Defence, Intelligence and Secure Communications Solutions

Transcription

1

2 Defence, Intelligence and Secure Communications Solutions Ensuring mission critical application performance Allot XXXXXXXXX Date Copyright 2013 Allot Communications Ltd. All rights reserved. Allot Communications, its logo and certain names, product and service names referenced herein may be registered trademarks, trademarks, trade names or service marks of Allot Communications Ltd. in certain jurisdictions. All other names are or may be the trademarks of their respective owners. The content herein is subject to change without further notice. The material contained herein is proprietary, privileged, and confidential and owned by Allot or its third party licensors. This information herein is provided to the person or entity to which it is addressed, for its own use only and evaluation of this document, therefore no disclosure of the content of this document will be made to third parties, including without limitation Allot s competitors, without the express written permission of Allot Communications Ltd

3 Table of Contents Executive Summary... 3 Motivation... 3 Network Performance Challenges... 4 Network Security... 4 Allot Secure Mission Critical Solutions... 4 Network Visibility... 4 Dynamic Policy Enforcement... 6 Additional Solutions and Features... 6 Benefits... 7 Solution Components... 7 Deployment... 8 Summary

4 Executive Summary Today s hyper-connected, globally dispersed organisations require fast and highly reliable network connectivity for accessing mission-critical and a wide array of other applications. Fast and constant access to information, as well as the ability to seamlessly share that information with others, within and outside of the organisation, has become a major enabler of communication sharing success today. Allot enterprise solutions deliver complete, real-time network visibility and policy enforcement in order to prioritize the performance of mission-critical applications over other network traffic in accordance with the organisation s goals and priorities. Fully incorporated with an advanced security solution for maintaining server and network integrity, Allot s solutions enable organisations to streamline their operations, to ensure the reliability and availability of network and communication systems, to meet business, product or service delivery commitments on time. The reliability of communication paths within Defence, Intelligence and Secure Communications environments is paramount, and Allot solutions enable optimization and prioritization of this traffic in the context of the environment it operates within. Traditional network infrastructure elements may have levels of control for traffic management integral to their main purpose of routing or switching traffic. Allot solutions provides a more sophisticated level of control and ease of management that surpasses the capabilities of these traditional infrastructure devices to a much higher level of granularity. Deep Packet Inspection (DPI) embedded in Allot s industry leading technologies provides more accurate identification and classification of IP based traffic, allowing a much finer policy across the network. Coarse control offered by traditional infrastructure devices rely on correct marking of traffic or coarse policy to prioritise traffic and are less dynamic with their reaction to changing conditions on the network. Motivation Today s secure communications networks must handle an increasing number of applications and multiple methods of delivery, while serving thousands of users across regionally or even globally dispersed organisations. The ability to ensure reliable application performance, to improve end-user productivity, and to enhance the connected experience by reducing packet drops for traffic that matters, all whilst controlling IT department resources and staffing costs, is extremely challenging. The answer: organisations and operation centres must have superior visibility and be able to control all applications and users on their networks. The following table groups applications by type and the desired goals: Value of Application Differentiation and Treatment Application Type Examples Goal Communication Tools Point-to-point, point-to-multipoint communications, voice and video. Ensure priority, quality and reliability of communications to ensure integrity. Network Batch processing tasks Defer to less busy and/or reduce overhead on network. Recreational Facebook, Twitter, Skype Reduce/eliminate impact of these applications with the focus on primary purpose of the network. 3

