Nortel Networks Alteon Switched Firewall

Transcription

1 White Paper Alteon Switched Firewall A positioning paper

2 Executive summary The Internet has become a vital resource for business of all sizes. is now a mission-critical resource; sharing applications and data online with customers, partners, and suppliers is becoming the standard way of conducting business. However, opening access to a corporate network especially to servers in the data center generates significant security concerns. A firewall is the most common way to implement perimeter protection for corporate information assets. While traditional firewalls do a great job of securing entry to a network or data center, today s solutions introduce performance bottlenecks. Until now, an enterprise or service provider had to chose between implementing the highest levels of security with maintaining the performance required for data center operations. To address the challenges of security, performance, and management within data centers, has developed a next-generation security architecture called the Nortel Open Security Architecture (OSA). OSA is a new paradigm for ultra-high-throughput security with unmatched scalability and flexibility. It combines the performance of wirespeed switching with the sophistication found in best-of-class security software solutions. The first product released using this new architecture is the Alteon Switched Firewall. The Alteon Switched Firewall, integrating Check Point FireWall-1 Next Generation, is specifically designed to provide a total solution that allows you to ensure high levels of security without giving up the data center performance that is truly critical to business success. The Alteon Switched Firewall optimizes capital investment by providing what we call high-performance security at a significantly lower cost than traditional solutions that require multiple firewalls. All this comes in a highly flexible solution that is easy to integrate into existing data centers. 2 Alteon Switched Firewall System White Paper

3 Introduction Firewalls come in various sizes and capabilities, filling many specific network requirements depending on their point of use. For example, data centers require firewalls with tremendous throughput capacity, often well in excess of 1,000 Mbps. Broadband subscribers, on the other hand, connect at speeds of one Mbps or less. has the right firewall solution to suit these various customer needs. For high-performance, high-throughput firewalls used in enterprise and service provider data centers, the Alteon Switched Firewall integrating Check Point FireWall-1 is the choice. To date, implementing perimeter protection security within a data center has required tradeoffs among high security, flexibility, and high performance. The most secure solutions impose a bottleneck within the data path. For high-speed data centers, the only solution until today was to implement multiple firewalls operating in parallel, load-balanced by a Web switch. Although this solution scales to gigabit speeds, it requires spending significant capital and often introduces an added level of complexity to data center management. Today, the economics of enterprise and service provider IT infrastructures require simpler, more cost effective solutions that scale to new performance levels. The solution? The Nortel Open Security Architecture (OSA). OSA is a new paradigm for ultra-high-throughput security with unmatched scalability and flexibility. It combines the performance of wire-speed switching with the sophistication found in best-of-class security software solutions. The Alteon Switched Firewall is the first product designed following the principles of the Open Security Architecture. The Alteon Switched Firewall Evolution of security hardware technology Firewalls have been used for many years to protect access to networks. Firewall architecture has changed over time to meet new requirements for security and performance. The first generation of firewalls, some of the earliest forms of protection in the new Internet environment, involved deploying firewall software on a general-purpose operating system running on a workstation or server. The firewall function often was one of many applications running on the device. As traffic volume grew and the sophistication of Internet users improved, problems with this firewall architecture emerged, such as security holes in general-purpose operating systems and poor performance under moderate traffic demands. It was time for an evolution to the second generation in firewalls. Figure 1: Contrast between traditional firewall architecture and the Alteon Switched Firewall. Traditional Firewall Appliances Scale Using Switches for Firewall Load Balancing Alteon Web Switches for firewall load balancing Traditional Firewall Appliance Alteon Web Switches for server load balancing The second generation of firewalls consisted of appliances that were created to solve server-based firewall shortcomings. These so-called appliances represented a new architecture a combination of a dedicated hardware device paired with a more secure operating system. The firewall appliance has one function only, and that is to function as a perimeter security device. Processing power is not shared with any other application. Increasingly, firewall appliances have become the dominant solution for securing networks and data centers. Despite their popularity, appliances still present a scalability and manageability challenge. As traffic grows, the firewall appliance becomes a bottleneck within the data path. The addition of other firewall appliances, load-balanced by a Web switch, allows for scaling and management of traffic distribution and sessions across multiple firewalls; however, at a certain point this solution becomes untenable from throughput, management and cost perspectives. It is now time for the next evolution in firewall architecture. Alteon Switched Firewall Simplifies Configuration and Management Alteon Switched Firewall Alteon Web Switches for server load balancing Alteon Switched Firewall System White Paper 3

