MSActivator Technical Description

Transcription

1 MSActivator Technical Description Technical and Hardware Description of the MSActivator TM March / 7

2 Contents MSActivator Technical Description Technical and Hardware Description of the MSActivator TM Introduction MSActivator TM Internals Modular Architecture: Web portal Generic profil based approach Event based architecture Powerful security configuration engine Pattern based configuration builder Modular architectural approach Software Modules SEC Engine Event Tracker Hardware Architecture Redundancy / 7

3 1. Introduction The UBIqube MSActivator TM is a powerful but very easy-to-use solution for provisioning management and monitoring for quick and cost effective delivery of security services on multi-vendor CPE devices (routers, firewall, UTM) deployed in multisite networks. The UBIqube MSActivator TM is designed to scale from small networks of less than one hundred devices to large networks with thousands of managed devices. The scalability is achieved through the powerful profile based approach and the multithread design of the embedded security engine. 2. MSActivator TM Internals 2.1. Modular Architecture: The design of the MSActivator TM is based on a modular architecture. Best of breed technologies are used to build each component of the MSActivator TM. For example the framework of the Web Portal is a WEB2.0 one Web portal Unified GUI, web-based client. Simple definition and activation of managed services on top of multivendor devices. Role based access control allowing delegation of administrative rights Generic profil based approach Complete set of predefined profiles for VPN, firewall, IPS, anti-virus, anti-spam, URL filtering Quick activation of new devices and services Event based architecture Enhanced per group and per site event processing for advanced datamining. Detailed reporting. Event correlation and pro-active alerting Powerful security configuration engine Multi-deamons, multi-threaded configuration and monitoring engine. Support of large scale global deployments at minimal HR cost. 3 / 7

4 Pattern based configuration builder Fast reconfiguration of the devices. Minimize human errors and guarantee the consistency of global security policy Modular architectural approach Enables easy migration and updates of the MSActivator TM modules. Provides a scalable solution Software Modules Combined with the WEB Portal, the other 2 main building blocks supporting the UBIqube VSOC solution are the SEC Engine and the Event Tracker. The UBIqube web portal has been written in Java with Ajax libraries, the frontal web server is Apache with Tomcat. The Oracle database contains all info regarding configuration and reporting, just like a typical CMDB as described in the ITIL standards. The SEC Engine and the event tracker are written in C and are running under a multithreaded Linux platform SEC Engine UBIqube has developed the SEC Engine specifically to administer Internet-connected devices. The SEC Engine hides all the complexity of remote operation on a group of devices. Security is a major concern, but so is reliability. Each device will have differences in 4 / 7

5 configuration, in availability and in usage. The SEC Engine guarantees coherence of all the devices. The SEC Engine takes commands from the VSOC for a single device, or for a group of devices. It uses a database of tested configuration fragments to calculate the new configuration for each device. If the device is currently accessible the new configuration is applied immediately. Otherwise the configuration is applied as soon as the device is connected. The SEC Engine can automatically update devices to allow dynamic Internet addresses or to propagate security updates. Certain operations, such as device reset or reboot, can be programmed for a certain date and time Event Tracker The Event Tracker - informs you or your customers on the appliances status and provides comprehensive reporting features for the previous months. The Event Tracker - combined with the SEC Engine collects information from the edge devices such as routers, Firewalls, UTMs, Load balancers and more. It uses network monitoring and testing tools to continuously collect availability, performance indicators and event occurrences. It also provides the following features : Log collection (syslog or flat files or snmp traps) Log archiving Log analysis Alert generation All systems report their logs to this centralized server. All the messages received from the managed devices are stored in the Event Tracker databases. The Event Tracker generates Dash Boards that are fully integrated into the VSOC, allowing information from all your sites, regardless of the CPE nature or brand, to be viewed in one single user interface. Detailed reports can be generated for any period required, and forensic analysis can be performed with zooming capabilities down to a particular day or hour 3. Hardware Architecture UBIqube recommends at least to set up 4 servers with the following hardware requirements: 1) Applications server (Web Portal, SEC Engine, Event Tracker) 2x Intel Xeon 16 Go Ram 5 / 7

6 3 *146GB 15Krpm SAS HotSwap HDD + RAID 5 2) Database server (CMDB) 2x Intel Xeon 16 Go Ram 3 *146GB 15Krpm SAS HotSwap HDD + RAID 5 3) PKI, Reporting Engine server 2x Intel Xeon 8 Go Ram 3 *146GB 15Krpm SAS HotSwap HDD + RAID 5 4) Archiving Server 1 Intel Xeon 4 Go Ram 4 *TB SAS HotSwap HDD + RAID 5 Those servers will be protected by embedded Linux based IPtables firewall. The data will be archived on dedicated backup server. Physical firewall can also be added to add a second layer of traffic filtering. 1 Gigabit Ethernet switch will interconnect the servers on the Server Interco and maintenance server. Server 1 and Server 2 will have 2 dedicated physical Interface (management and maintenance). In normal condition only server 1 will have its management interface up and connected to the Device Administration Network. In case of failure of server 1, the UBIqube modules will be started on server 2 and its management interface will be configured with the same IP as server 1 and connected to the Device Administration Network. The UBIqube support center will have access to the servers for support and maintenance purposes. The access will be done through an IPsec VPN tunnel. 6 / 7

7 4. Redundancy The WEB Portal, SEC engine and Event Tracker module do not maintain any information. In case of disaster recovery those modules can simply be reinstall on the new hardware platform. All the data (users, devices, configuration, and services) are only stored in the Configuration Management DataBases. The CMDB is exported every night for backup, allowing easy restoration on other hardware. As an example on the previous architecture the databases and the tampered proof logs files are saved every night on the Backup server. Upon failure a new server can be easily set up or the server 1 can run the databases as the server 2 can run the server 1 applications allowing fast restoration of the SOC. 7 / 7