5 Network Performance Challenges The WAN / VPN Secure networks are often composed of multiple sites at dispersed locations that are all connected to one or more main network hubs. Users of all grades and access to various levels of privileged information are reliant on this network to perform their everyday duties. However, access to business critical applications from a distance is often encumbered by serious performance issues resulting in a very real impact on the efficiency of these remote users. Without the proper approach and tools, dealing with the constant challenge of optimizing this connection can be extremely time-consuming and expensive. Network Security Network security represents a further challenge to secure communications networks. Denial of service (DoS) and / or distributed denial of service (DDoS) attacks are capable of disrupting anything from individual servers to complete networks, leading to downtime, loss of access to mission-critical applications and increased demand for support services. Cyber security especially in the networks discussed in this paper is vital to maintain the uncompromising demands of these networks without information leakage or service interruption. Allot Secure Mission Critical Solutions Allot s highly scalable solutions deliver powerful network visibility over 10M, 100M, 1G and 10G interfaces, enabling organisational units to determine exactly how different applications and individual users are impacting network performance. Using this valuable information, network managers can introduce powerful policies that guarantee mission-critical application performance, align other application usages with the organisation s goals and demands, and provide effective protection against network security threats. Allot solutions are managed from a single, central location, avoiding the need for additional IT staffing resources. Network Visibility Allot s dynamic actionable recognition technology (DART) delivers extremely accurate, realtime Layer 7 application visibility, at very high speeds and peak loads. DART also identifies individual user traffic and types of device (smartphone, mobile, dongle) on the network. Hitless updates ensure that recognition capabilities keep pace with new applications and protocols, including those that have been encrypted to avoid detection. Allot s DART provides accurate and reliable answers to a broad range of network utilization questions: How much bandwidth is consumed during office hours, and by which applications? What are the usage patterns for mission-critical apps such as VoIP, secure messaging, command and control applications, surveillance streaming? What are the most popular non mission-critical apps used at different regional sites (e.g. social networking, video streaming)? Is there sufficient bandwidth to ensure reliable service delivery for organisational VoIP? Who or what are the heaviest bandwidth consumers, what applications are they accessing, and when? What application traffic is causing higher levels of discards and affecting robust communication? Allot solutions deliver a rich set of reporting capabilities that include precise traffic statistics, the ability to add user defined signatures (UDS) for business specific content and applications, system alarms and actions when certain conditions and thresholds are met, real- 4

6 time and historic reports, and drill-down functionality to view more granular network and subscriber data. Reporting UI showing network bandwidth utilization by a range of applications, complete with drill down menus Reporting UI showing the most active users on the network and the applications that they are using 5

7 Dynamic Policy Enforcement Allot s policy enforcement capabilities enable network administrators to prioritize application traffic and to manage end users from a single, centralized location, ensuring reliable access to mission-critical applications, and prioritizing other application traffic in accordance with the organisation s goals and priorities. The following QoS actions that can be applied in real time to application, subscriber, and device traffic: Guarantee minimum bandwidth or set maximum bandwidth for specific applications Expedite the delivery of mission-critical applications when the network is congested Drop or reject packets of restricted users or applications Reduce the bit-rate for all or selected traffic when the network is over-congested Reduce congestion and dropped packets by intelligent traffic shaping Manage many thousands of policies and policy elements robustly Together, these actions bring about greatly improved performance on the network s main segments: WAN/VPN - Business critical applications can take precedence over less than critical or recreational applications at specified times and at predefined locations. Application and local site performance can be adjusted in real time, maintaining network integrity and reducing the need for helpdesk support for remote or regional network users. Intelligent management of chosen business critical applications improves the ability for critical networks to perform their duties to their optimal best. Additional Solutions and Features Differentiated service levels - Allot s enterprise solutions are flexible enough to enable organizations to deliver differentiated service levels on a per-user basis. For example, better QoS can be allocated to high priority users. Allot enterprise solutions support user management, and can be integrated with a broad spectrum of third party user provisioning systems, including DHCP and Active Directory. Security Threats Protection - Allot s fully integrated network security solution protects the network from DDoS and botnet attacks, and malicious user activity. Real-time, blacklist based URL filtering helps organizational units to comply with legislation against the distribution of illegal content via the Internet. Remote Office Self-monitoring - Allot enables organizational units to provide self-monitoring and self-provisioning services to their branch offices or other remote sites, giving them a customized view of traffic on their own bandwidth pipes. By utilizing secure access to a predefined set of reporting and provisioning functions, remote offices can track their own usage and adjust QoS policy to better regulate bandwidth utilization and application performance. This facilitates greater user satisfaction with IT services, makes traffic management more efficient and effective, empowers users and reduces help desk calls. 6