4 The third-generation switched firewall architecture takes the best of second-generation appliances and adds the scalability, manageability, and performance of switching meeting key requirements of the high performance IT data centers (see Figure 1). The OSA-based Alteon Switched Firewall is the first of this new generation of firewall architecture. The Alteon Switched Firewall System provides multi-gigabit firewall performance for data centers that require this level of throughput and state-of-the-art filtering in order to secure and safeguard servers. Using the innovative OSA architecture, the Alteon Switched Firewall System overcomes the traditional performance degradation that occurs with deep packet inspection. This switch-accelerated firewall solution not only increases throughput performance to multi-gigabit speeds, but also improves the flexibility and manageability of the firewall function. Firewall policies are controlled from a dedicated appliance while high performance comes from the addition of wirespeed Layer 4-7 switching technology. Alteon Switched Firewall Architecture Following the principles of OSA, the Alteon Switched Firewall is a multicomponent solution that is managed as a single system. It combines the traffic management functionality of Web switching with the firewall function of one or more dedicated appliances, providing unmatched levels of network manageability and performance. The cornerstones of this new architecture are: Alteon Web Switching technology Figure 2: Alteon Switched Firewall accelerates session packets. Traditional Firewall Solution Secure Data Center Un-Secure Internet Alteon appliance platform Single System Image (SSI) automatic configuration capability patent-pending interface technology, the Nortel Appliance Acceleration Protocol (NAAP) Check Point Software Technologies FireWall-1 Next Generation security application and SecureXL performance architecture Traditional firewall appliance architectures integrate the policy control and forwarding functions of an in-line data processing device. Scalability is achieved through the use of multiple firewalls load-balanced by a Web switch. In contrast, the Alteon Switched Firewall separates the control and forwarding functions. A dedicated firewall appliance the Alteon Switched Firewall Director runs Check Point s Firewall-1 Next Generation application. The Alteon Switched Firewall Director handles the control functions of policy management, session acceptance, session management, etc. However, once the first packet in a session passes through the inspection engine, rule checking and packet forwarding are offloaded to a high-speed switch, the Alteon Switched Firewall Accelerator. Throughput is Security Revolution 90% of all packets are accelerated Alteon Switched Firewall System Secure Data Center Switched Firewall System Un-Secure Internet boosted by the acceleration of these subsequent packets in a session because these packets are processed by the wirespeed switching fabric. Based on typical session composition, users will find that nine of every ten packets are accelerated for a throughput improvement of nearly ten times that of traditional firewall appliances while still maintaining full security (see Figure 2). Each component of the Alteon Switched Firewall has a specialized function. The Alteon Switched Firewall Director, running FireWall-1, performs policy checking for every new connection request, manages the connection table, and specifies the rules for handling subsequent packets in a session. While a session is active, policy checking for packets is managed by the Alteon Switched Firewall Accelerator at blazing speeds. As traffic and the number of policies grow, additional Alteon Switched Firewall Directors can be paired with a single Alteon Switched Firewall Accelerator. Alteon Switched Firewall System White Paper 4

5 The Nortel Appliance Acceleration Protocol (NAAP) controls and manages the interface between the devices. NAAP is a communication protocol that simplifies management and centrally enforces security between the Switched Firewall Accelerator and Switched Firewall Directors, providing integrated communication and acceleration of the interface function. This breakthrough hardware acceleration architecture the sharing of the connection tables and separation of the control and forwarding planes represents a paradigm shift that is similar to the movement from routing to Layer 3 switching. Extracting the forwarding function out of the software and processing it on a specially-purposed ASIC was the basis of the LAN routing-to-layer 3 switching market paradigm shift. Nortel Networks is accelerating perimeter security in a similar fashion with the Open Security Architecture and the Alteon Switched Firewall. Not only does the specialized forwarding function improve firewall throughput performance, but additional acceleration comes from the automatic offload of CPU-intensive network address translation (NAT) to the Alteon Switched Firewall Accelerator. NAT has always been a CPU drain for firewalls. By offloading this function to the exceptionally powerful processing on the Alteon Switched Firewall Accelerator, the firewall appliance (Alteon Switched Firewall Director) is not wasting valuable CPU resources performing NAT functions. Multiple Switched Firewall Directors can be teamed with one Switched Firewall Accelerator. NAAP creates a Single System Image as the first Alteon Switched Firewall Director is configured. Adding additional Directors is a simple plug-and-play operation as the device is automatically recognized and the system image created. Benefits of the Alteon Switched Firewall revolutionary Alteon Switched Firewall system enables service providers to deploy current and future high-margin managed security services over a cost-effective and flexible infrastructure. With its innovative architecture and plug-and-play provisioning of firewall resources, the Alteon Switched Firewall allows service providers to reduce capital expenditures due to the Open Security Architecture s pay as your traffic grows flexiblity. The Alteon Switched Firewall provides the best price/throughput ratio on the market, making it the best choice for performance-hungry networks. Operation costs are minimized because administrators no longer must configure each firewall as added. The first firewall can be provisioned in minutes using a GUI-based configuration wizard. The Single System Image replication and management wizard capabilities of the Alteon Switched Firewall System makes adding new Alteon Switched Firewall Directors a plug-and-play operation. The acceleration capabilities of the Open Security Architecture can be extended to other security technologies, such as intrusion detection systems, virus scanning, content filtering and virtual private networks. higher-end switching platform rides the switching performance curve and scales to incredible performance. The Alteon Switched Firewall is the first product released using this innovative OSA architecture. The result is a firewall that delivers in excess of 3 Gbps throughput and supports up to 32,000 new connections every second with over 500,000 concurrent connections performance that is unmatched in the industry. 5 Alteon Switched Firewall System White Paper

6 For more information, contact your representative or call NORTEL ( ), or outside of North America. United States 4401 Great America Parkway Santa Clara, CA ASK Canada 8200 Dixie Road, Suite 100 Brampton, Ontario L6T 5P6 Canada Caribbean and Latin America CALA Inc 1500 Concord Terrace Sunrise, FL Europe, Middle East, and Africa EMEA, S.A. Les Cyclades-Immeuble Naxos 25 Allee Pierre Ziller Valbonne, France ** 44(0) Asia Pacific 27/F City Plaza One 1111 King s Road Quarry Bay Hong Kong **Number accessible from most European Countries Copyright All Rights Reserved. *, the logo, and the Globemark, are trademarks of. All other trademarks are the property of their respective owners. Information in this document is subject to change without notice. assumes no responsibility for any errors or omissions that may appear in this document /01-02