Filip Kolář Major Account Manager F5 Networks, Inc 1

Transkript

1 Filip Kolář Major Account Manager F5 Networks, Inc 1

2 PARTNEŘI F5 F5 Networks, Inc 2

3 Růst dat Útoky z internetu Internet of Things: Int. traffic shaping Konsolidace L4-L7 bezpečnost DDoS ochrana Škálovatelnost IPv4/IPv6 ISP TRENDY F5 Networks, Inc 3

4 DoS = Denial of Service DDoS = Distributed Denial of Service znepřístupnění služeb cílovým uživatelům Policy Enforcement kontrola řízení přístupu do sítě pomocí inteligentního traffic shapingu DNEŠNÍ TÉMATA F5 Networks, Inc 4

5 POZICE F5 F5 Networks, Inc 5

6 TETRIS? F5 Networks, Inc 6

7 ...NE, PORTFOLIO F5 HYBRIDNÍ DDoS OCHRANA CLOUD SERVICE SILVERLINE Cloud DDoS ochrana ZAŘÍZENÍ V LOKALITĚ ZÁKAZNÍKA: Local Traffic Manager (LTM) Global Traffic Manager (GTM) Advanced Firewall Manager (AFM) Application Security Manager (ASM) BIG-IP Access Policy Manager (APM) BIG-IP Carrier Grade NAT (CGNAT) BIG-IP Policy Enf. Manager (PEM) TMOS irules EAL2+ EAL4+ (in process) F5 Networks, Inc 7

8 CLOUD DDoS ochrana Silverline Scrubbing Center Inspection Plane Inspection Toolsets Traffic Actioner Route Management Flow Collection Visibility Portal Tier 1 Signaling Management Legitimate Users DDoS Attackers Cloud Scrubbing Service Volumetric attacks and floods, operations center experts, L3-7 known signature attacks Switching Copied traffic for inspection BGP signaling Routing/ACL Netflow Switching Data Plane Netflow Proxy and Asymmetric Mitigation Tier Routing (Customer VRF) GRE Tunnel Proxy IP Reflection X-Connect Customer F5 Networks, Inc 8

9 DDoS F5 Networks, Inc 9

10 ISP TOP3 cíl pro DDoS útoky Source: F5 Networks, Inc 10

11 DDoS V MÉDIÍCH F5 Networks, Inc 11

12 DDoS V MÉDIÍCH F5 Networks, Inc 12

13 DDoS V CZ+SK MÉDIÍCH F5 Networks, Inc 13

14 Application SSL DNS Network Výhružný mail, který obdržel zákazník F5 TYPY DDoS ÚTOKŮ F5 Networks, Inc 14

15 ŮST PROVOZU 120, ,000 GLOBALNÍ INTERNETOVÝ PROVOZ VE FIXNÍCH SÍTÍCH [PB/MĚSÍC] EXP. 80,000 60,000 40,000 20,000 0 * F5 Networks, Inc Source: Cisco, The Zettabyte Era Trends and Analysis 15

16 TRUKTURA PROVOZU Klíčové prioritizovat viditelný provoz (http, video), který rozhoduje o uživatelské zkušenosti, před provozem na pozadí (P2P, filesharing,...) * F5 Networks, Inc Source: Sandvine 16

17 Mobilní vs. Fixní ISP ŮST PROVOZU F5 Networks, Inc 17

18 ZNALOST: Uživatel, Zařízení, Aplikace, Síť KONTROLA SÍTĚ A OPTIMIZACIE MONETIZACE SÍTĚ NTELIGENTNI TRAFFIC SHAPING F5 Networks, Inc 18