8 Benefits By deploying Allot s solutions, customers stand to reap a broad range of benefits: Ensure the performance of mission- and business-critical applications Encryption safe and aware Prioritize application delivery in accordance with business or organizational goals Increase employee / user productivity and control access to recreational applications Keep a hold on IT resource and staffing costs Protect the network from information leakage, malware and DDoS attacks IPv6 enabled QoS changes either manual, automated or on an event trigger (i.e. time, volume usage, etc.) are dynamically applied and reflect the policy change in real time. Application activity can easily be tied to the user community and individuals, organisational units, divisions, companies etc. using Identification Access Management solutions including Active Directory (AD). Solution Components Allot enterprise solutions require the following components: Allot Service Gateway platforms and/or Allot NetEnforcer bandwidth management devices are a series of scalable, high-performance, IPv6 ready, open platforms that are powered by Allot s DART technology and deliver actionable network intelligence. Designed for in-line deployment in a wide range of networks, these appliances and platforms perform real-time traffic monitoring, QoS enforcement, intelligent charging, and traffic steering, providing a common feature-set that scales to 160 Gbps of throughput on a single chassis. Allot NetXplorer is the management umbrella for Allot devices, platforms and services, providing a central vantage point for network-wide analytics, policy provisioning, alerting, and accounting. Its intuitive GUI paints a consolidated picture of application, user, device, and network topology traffic, while its wide variety of analytical reports and policies enable easy drill down to the most granular data. It is compatible with air-gapped environments, prevalent in secure communications environments. NetPolicy Provisioner is Allot s self-monitoring and self-provisioning tool. The NPP web-based GUI is accessible from any browser window, giving users direct access to a predefined set of NetXplorer realtime monitoring reports with full display options and drill-down capabilities. Allot ServiceProtector is an integrated system for defense against distributed denial of service (DDoS) attacks, prevention of outbound spam and for containment and clean-up of infected botnet hosts. It can be added to new or existing deployments of Allot Service Gateway platforms and NetEnforcer devices, with no service interruption or downtime as the functionality is license activated in the platform. Allot WebSafe is a carrier-class URL filtering service designed to block access to blacklisted content at the network level. Allot WebSafe is a license-activated service enabler within Allot Service Gateway platforms and Allot NetEnforcer devices, and requires no additional hardware and no change in network configuration. For per-user visibility and policies (QoS), the following component is required: Allot Subscriber Management Platform (SMP) allows the centralized creation, provisioning, management and monitoring of per-user, quota and tiered services. 7

9 Deployment Satellite and other Transmission Mechanisms managed services network NetXplorer (NX) 40Mb x 15Mb 4.6m 2Mb x 2Mb 2Mb x 2Mb Allot Traffic Management platform 3.7m 1.8m Remote Vsat (x20) Allot Traffic Management platform 8

10 Allot devices act as layer 2 bridges and are invisible to all users or cyber scanning, and as such can be placed anywhere in a network to dynamically control traffic seen. The solutions can be extended into enabling complementary security services. There are no interoperability concerns inserting Allot devices into a network because neighbour devices do not see the Allot device, they continue to interoperate with each other without issue in the same manner as if the Allot device was not there. Allot devices interrogate and treat all traffic seen by looking beyond encapsulation and tagging of packets to identify and classify the payload. The encapsulation and tagging remains intact, with IP headers adjusted if QoS markings need to be altered in transit. Encryption is not broken; there is no man-in-the-middle attempt to breach secrecy. Allot s DART (DPI) engine uses intelligence to understand the nature of the application regardless of the encryption. Allot devices can be placed before or after an encryption device, the effectiveness of the device improves when it sees applications in the clear. Allot realize that encryption is becoming more prevalent and as such has developed signatures and behavioural algorithms to mitigate risk of misidentifying the traffic within the encrypted tunnel. Individual encryption tunnels that require individual traffic management treatment can be achieved with the granular element based policy control function. Summary Allot enterprise solutions deliver powerful visibility and dynamic policy enforcement in highly scalable devices, with extremely accurate Layer 7 application awareness, with user and device visibility all at very high speed and peak loads. Allot s reporting functionality handles an extensive number of QoS policy rules which can support thousands of users at remote locations. These capabilities enable customers to optimize their networks, to ensure peak performance for mission-critical applications, to prioritize access to other applications in accordance with their organizational goals, and to contain IT resources and staffing costs. Contacts Allot Communications 3 Huxley Road, Guildford Surrey GU2 7RE United Kingdom Phone: sales-uk@allot.com WWW: 9