Who We Are.. ideras Features. Benefits

Transcription

1 :: Protecting your infrastructure ::

2 Who We Are.. ideras Features Benefits Q&A

3 Infosys Gateway Sdn Bhd. Incorporated in 2007 Bumiputra owned Company MSC Status Company Registered with Ministry of Finance (MOF), Kementah (MINDEF) Malaysia Industry Council for Defence, Enforcement & Security(MIDES) MATRADE, SME-CORP & OIC- CERT Successfully innovated and developed a network security appliance with continuous R&D for enhancement and future innovation 1st Malaysian developed unified network security product named ideras.

4 Global Certification Common Criteria EAL 2

5 For securing the complete ICT environment, we propose the following components: Malaysia First Unified Network Security Innovation, ideras.

6

7 Unified threat management (UTM) is a converged platform of point security products, particularly suited to midsize and enterprise businesses. Typical feature sets fall into three main subsets; 1. Firewall 2. Intrusion Detection & Prevention System (IDPS) 3. Proxy Filter (Content Filtering, URL Filtering, Web Antivirus [AV])

8 UNLIMITED USERS

9 Features Control of network traffic to optimize bandwidth, lower latency, and/or increase usable bandwidth. A firewall, an appliance designed to prevent unauthorized access to your network FIREWALL TRAFFIC SHAPER IDPS Monitor inbound and outbound network activity, identify suspicious network patterns that may indicate potential harm to your environment and prevents it based on the rules set CAPTIVE PORTAL CONTENT FILTERING Prevent access to harmful content, which may be harmful if opened or accessed. Direct users to a web page before granting access to the internet. Able to identify who is using your network. VPN VPN, to connect to a private network, such as a company's internal network, ensuring secured connectivity within your environment.

10 FIREWALL Firewall

11 FIREWALL Firewall Firewall is the most important component of the UTM Box Firewall rules control what traffic is allowed to enter an interface on the firewall Filtering by source and destination IP, IP protocol, source and destination port for TCP and UDP traffic Option to log or not log traffic matching each rule. Highly flexible policy routing possible by selecting gateway on a per-rule basis (for load balancing, failover, multiple WAN, etc.)

12

13 FIREWALL

14 FIREWALL Firewall: Other Functionalities A tool to control the network traffic in order to optimize or guarantee performance, lower latency, and/or increase usable bandwidth by delaying packets that meet certain criteria. NAT Network Address Translation (NAT) is a way to map an entire network (or networks) to a single IP address. TRAFFIC SHAPER Virtual IPs Virtual IP (VIP) feature provides IP addresses that can float between two or more physical network nodes. These IP addresses are used to provide redundancy for attached servers and VIPs Firewall rules can be scheduled so that they are only active at certain times of day or on certain specific days or days of the week. SCHEDULES

15 FIREWALL NAT (screenshots) cont Add Port Forwarding When enabled, this automatically creates additional NAT redirect rules for access to port forwards on your external IP addresses from within your internal networks. Firewall: NAT: 1:1 The NAT + proxy mode uses a helper program to send packets to the target of the port forward. It is useful in setups where the interface and/or gateway IP used for communication with the target cannot be accurately determined at the time the rules are loaded. Enables the automatic creation of additional NAT redirect rules for access to 1:1 mappings of your external IP addresses from within your internal networks. Reflection on 1:1 mappings is only for the inbound component of the 1:1 mappings. This functions the same as the pure NAT mode for port forwards.

16 FIREWALL NAT (screenshots) cont NAT: Outbound Automatically create outbound NAT rules which assist inbound NAT rules that direct traffic back out to the same subnet it originated from. Required for full functionality of the pure NAT mode of NAT Reflection for port forwards or NAT Reflection for 1:1 NAT. This only works for assigned interfaces. Other interfaces require manually creating the outbound NAT rules that direct the reply packets back through the router.

17 FIREWALL Schedule

18 FIREWALL Virtual IPs Virtual IPs add knowledge of additional IP addresses to the firewall that are different from the firewall's actual "real" interface addresses. Most often, these are used for NAT, but they can also be used for other functions such as clustering, binding services such as DNS, load balancing in packages

19 TRAFFIC SHAPER Traffic Shaper Traffic shaping, also known as "packet shaping," is the practice of regulating network data transfer to assure a certain level of performance, or quality of service (QoS). The practice involves delaying the flow of packets that have been designated as less important or less desired than those of prioritized traffic streams. Regulating the flow of packets into a network is known as "bandwidth throttling." Regulation of the flow of packets out of a network is known as "rate limiting. Example : delaying packet flow when downloading video (which is rated as less important from the company policy) Traffic Shaper UI

20 IDPS Intrusion Detection & Prevention System IDS IPS Rules Intrusion Detection System(IDS) is considered to be a passive-monitoring system, since the main function of an IDS product is to warn you of suspicious activity taking place not prevent them. IDSs can respond to the suspicious event in one of several ways, which includes displaying an alert, logging the event. Intrusion Prevention System(IPS) provides policies and rules for network traffic along with an IDS for alerting system or network administrators to suspicious traffic, but allows the administrator to provide the action upon being alerted. IPS has the capability of being able to prevent known intrusion signatures, but also some unknown attacks due to its database of generic attack behaviors. The rule header contains the information that defines the who, where, and what of a packet, as well as what to do in the event that a packet with all the attributes indicated in the rule should show up. The first item in a rule is the rule action. The rule action tells IPS what to do when it finds a packet that matches the rule criteria. There are 5 available default actions in IPS, alert, log, pass, activate, and dynamic.

