Modularized Bypass Protector Bypass TAP and Ethernet TAP for SpecFlow Policy

Modularized Bypass Protector Bypass TAP and Ethernet TAP for SpecFlow Policy

1.Overviews

With the rapid development of the Internet, the threat of network information security is becoming more and more serious, so a variety of information security protection applications are used more and more widely. Whether it is traditional access control equipment (firewall) or a new type of more advanced protection means such as intrusion prevention system (IPS),Unified threat management platform (UTM), Anti-denial service attack system (Anti-DDoS), Anti-spam Gateway, Unified DPI Traffic Identification and Control System, and many security devices are deployed in series in the network key nodes, the implementation of the corresponding data security policy to identify and deal with legal / illegal traffic. At the same time, however, the computer network will generate a large network delay or even network disruption in the case of fail over, maintenance, upgrade, equipment replacement and so on in a highly reliable production network application environment, users cannot stand it.

Real Product Picture
- with 1*10G modular +1*40G modular +1*100G monitoring module
- The first and second slot can insert bypass modular, the third slot insert monitoring modular bypass
- Customer can choose 10G/40G/100G bypass/monitoring modular flexibly as they need

Monitoring module:MON-MOD-L16XG with 16*10G monitoring ports

10G bypass configuration

100G bypass module configuration

2. Main Features

Wire speed-Inline-protecting

Inline protect based on specific traffic (ACL)

Multiple-Link Protector；

Bypass switch lower delay(8ms)；

Custom-format heartbeat packet checking；

Service-Level Healthy-checking

Load-balance inline deployment

Support multiple security inline device protect

Vlan-TAG/TRANSLATE /untagged support

Remote & local management ；

Dual-Power / DC/ AC support

Modularize design : flexible support 10G/40G/100G by replacing bypass module

BYPASS MODULE

MONITOR MODULE

3. NetTAP® Intelligent Bypass Swtich Application Solution​

NetTAP® Bypass TAP Protector “SpecFlow” Policy Flow Traction Series Protection

As shown above, when the security network device only needs to deal with the specific traffic in series security protection,through the NetTAP "bypass Protector" traffic per-processing function, through the traffic screening strategy to connect the security device " Concerned "traffic is sent back directly to the network link, and the" concerned traffic section "is traction to the in-line safety device to perform safety checks. This will not only maintain the normal application of the safety detection function of the safety device, but also reduce the inefficient flow of the safety equipment to deal with the pressure; at the same time, the "bypass protector" can detect the working condition of the safety device in real time. The safety device works abnormally bypasses the data traffic directly to avoid disruption of network service.

The NetTAP® Traffic Bypass Protector can identify traffic based on the L2-L4 layer header identifier, such as VLAN tag,source / destination MAC address, source IP address, IP packet type, transport layer protocol port, protocol header key tag, and so on. A variety of matching conditions flexible combination can be defined flexibly to define the specific traffic types that are of interest to a particular security device and can be widely used for the deployment of special security auditing devices (RDP, SSH, database auditing, etc.).

NT-MBYP-CHS Bypass Switch.pdf