Download as PDF, PPTX
Uploaded byEnterprise Management Associates
Best Practices for Building Scalable Visibility Architectures
The document outlines best practices for building scalable visibility architectures, presented by experts Jim Frey and Scott Register. It covers key definitions, components, and the importance of visibility architecture in managing network traffic for performance and security operations. The webinar emphasizes the need for adaptive and resilient infrastructures due to the rapid growth of network traffic and tools.
More Related Content
Similar to Best Practices for Building Scalable Visibility Architectures
More from Enterprise Management Associates
Best Practices for Building Scalable Visibility Architectures
- 1. Best Practices forBuilding Scalable Visibility Architectures Jim Frey VP of Research Network Management Enterprise Management Associates Scott Register Senior Director Product Management Ixia February 11, 2014
- 2. Today’s Presenters Jim Frey VicePresident of Research, Network Management Jim has over 25 years of experience in the computing industry developing, deploying, managing, and marketing software and hardware products, with the last 20 of those years spent in network and infrastructure operations and security management, straddling both enterprise and service provider sectors. Scott Register Senior Director, Product Management Scott has more than 15 years of experience leading product management operations for global technology companies. Scott lead product management at BreakingPoint Systems prior to its acquisition by Ixia. Other past experience includes leading product lines for Blue Coat, Permeo, and Check Point Software. Slide 2 © 2014 Enterprise Management Associates, Inc.
- 3. Logistics for Today’sWebinar Questions • Log questions in the Q&A panel located on the lower right corner of your screen • Questions will be addressed during the Q&A session of the event Event recording • An archived version of the event recording will be available at www.enterprisemanagement.com Event presentation • A PDF of the PowerPoint presentation will be available Slide 3
- 4. Agenda • What isa Visibility Architecture? • Definitions and Drivers • Best Practices and Decision Points • Topology • Tap or SPAN? • In-line vs Out-of-Band • Dealing with Virtualization • Key Features for NPBs • Ixia Visibility Solutions • Wrap-up and Key Takeaways • Q&A Slide 4 © 2014 Enterprise Management Associates, Inc.
- 5. Visibility Architecture Defined Systemicapproach to establishing access to network traffic streams for packet-based monitoring and management purposes Slide 5 © 2014 Enterprise Management Associates, Inc.
- 6. Visibility Architecture Defined Systemicapproach to establishing access to network traffic streams for packet-based monitoring and management purposes Key Value • Permanent, adaptive packet stream management infrastructure for reliable, resilient, effective network and security operations Essential Attributes • Scalability • Sustainability • Flexibility Slide 6 © 2014 Enterprise Management Associates, Inc.
- 7. Basic Components ofa Visibility Architecture … Network Infrastructure Slide 7 © 2014 Enterprise Management Associates, Inc.
- 8. Basic Components ofa Visibility Architecture Packet Analysis & Monitoring Systems Performance Monitor Performance Monitor Security Monitor Packet Recorder … … Network Infrastructure Slide 8 © 2014 Enterprise Management Associates, Inc.
- 9. Basic Components ofa Visibility Architecture Packet Analysis & Monitoring Systems Performance Monitor Performance Monitor Packet Recorder Security Monitor … Tap Tap SPAN SPAN … Network Infrastructure Slide 9 © 2014 Enterprise Management Associates, Inc.
- 10. Basic Components ofa Visibility Architecture Packet Analysis & Monitoring Systems Performance Monitor Performance Monitor Security Monitor Packet Recorder … Visibility Architecture … Tap Network Visibility Controller (a.k.a. Network Packet Broker) Tap … SPAN SPAN … … Network Infrastructure Slide 10 © 2014 Enterprise Management Associates, Inc.
- 11. NVC/NPB Defined Heart ofthe Visibility Architecture • Network devices that provide managed access to packet streams from SPAN and TAPs to network and security analysis tools NVCs provide advanced features beyond simple “Agg Tap” • 1:1, 1:M, M:1, and M:M connections between packet sources and packet consumers (tools) • Filtering and manipulating packet streams to improve effectiveness and efficiency of tools • Load balancing tools for greater resilience Slide 11 © 2014 Enterprise Management Associates, Inc.
- 12. NVC/NPB Defined Heart ofthe Visibility Architecture • Network devices that provide managed access to packet streams from SPAN and TAPs to network and security analysis tools NVCs provide advanced features beyond simple “Agg Tap” • 1:1, 1:M, M:1, and M:M connections between packet sources and packet consumers (tools) • Filtering and manipulating packet streams to improve effectiveness and efficiency of tools • Load balancing tools for greater resilience Aliases…. • Network Monitoring Switch • Matrix/Aggregation Switch • Data Access Switch • Distributed Filter Tap Slide 12 © 2014 Enterprise Management Associates, Inc.
- 13. Why a VisibilityArchitecture? Network Growing Faster than the Tools! Maximum networking link speeds within data center / core networks 100M 1G 10G 40G 100G 0% 10% Current 20% 30% 40% 50% Planned in 12 months Sept. 2013; Sample Size = 177 Slide 13 © 2014 Enterprise Management Associates, Inc.