21 IDPS IDPS Rules

22 IDPS( Screenshot..) IDPS IPS Alerts & Block malicious site Logging and Alerting System & Output Modules: process alerts and logs and generate final output. All the traffics whichever match the rules has been enabled, will trigger alert Alerts

23 IDPS( Screenshot..) IDPS IPS Alerts & Block malicious site Blocks: All the traffics whichever match the rules has been enabled, will trigger alert then it will block and blocked host will be listed in Block Page. Blocked

24 CONTENT FILTERING Content Filtering (Proxy) Proxy limits the web access for some users to a list of accepted/well known web servers and/or URLs only. Will generate the logs for all the access or blocked URLs/ IPs for the session Block access to some listed or blacklisted web servers and URLs matching list of regular expressions or words for the users. Have different access rules based on time of day, day of the week, date etc. Redirect blocked URLs to an info page or redirect banners to an empty GIF.

25

26 Content Filtering (Proxy) CONTENT FILTERING These are the additional expressions In addition to the PROXY function, rules can be customised to add onto the blocklist (Kindly refer to the above diagram).

27 CONTENT FILTERING Content Filtering (Proxy)

28 Other Functionalities VPN GlobalBlock Mail Reporting Captive Portal DHCP SERVER Monitoring Graph

29 VPN VPN ideras software offers three options for VPN connectivity, IPsec, OpenVPN, and PPTP. IPsec IPsec allows connectivity with any device supporting standard IPsec. This is most commonly used for site to site connectivity to other ideras installations, other open source firewalls (m0n0wall, etc.), and most all commercial firewall solutions (Cisco, Juniper, etc.). It can also be used for mobile client connectivity. OpenVPN OpenVPN is a flexible, powerful SSL VPN solution supporting a wide range of client operating systems. PPTP Server PPTP was a popular VPN option because nearly every OS has a built in PPTP client, including every Windows release since Windows 95 OSR2. However, it's now considered insecure and should not be used.

30 VPN VPN (screenshots) cont Enabling OPEN VPN

31 GlobalBlock GlobalBlock Global Blocks allows: Blocking individual countries All incoming and outgoing traffic can be blocked using global block. Restrict spammers from selected countries. Global block allows users to add IP Block list

32 GlobalBlock GlobalBlock(Screenshots cont.)

33 CAPTIVE PORTAL Captive Portal The Captive Portal allows the IT Administrator to direct users to a web page before Internet access is permitted. From that page, IT Admin can either let users access the Internet after clicking through, or require authentication. Captive Portal Status Online Users Captiveportal Status Captiveportal Status

34 Captive Portal CAPTIVE PORTAL User List

35 CAPTIVE PORTAL Captive Portal

36 DHCP Server

37 Taffic Monitoring The monitoring Graphs are depicted in different colour patterns which mostly is RED, BLUE and GREY. It is customizable so it can be assigned to any aspect the client wishes to monitor. For example if the client wishes to monitor traffic passing or blocking through an interface then the RED will be Traffic blocked coming in and GREY will be traffic blocked going out from the network through the selected interface. Packets The packets can also be monitored through the same Monitoring Graphs. The Graph will show you the packets passing per second through the selected interface or blocked. The same colour combination is followed with RED showing packets per second coming in the network and GREY showing packets per second going out of the network.

38 Reports

39 IMPLEMENTATION W/station 02 W/station 01 W/station 03 Branch Office Branch Office Branch Office W/station 02 Internet W/station 01 W/station 01 W/station 03 W/station 03 W/station 02 Web Server Mail Server FTP Server DB Server Domain Server Datacenter Application Server

40 ideras UTM promises to be security in a box The BENEFITS are endless, but here are a few of the relevant qualities of using ideras within your organization: Lower up-front cost Simplicity Ease of management Minimal Training Generally speaking, a single all-in-one appliance costs less than buying multiple dedicated systems. No user license based on additional functionalities used. A single purchase covers every security need, and all the security features can be controlled and configured from a single management console. Only a single vendor will be in-charge for the maintenance of the device. The proposed solution will have a unified console to manage all its features. This will provide ease of management to the users. Only one product training is required, therefore reducing technical training day required in order to understand the nature of the product.

41 ideras UTM promises to be security in a box The BENEFITS are endless, but here are a few of the relevant qualities of using ideras within your organization: Lower maintenance costs Less space Lower power consumption Easier to install and configure Fully integrated Significantly reduce the amount you pay for service contracts and ongoing support. You only pay yearly maintenance support charges. Require less space to store this equipment, where Unified Threat Management s has the ability to fit all the services into a small, selfcontained package can be really appealing. One power supply means less power used and less lost while reducing line voltage to the levels network devices use. A oneappliance set up means there is just a couple of wires to connect and one interface to use setting the device. The UTM device s many features are designed to work together without leaving gaps in your protection or creating interoperability challenges.

42

43