Security visibility with packet flow switch platforms

“One of the key concerns with network security is performance of security systems,” said Zeus Kerravala, Founder and Principal Analyst of ZK Research. “With the NETSCOUT nGenius 2204 and 4204 packet flow switches reducing processing burden on security systems, organisations do not have to make a tradeoff between features and performance.”

According to a 2016 study on IT initiatives from business information provider IHS, almost 2 out of 3 respondents reported that they plan to implement network visibility and performance monitoring in the next 12 months. Network monitoring is the most important component in the initiatives aimed at reducing network and communications systems downtime, which according to IDC costs North American businesses $700m annually.

Improving network security and reliability are the key drivers for network monitoring projects, both in service provider and enterprise environments. As these organisations seek to improve capital and operating efficiencies, they are under pressure to rationalise network resources and extend the life of their current investments, rather than add new network capacity. The expansion of security capabilities within the NETSCOUT portfolio enables the networking and the security teams to implement joint security visibility projects, easing the expansion and adoption of security systems that require access to packet data, such as Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), Next-Gen Firewalls (NGFW), Distributed Denial of Service (DDoS), and many others.

“Network security is fast becoming an urgent priority as a result of the rapid proliferation of IT applications and threats,” said Brian McCann, President, NETSCOUT Packet Flow Switch Business Unit. “NETSCOUT is pioneering business assurance by combining monitoring and cybersecurity defenses into a unified architecture, NETSCOUT delivers a complete business assurance solution, powered by IP intelligence. In doing so, NETSCOUT is helping IT Operations reduce costs, increase visibility, and spend less time managing their tools.”

The PFS 2204 and 4204 products both support 1G and 10G environments, and the PFS 4204 product also supports 40G environments. In addition, the PFS 4204 provides line rate packet de-duplication thereby increasing efficiency and optimising packet processing for security systems.

Key security capabilities with the nGenius PFS 2204 and 4204 products include:

• Active tool chaining: enables deployment of an inline security infrastructure in a virtual chain, rather than cabling each system into a physical configuration. The key advantage of the PFS 2204 and PFS 4204 implementation is the 50% reduction of ports needed and elimination of complex physical cabling configurations. At the same time, each device gets exactly the traffic it requires, at the speed and in the form that it is designed to accommodate.
• Application-level health checks: performs an assessment of the security system’s functionality with both "negative" and "positive" health checks, beyond a simple on/off response, ensuring applications function as expected.
• Policy-based triggers: provides the unique ability to customise monitoring performance via user-defined mechanisms that trigger actions related to monitoring, forwarding rules and health status. Users can specify event policies that trigger certain actions, such as providing alerts via SNMP and Syslog, forcing ports into down link status and/or changing traffic forwarding mapping to tools.
• Passive and active hybrid mode: As customers build out security systems and migrate to large-scale active inspection, hybrid mode increases the efficiency of those systems and improves their effective port density by enabling passive and active traffic to be delivered on a single port. Available on both the PFS 2204 and PFS 4204, hybrid mode enables security systems to more efficiently fuse these functions within a single deployment that serves both active and passive traffic.

The nGenius PFS 2204 and 4204 Packet Flow Switches are available now. The systems and associated modules are delivered with all ports active, and all features and applications supported by the hardware available at no extra charge. Customers covered under NETSCOUT’s award-winning MasterCare customer support program enjoy access to supported features and applications released during the term of their coverage without the costs and complexity of additional software feature licenses.

You can visit NETSCOUT at Cisco Live US 2016 at booth #647, or in the Security Partner Village.