- 14. Why a VisibilityArchitecture? Network Growing Faster than the Tools! Maximum networking link speeds within data center / core networks 100M 1G 10G 40G 100G 0% 10% Current 20% 30% 40% 50% Planned in 12 months Tools Challenged to Keep Pace! Sept. 2013; Sample Size = 177 Slide 14 © 2014 Enterprise Management Associates, Inc.
- 15. Why a VisibilityArchitecture? Growing Number of Tools! Types of tools attached to NVCs/NPBs Network Performance Monitor Data Loss Prevention Intrusion Detection / Prevention Troubleshooting / Packet Analyzers (e.g. packet “sniffers”) Compliance Monitor Data / Packet Recorder Application Performance Monitor VoIP / UC / Video Analyzer Current 0% 10% 20% Planned in 12 months 30% 40% 50% 60% Sept. 2013; Sample Size = 177 Slide 15 © 2014 Enterprise Management Associates, Inc.
- 16. Why a VisibilityArchitecture? Growing Number of Tools! Types of tools attached to NVCs/NPBs Network Performance Monitor Data Loss Prevention Intrusion Detection / Prevention Troubleshooting / Packet Analyzers (e.g. packet “sniffers”) Compliance Monitor Data / Packet Recorder Application Performance Monitor VoIP / UC / Video Analyzer Current 0% 10% 20% Planned in 12 months 30% 40% 50% 60% Can’t accommodate using old/dedicated approach! Sept. 2013; Sample Size = 177 Slide 16 © 2014 Enterprise Management Associates, Inc.
- 17. Why a VisibilityArchitecture? In-Lines Use Cases for Security Deployments Security priorities: Never Higher Threat landscape: Never More Daunting One important answer: Active Enforcement • Intrusion Prevention Systems (IPS) • Data Loss Prevention (DLP) Sept. 2013: Sample Size = 177 Slide 17 © 2014 Enterprise Management Associates, Inc.
- 18. Why a VisibilityArchitecture? In-Lines Use Cases for Security Deployments Security priorities: Never Higher Threat landscape: Never More Daunting One important answer: Active Enforcement • Intrusion Prevention Systems (IPS) • Data Loss Prevention (DLP) Major concerns • Performance of IPS, DLP • Resilience of IPS, DLP Potential answer • Highly efficient, packet switching • Advanced resilience features Sept. 2013: Sample Size = 177 Slide 18 © 2014 Enterprise Management Associates, Inc.
- 19. Who Is Ixia? TheMOST TRUSTED names in networking trust Test Visibility Security Enterprises trust IXIA to: Assess vendor equipment and applications Improve network security posture Improve network and application visibility and performance Service Providers trust IXIA to: Improve and speed service delivery Speed roll out of next gen services Improve network and application visibility and performance Equipment Manufacturers trust IXIA to: Develop next generation devices Speed time to market Improve performance and reliability Chip Fabricators trust IXIA to: Validate protocol conformance Speed time to market Slide 19
- 20. Best Practices forVisibility Architectures Slide 20 © 2014 Enterprise Management Associates, Inc.
- 21. Best Practices: Where NVCs/NPBsAre Deployed Where has your organization deployed Network Visibility Controllers (NVCs)? Data center core network Top of Rack Data center Edge (ingress/egress) Campus backbone Remote sites DMZ End of Row Backhaul links Other (Please specify) 0% Current 10% 20% 30% 40% 50% 60% 70% Planned in 12 months Sept. 2013; Sample Size = 177 Slide 21 © 2014 Enterprise Management Associates, Inc.
- 22. Best Practices: Where NVCs/NPBsAre Deployed Where has your organization deployed Network Visibility Controllers (NVCs)? Data center core network Top of Rack Data center Edge (ingress/egress) Campus backbone Remote sites DMZ End of Row Backhaul links Other (Please specify) 0% Current 10% 20% 30% 40% 50% 60% 70% Planned in 12 months Points of Concentration & Control Sept. 2013; Sample Size = 177 Slide 22 © 2014 Enterprise Management Associates, Inc.
- 23. Poll Question If youhave network or security monitoring tools that require SPAN ports or TAP connections, do you (select one): A. B. C. D. Slide 23 Plan to expand use of SPAN ports Plan to expand use of TAPs Plan to add both more SPAN ports and TAPs Have no plans to add more SPAN ports or TAPs © 2014 Enterprise Management Associates, Inc.
- 24. Best Practices: Mixing SPANand TAP for Access 50.0% 40.0% 30.0% 20.0% 10.0% 2009 2013 0.0% Sample Size = 165 (Sept 2009); 177 (Sept 2013) Slide 24 © 2014 Enterprise Management Associates, Inc.
- 25. Best Practices: Mixing SPANand TAP for Access 50.0% 40.0% 30.0% 20.0% 2009 2013 10.0% 0.0% Need Both, but Leaning Towards Taps Sample Size = 165 (Sept 2009); 177 (Sept 2013) Slide 25 © 2014 Enterprise Management Associates, Inc.
