This document discusses using SDN-based security mechanisms to support the new 100G backbone of Taiwan Academic Network (TANet). It outlines challenges with upgrading security devices to higher speeds and proposes using SDN technology to provide network and service bypass, flexible load balancing of traffic to security devices, and improved full-fidelity netflow generation for security monitoring. The SDN-based approach aims to improve availability, reduce costs, and increase flexibility of the network's security infrastructure as bandwidth increases.

1. SDN-based Security
Mechanisms on the New 100G
Backbone of Taiwan Academic
Network (TANet)
1
Dr. Ying-Chieh Chang
(ycc@ncnu.edu.tw)
National Chi Nan University
Nantou Regional Network Center, Taiwan
Tony Wang
(tony.wang@packetx.biz)
Chief Executive Officer
PacketX Technology

2. Agenda
• 1. TANET’s challenge for security mechanism
• 2. SDN-based security supporting
infrastructure(I)
Network and Service bypass
• 3. SDN-based security supporting
infrastructure(2)
Netflow generation
2

3. Taiwan Academic Network (TANet) is a national
computer network for educational and research
purposes that was established in July 1980 by
various major universities and the Ministry of
Education (MOE).
3

4. Its main objective is to facilitate teaching and
research activities for schools and research
institutions of all levels nationwide in an effort
to share resources and provide opportunities for
cooperation.
4

5. Currently, the TANet environment is jointly
managed by the Ministry of Education, the
National Science Council and Academia Sinica in
order to provide schools of all levels with an
information infrastructure for application in the
areas of education, learning, and academic
research.
5

6. Network framework
1. Domestic backbone network
2. International backbone network
3. Inter-school network and external network
4. Wireless networks in school campuses
5. Security
6

7. More then ten years ago
TANet：Tree-tier Topology
4 Core Notes
22 City/County Network Centers
2.5 Gbps
10Gbps
1~4 Gbps
7
13 Regional Centers

8. 8
2016 – TANet 100G

9. TANET 100G
Topology
9

10. When throughput upgrade to 1G/10G/40G/100G
• A lot of existing devices have no 10G Port although
they still work well: Interface Speed only 1G ( Firewall,
IPS, IDS )
• Problem is….
We need to buy new security devices (10G/40G)
10

11. 10G/40G/100G security devices
is usually more expensive than routers and switches
while comparing the cost/bandwidth
11

12. Agenda
• 1. TANET’s challenge for security mechanism
• 2. SDN-based security supporting
infrastructure(I)
Network and Service bypass
• 3. SDN-based security supporting
infrastructure(2)
Netflow generation
12

13. TANET 100GRegion Network Center
Single point of failure
Single point of failure
Pitfalls
• Devices out of service
• Mini-Gbic failure
• Cable / Fiber failure
• Failed configuring
13
Previous Topology
IPS

14. TANET 100GRegion Network Center
All the traffic between TANET and
Region Network Center should
route to intrusion prevention
system(IPS).
IPS is the single point. The
connection is broken if IPS fails
14
Previous Topology
IPS
I0G or 1G I00G
I0G

15. SDN device
Bypass Switch
TANET 100G
IDS-1
IDS-2
IDS-3
IDS-4
IPS
Security Supporting Mechanism:
- Bypass switch
- Proprietary SDN device( L2-L7 support )
15
Region Network Center
New Topology

16. TANET 100G
Bypass Switch
In-Line Mode
When everything is fine …
Network packets pass through
the Bypass Switch, SDN device,
and IPS
16
Region Network Center
IDS-1
IDS-2
IDS-3
IDS-4
IPS

17. TANET 100G
Health Check
Bypass Switch
Bypass Switch should provide
health check in case any
element (including itself, SDN
device, IPS) malfunctions.
17
Region Network Center
IPS

18. TANET 100G
Health Check
Bypass Switch
When some troubles happen…
Health Check packets are lost
or delayed a lot(high latency)
18
Region Network Center
IPS

19. SDN
TANET 100G
When IPS can not sustain for the
network throughputs….
However, let’s consider 1080P/4K
YouTube video streaming:
• High bandwidth
• Low risk
[Service Bypass]
The SDN device directs YouTube
packets not to pass through
IPS/IDS…but loop back directly
IPS
19
Region Network Center

20. SDN
TANET 100G
The SDN device helps to reduce
IPS loading.
We could extend the period of
use for IPS
20
Region Network Center
IPS

21. 21
Packet Prism Mechanism
Distinguish YouTube packets from input Ethernet stream
Classification: (1) YouTube packets and (2) the other packets
1. Configuration: Input HTTPS/ YouTube signature (insert to Signature DB)
2. [Signature Matching] Check if the signatures can be matched in the input packet
payload. Learn the server IP of that packet if “matched” (insert to IP DB).
3. [IP address Matching] Identify the YouTube packets by server IP address
IP address
Matching
Signature
Matching
Signature DBIP DB
Not macted
Matched
Not Matched
Matched, to
Abstract the server IP
Output
1
Output
2
InputEthernet
Packet
Ethernet
Packet
Ethernet
Packet

22. SDN
TANET 100G
Load balance function
could direct traffic to a
few of IDS simultaneously
according to
- IP address
- Subnet
- 5-tuple hash
IPS
22
Region Network Center

23. SDN
TANET 100G
SDN device could
accurately deliver
different application
traffic to different
IDS(any out-of-band
analysis system).
This makes new
security testing or
forensics process
easier.
TEST LAB
IPS
23
Region Network Center

24. TANET 100G
IDS-1
IDS-2
IDS-3
IDS-4
SDN device can be the
monitoring infrastructure to
support both in-line security
(IPS)and out-of-band(IDS)
security service.
IPS
Bypass Switch
TEST LAB
Flexible Redundant
24
Region Network Center

25. Agenda
• 1. TANET’s challenge for security mechanism
• 2. SDN-based security supporting
infrastructure(I)
Network and Service bypass
• 3. SDN-based security supporting
infrastructure(2)
Netflow generation
25

26. TANET 100G
Bypass Switch
Flow Report
Server
Routers hardly support 1:1
non-sampling Netflow
generation. It is ok for
network management but
not ok for security.
26
Region Network Center

27. SDN
TANET 100G
In-Line Mode
Flow Report
Server
The SDN device analyzes
traffic and then generate 1:1
Netflow v9 for Flow Report
Server.
This helps to reduce router
CPU usage and improves the
security level
27
Region Network Center

28. TANET 100G
28
Region Network
Center
Region Network
Center
TANET 100G
Netflow Analyzer
• NetFlow V5/V9 generation
• Sampling rate 1:1
• Active Timeout 60 sec
• Passive Timeout 60 sec
NetFlow
Gen
NetFlow
(Sampling 64:1)
Netflow Analyzer
Filtering • L2-L7 filtering
• (remove low-risk traffic)
Port
Mirror
New NetFlow generation
architecture
Traditional NetFlow generation
architecture

29. SDN
TANET 100G
TAP Mode
Flow Report
Server
If IPS is out of service so that
Bypass Switch state is changed
to TAP mode, we still could log
1:1 traffic flow
29
Region Network Center

30. Conclusion
SDN-based Security Supporting
Mechanisms
– High Availability
– Load Sharing
– Cost Down
– Flexibility
30