19 UŽIVATEL ZAŘÍZENÍ APLIKACE TYP SÍTĚ 2G 3G 4G GEO ZATÍŽENÍ ONTEXTY F5 Networks, Inc 19

20 GLOBALNÍ NÁHRADA CISCO SCE Overall P2P = 10 Mbps Uživatel Sub B P2P = 4 Mbps Sub A + B + C P2P = 10 Mbps PER-UŽIVATEL Gold Subscriber = 20 Mbps Uživatel Rest = 10 Mbps P2P = 4 Mbps Rest = 10 Mbps P2P = 512 kbps PRINCIP INTELIGENTNÍHO TRAFFIC SHAPINGU F5 Networks, Inc 20

21 Vestavění DB Webroot ~20M sitů irule whitelist/blacklist Custom DB 1. Trying to access blocked URL PGW/ GGSN RTR 3. Access Denied 2. Integrated Webroot URL Filtering / Blacklist Internet Kategorizace URL

22 L4 L DNS Firewall Policy Enforcement DNS POLICY ENF. L7 STEERING FW/DDOS/CGN L3/L4/L7 Steering CGNAT Dedicated platforms, different vendors HTTP HE Unified platform, L4 L7 consolidation Konsolidace síťových prvků F5 Networks, Inc 22

23 FW, NAT, DDoS ochrana, Inteligentní traffic shaping Attacker Internet Web Bot => Úspora investičních a provozních nákladů, jednodušší správa infrastruktury Konsolidace síťových elementů na jeden box F5 F5 Networks, Inc 23

24 Konsolidace core prvků F5 zákazníci - VoIP provider in Australia - Usecase - Broadband aggregation - F5 solution load balancer, bandwidth manager and firewall in one box - Traditional model dedicated boxes - Benefit for the customer - Costs savings - More than US$100,000 CAPEX, (alternative solution US$250,000) - Further savings on OPEX (maintenance, training) - Simpler troubleshooting - ISP (cable operator) in Israel - Usecase - Lack of IPv4 and Web cache servers loadbalancing - F5 solution - Traffic Steering (for web caches) and CGNAT - Benefits for the customer - NAT (IDM is able to NAT https traffic behind a specific IP subnet and treat this traffic uniquely.; high speed logging) - Costs savings for internet connectivity due to web caches - Network management improvement thanks to irules - We can seamlessly add a new cache in one click on the F5 platform. We don t have to change anything at the network level. This is definitely something we couldn t do before, says El Khoury. F5 Networks, Inc 24

25 MageMojo Webhosting DDoS ochrana a web aplikační firewall MageMojo is a webhosting provider in the U.S. with 2500 hosted websites Usecase - Cyber Monday, DDoS attack, outage for several hours - Requirements Attacks elimination, low latency and high performance, Network FW with PCI DSS - F5 solution DDoS, AFM ICSA certified FW for DC protection, WAF for L7 attacks, LTM for scalability Benefits for the customer - Cost savings of 70% thanks to the consolidated solution - In the end, Hileman says, we saved over 70 percent consolidating with F5 instead of buying all the individual components or going with a third-party mitigation service. - In comparison to other DDoS solutions, F5 includes the app security as well - Thanks to full proxy, the DDoS attack is discovered before reaching the app servers - Scalability of the VIPRION for season peaks (inet connectivity savings) - Comparable solution to the competition Even the base performance of a single blade is equal to the new connections per second of the largest firewalls at Cisco and Juniper, F5 Networks, Inc 25

26 Datametrix DC a Cloud Loadbalancing virtualních serverů, bezpečn s DC, autentiz ce uživ e ů, DR Datametrix is a Cloudu provider in Norway (Telenor s daughter company) Usecase - Requirements - LB of virtual servers, DC FW, system for subscribers authentication, Disaster recovery - F5 solution - 2xVIPRION 2400 chassis for DC, modules: Local Traffic Manager (LTM) to balance traffic across virtualised servers Advanced Firewall Manager (AFM) to filter incoming customer communications and DDoS Access Policy Manager (APM) to manage user authentication / SSO Global Traffic Manager (GTM), Virtual Edition, to balance traffic across its two datacentres and implement automatic fail-over in the event of a disaster. Benefits - Security, Availability, Scalability F5 Networks, Inc 26

27 Filip Kolář