- 26. Data Deduplication Necessity ifusing SPAN ports A A D D C A F C C E D B F E A Increase throughput efficiency to monitoring tools Reduce monitoring tool overload Improve monitoring tool processing efficiency Eliminate duplicate packet storage Slide 26 C B A
- 27. Best Practices: In-Line vs.Out-of-Band deployments Are NVCs deployed in-line anywhere within your organization's network? No, and no plans to do so 10% 40% No, but planning to do so Yes – currently deployed in-line 50% Sept. 2013: Sample Size = 177 Slide 27 © 2014 Enterprise Management Associates, Inc.
- 28. Best Practices: In-Line vs.Out-of-Band deployments Are NVCs deployed in-line anywhere within your organization's network? No, and no plans to do so 10% 40% No, but planning to do so Yes – currently deployed in-line 50% Essential: Load Balancing + Bypass Technology Sept. 2013: Sample Size = 177 Slide 28 © 2014 Enterprise Management Associates, Inc.
- 29. Inline Security Typical InlineSecurity Deployments Campus Network Cloud Branch Core Data Center Why Inline Security? Critical Considerations Threat prevention, not reaction Cannot take the network down Satisfy compliance requirements Cannot slow or block application traffic Prevent IPR and publicity “issues” Must scale with network demands Slide 29
- 30. Best Practices: Dealing withVirtualized Environments Approaches using or considering for adding packet monitoring to virtualized environments Packet analysis tools deployed on VMs for intra-host visibility SPAN/Port Mirroring from virtual switches Virtual taps Header stripping for overlay encapsulations 0% 20% 40% 60% 80% Sept. 2013; Sample Size = 156 Slide 30 © 2014 Enterprise Management Associates, Inc.
- 31. Best Practices: Dealing withVirtualized Environments Approaches using or considering for adding packet monitoring to virtualized environments Packet analysis tools deployed on VMs for intra-host visibility SPAN/Port Mirroring from virtual switches Virtual taps Header stripping for overlay encapsulations 0% 20% 40% 60% 80% Select Techniques Based on Specific Needs Sept. 2013; Sample Size = 156 Slide 31 © 2014 Enterprise Management Associates, Inc.
- 32. Virtual Visibility Core Switch NetworkPacket Brokers Enables inter-VM, east-west traffic monitoring to eliminate the blind spots in virtualized environments Top of Rack Switch Virtualized Host Hypervisor vSwitch Kernel Module Virtual Tap VM VM VM VM App App App App App OS Slide 32 VM OS OS OS OS
- 33. Best Practices: Key NVC/NPBFeatures Most important packet manipulation features (Mean by role) Load Bal across multiple tools Inbound Filtering Outbound Filtering Decryption Time stamping Tunneling Port labeling Masking De-duplication IPv6 support Header stripping (de-encapsulation) Media conversion (i.e. 10G to 1G) Packet slicing 3 = Critical 2 = Helpful 1 = Not Important 2.00 Executive 2.25 2.50 2.75 Staff Sept. 2013; Sample Size = 177 Slide 33 © 2014 Enterprise Management Associates, Inc.
- 34. Feature Priorities Varyby Industry Vertical Financials Manufacturing 1. Inbound Filtering 1. Load Balancing 2. Load Balancing 2. Outbound Filtering 3. Outbound Filtering 3. De-duplication/Tunneling 4. Time Stamping Healthcare/Pharma All Others 1. Load Balancing 2. Inbound Filtering 2. Inbound Filtering 3. Packet Slicing / IPv6 / 3. Decryption Port Labeling / Outbound Filtering Slide 34 1. Load Balancing 4. Tunneling © 2014 Enterprise Management Associates, Inc.
- 35. Creating A NetworkVisibility Architecture Visibility Architecture Remote Office Branch Office Campus Network Operations Network Taps App Aware Virtual & Cloud Access Core Data Center Private Cloud Virtualization Carrier Networks Wired and Mobile Slide 35 Out of Band NPB Inline Bypass Network Access Element Mgmt Performance Management Security Admin Policy Mgmt Inline NPB Packet Brokers Session Aware Applications Server Admin Data Center Automation Management Audit & Privacy Forensics
- 36. EMA: Key Takeawayson Visibility Architectures 1. Visibility Architectures provide both tactical and strategic advantages to security and operations 2. Deploy in the core first; expand to edge and remote sites over time 3. Top, most-valued NVC/NPB features are Load Balancing and Inbound/Outbound filtering, though other features may also be important based on vertical sector 4. Focus on scalability, flexibility, manageability, completeness when seeking solutions Slide 36 © 2014 Enterprise Management Associates, Inc.
- 37. Question & Answer: Pleaselog questions in the Q&A Panel Jim Frey JFrey@enterprisemanagement.com @jfrey80 Scott Register sregister@ixiacom.com @swregister Download this FREE White Paper from the follow-up email you receive from EMA! Or go to the Ixiacom.com home page and click on the EMA webinar banner. Slide 37