic to the security resource center for processing. Optional. Provides the functions of security event collection, association analysis, and security state display on the entire network. Divided into multiple stairs: 500 events per second (EPS), 1000 EPS, 2500 EPS, and 5000 EPS. Service management (SM&SC) all-in-one device 1 Optional (number of users 10,000) Security collaboration (SV&iRadar) all-in-one device 1 Optional (number of logs 2500 EPS) 1.3 Distributed hardware deployment (number of users > 10,000; number of logs > 2500 EPS) SM server SC server Database server SV server iradar server iradar-ca server iradar-cm server S2600T disk array More Information Unlimited Unlimited Service manager, which manages each SC, sends realtime instructions to connected nodes, and completes various services Service controller, which completes user authentication, security policy delivery, and data reporting Database servers can be independently deployed for redundancy backup. Security View manages security states, displays the association analysis results of iradar, and evaluates the security state of the entire network. Log collection and association analysis server When the number of association rules on the iradar server is greater than 15, it is recommended to configure one association analyzer. When the number of branch nodes is less than 2000, an iradar-cm log collector can be deployed. When the number of EPS is greater than 2000, it is recommended to deploy an iradar server. External disk array, which is configured when the SV and iradar select High Availability (HA) redundancy backup. 6 For more information about Huawei, please visit:

8 Copyright Huawei Technologies Co., Ltd All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. Trademark Notice, HUAWEI, and are trademarks or registered trademarks of Huawei Technologies Co., Ltd. Other trademarks, product, service and company names mentioned are the property of their respective owners. General Disclaimer The information in this document may contain predictive statements including, without limitation, statements regarding the future financial and operating results, future product portfolio, new technology, etc. There are a number of factors that could cause actual results and developments to differ materially from those expressed or implied in the predictive statements. Therefore, such information is provided for reference purpose only and constitutes neither an offer nor an acceptance. Huawei may change the information at any time without notice.