40GE 100GE Links Network Packet Broker 3.2Tbps Data Exchange Visibility Strategy

40GE 100GE Links Network Packet Broker 3.2Tbps Data Exchange Visibility Strategy
 

What is Network TAPs?

Network TAPs are stand-alone tools that connect in-line to network links. They are independent to the switch and are installed in-line between switches and routers or firewalls. A TAP passes all the traffic it sees in both directions directly into the network and also makes a mirror copy of the traffic to output to network tools. TAPs are available in varying port configurations to accommodate small business all the way up to multi-site global networks. Also, because TAPs are independent of the network equipment, they can be configured to allow network tools to manipulate and inject packets into the live network. So, for security applications, TAPs can connect tools that have the capability to predict, detect and prevent malicious attacks. TAPs also include failsafe technology that keeps network traffic flowing even in the event of a power failure.

Live network traffic passes through the TAP, directly into the active tool and back into the network in real time. This allows the tool to analyze the traffic, manipulate packets, stop suspicious packets and take immediate action on the link to block malicious traffic. These tools include Active Firewall and Intrusion prevention systems (IPS/NGFW). The TAP in the active stack has unique bypass technology that sends a heartbeat to the active tool. If the tool goes off line for any reason, the TAP can bypass the tool keeping live network traffic flowing. When the heartbeat returns, traffic automatically returns to normal operation flowing through the tool. Managing and protecting network infrastructure and information requires focus. Each of these devices specializes on a very tight functional range. The example above is by no means a complete list of network monitoring, management and security tool options. There are many purpose built tools for applications such as Data Loss Protection (DLP), Customer Experience Management (CEM), and Identity Access Management (IAM). A simple web search will turn up a wide variety of devices that can be added to these links based on specific threats or required analysis. Having a multiple port TAP foundation allows tools to easily and safely be added, repurposed or changed depending on the immediate needs of the network. There is a logical step by step flow when developing a visibility strategy; access, capture, analyze, secure and remediate if necessary. Ideally, if the right strategy and tools are in place along with other organizational influences to be discussed later, the remediation step will hopefully not be required. However, as is often said, plan for the best but prepare for the worst.

 
Matrix-TCA-CG is a network data visualization control device for high density and large flow of 10G/40G/100G.
Matrix-TCA-CG is specially designed for the data collection of 10GE 40GE and 100GE links distributed intensively in operators mobile Internet export, IDC export, provincial network and backbone.
Based on ATCA standard architecture, MATRIX-TCA-CG has high carrier-level reliability and strong expansibility which can smoothly configure the functional board CARDS to cope with port demand scenarios of various specifications and sizes.

The NTCA-CHS-7U7S is a 7U standard rack height. The chassis adopts the horizontal slot service slot mode. The device supports a total of seven slots, including two switching slots and five service slots. Each slot provides 300W cooling capacity, the chassis uses a pull-type cooling air duct to provide good heat dissipation performance for the whole machine. The backplane adopts a dual-star architecture, providing 200Gbps full-duplex interconnected channels in each switch slot to the service slot. Fully equipped with two switch cards can achieve 400G backplane bandwidth per service slot.

The NTCA-CHS-16U14S is a 16U standard rack height. The chassis adopts the horizontal insertion service slot mode. The whole machine supports 14 card slots, including 4 switching slots and 10 service slots. Each slot provides 300W cooling capacity, the chassis uses a pull-type cooling air duct to provide good heat dissipation performance for the whole machine. The backplane adopts a dual-star architecture, providing independent 100Gbps backplane bandwidth for each switch slot to the service slot. Fully 4 switch cards can provide 400G backplane cross-board bandwidth application per service slot.

100G Data Acquisition, Data Capturing and Switch Service Card/Module

Card Interface

Service interface:10*QSFP28 100G(compatible with 40G)interface
Management interface:1*RJ45 interface
CONSOLE interface:1*RJ45 interface
BASE interface:13*1000Minter-board communication interface
FABRIC interface:12*100G Service data dedicated transmission interface
IPMC interface:1*RJ45 interface

Card Function and Features

NT-TCA-SCG10 has built-in high-performance large-capacity data processing ASIC chip, which can complete business data aggregation and data exchange and data exchange up to 3.2Tbps. 

Main Business Features:

1- 10 QSFP28 type 100G Ethernet interfaces on the front panel, which can complete 100G/40G link splitting and mirroring input or 100G/40G service traffic aggregation and split output.
2- Up to 12 100GBASE-FABRIC service data transmission switching channels provide high-performance transmission for cross-board data exchange services between service slots
3- Provides up to 64G inter-board communication exchange capability for inter-board communication BASE, providing unified real-time communication support for system operation and management.
4- Supports NT-TCA-RTM-CG10 rear panel interface expansion card, and expands an additional 10 QSFP28 type 100G Ethernet interfaces. The expansion interface can also complete 100G/40G link acquisition or split output.
5- The flexible multi-group field matching filtering policy rules are used to establish black and white lists of traffic that are of interest to users, and to flexibly combine and use them to filter and output business data as needed. The multi-group field covers the standard fields of the packet stream, such as five-tuple, physical port, MAC address, vlan, and L3/L4 protocol domain.
6- Based on the user-defined field (UDF) filtering rule matching, the UDF custom domain can support a custom match of 128 bytes before the message. Typical applications can be used to filter HTTP GET/POST packets, tunnel-based packet key segment matching, etc.
7- High-capacity accurate field matching rules up to 128K, providing users with independent packet filtering support for independent IP/MAC/L4PORT fields.
8- Unified policy cross-board multicast output. Based on the unified management of the aggregation and distribution services of the whole machine, it can directly support the inter-board service policy to configure multicast multi-port replication, traffic distribution, and load balancing output.
9- Flexible management interface support. This board is used as an election master to manage the configuration, delivery, and execution of all board policies of the entire machine, and provides users with a unified configuration management interface. The system supports command line-based CONSOLE/TELNET/SSH management, and supports graphical-based HTTP/WEB configuration management interface, which greatly reduces the threshold for engineering implementation configuration and the requirements for post-system operation and maintenance.
10- Unified board management software version. All service cards and switch cards use the same software version, and the main control card automatically updates and upgrades the software version, greatly improving the user's upgrade and maintenance efficiency.

Network Packet Broker Specification and Module Type