Modularized Bypass Protector Bypass TAP and Ethernet TAP for
SpecFlow Policy
1.Overviews
With the rapid development of the Internet, the threat of network
information security is becoming more and more serious, so a
variety of information security protection applications are used
more and more widely. Whether it is traditional access control
equipment (firewall) or a new type of more advanced protection
means such as intrusion prevention system (IPS),Unified threat
management platform (UTM), Anti-denial service attack system
(Anti-DDoS), Anti-spam Gateway, Unified DPI Traffic Identification
and Control System, and many security devices are deployed in
series in the network key nodes, the implementation of the
corresponding data security policy to identify and deal with legal
/ illegal traffic. At the same time, however, the computer network
will generate a large network delay or even network disruption in
the case of fail over, maintenance, upgrade, equipment replacement
and so on in a highly reliable production network application
environment, users cannot stand it.
Real Product Picture
- with 1*10G modular +1*40G modular +1*100G monitoring module
- The first and second slot can insert bypass modular, the third
slot insert monitoring modular bypass
- Customer can choose 10G/40G/100G bypass/monitoring modular
flexibly as they need
Monitoring module:MON-MOD-L16XG with 16*10G monitoring ports
10G bypass configuration
100G bypass module configuration
2. Main Features
Wire speed-Inline-protecting
Inline protect based on specific traffic (ACL)
Multiple-Link Protector；
Bypass switch lower delay(8ms)；
Custom-format heartbeat packet checking；
Service-Level Healthy-checking
Load-balance inline deployment
Support multiple security inline device protect
Vlan-TAG/TRANSLATE /untagged support
Remote & local management ；
Dual-Power / DC/ AC support
Modularize design : flexible support 10G/40G/100G by replacing
bypass module
BYPASS MODULE
| BYP-MOD-L2XG | BYP-MOD-L1CG | BYP-MOD-L1QXG |
| Links supporting | 2*10G links inline bypass module | 1*100G links inline bypass module | 2*40G links inline bypass module |
| Maximum module number inserted in a Chassis | 2 unit | 1 unit | 2 unit |
MONITOR MODULE
| MON-MOD-L16XG | MON-MOD-L8XG | MON-MOD-L2CG | MON-MOD-L8QXG |
| Monitor ports | 16 * 10G monitoring ports | 8* 10G monitoring ports | 2 * 100G monitoring ports | 8*40G monitoring ports |
| Maximum module number inserted in a Chassis | 1 unit | 1 unit | 1 unit | 1 unit |
3. NetTAP® Intelligent Bypass Swtich Application Solution
NetTAP® Bypass TAP Protector “SpecFlow” Policy Flow Traction Series
Protection
As shown above, when the security network device only needs to deal
with the specific traffic in series security protection,through the
NetTAP "bypass Protector" traffic per-processing function, through
the traffic screening strategy to connect the security device "
Concerned "traffic is sent back directly to the network link, and
the" concerned traffic section "is traction to the in-line safety
device to perform safety checks. This will not only maintain the
normal application of the safety detection function of the safety
device, but also reduce the inefficient flow of the safety
equipment to deal with the pressure; at the same time, the "bypass
protector" can detect the working condition of the safety device in
real time. The safety device works abnormally bypasses the data
traffic directly to avoid disruption of network service.
The NetTAP® Traffic Bypass Protector can identify traffic based on
the L2-L4 layer header identifier, such as VLAN tag,source /
destination MAC address, source IP address, IP packet type,
transport layer protocol port, protocol header key tag, and so on.
A variety of matching conditions flexible combination can be
defined flexibly to define the specific traffic types that are of
interest to a particular security device and can be widely used for
the deployment of special security auditing devices (RDP, SSH,
database auditing, etc.).
NT-MBYP-CHS Bypass Switch.pdf
