DefensePro x420 Page 1

DefensePro x420

Technical Note

DefensePro Product Management

DefensePro x420 Page 2

Table of Contents

1 The Urging Need for High Performance............................................................................................ 2

2 DefensePro x420 ............................................................................................................................... 3

2 DefensePro x420 Layers of Defense ................................................................................................. 4

3 Hardware Platform Designed For Attack Mitigation ........................................................................ 5

4 Multi-Tenancy ................................................................................................................................... 6

The Urgent Need for High Performance The current natural growth of the Internet and the forecasted staggering increase in traffic calls for

infrastructure to support robust, high-throughput attack-mitigation capabilities. Now, more than ever,

organizations are obliged to support highly available, secure services and meet rising throughput

demands.

The requirement to support highly available, secure services and meet rising throughput demands is

manifested in the following main scenarios:

Carriers—Carriers are required to provide their customers reliable and secure services while being

able to scale easily to meet demands.

MSSPs—MSSPs are required to process more simultaneous attacks, which are higher in volume as

attackers’ capabilities improve.

Online Businesses—Online Businesses are required to provide available service for more users while

ensuring that high-volume attacks do not significantly reduce the availability of their main income

source.

The requirements arising from these scenarios raise the following considerations for the design of an

attack-mitigation hardware platform:

Scalability—Scalability must be achieved through an easy procedure, because today’s requirements

are bound to grow relative to many parameters. Any platform design must meet today’s

requirements while allowing scaling when requirements change.

Attack mitigation capacity—Attack mitigation capacity must meet the attackers’ growing

capabilities—today’s and tomorrow’s. Attack mitigation must allow legitimate traffic to continue to

flow uninterrupted.

Multi-tenancy—Multi-tenancy must be considered, because providers are required to serve an

increasing number of customers, and because the network architectures continue to become more

complex.

DefensePro x420 Page 3

Figure 1: Key Design Considerations

DefensePro x420 The DefensePro x420 platform is designed to meet high-throughput requirements stemming from

increased volumes of legitimate traffic as well as attacks.

With an industry-leading 25-MPPS attack-mitigation capacity, the x420 platform is designed for high-

throughput processing and high-volume attack mitigation.

Table 1 Main Performance Metrics

Metric X412 X420

Capacity 14 Gbps 40 Gbps

Throughput 12 Gbps 36 Gbps

Maximum attack mitigation capacity 10 MPPS 25 MPPS

HTTP challenges/second 520 K 1,040 K

DNS challenges/second 2.2 M 4.4 M

The DefensePro x420 platform uses Radware’s software throughput-license model. Available licenses

range from 10G – 40G in 10G steps. This successful model provides customers a gradual scaling process

without the requirement for costly and operationally complicated hardware changes.

DefensePro x420 Page 4

DefensePro x420 Layers of Defense Threats can be categorized into different layers that typify different “natures” of attack behavior.

Therefore, the protection strategy must also be constructed with multiple layers of security

technologies, which effectively analyze and repel each of the threats.

DefensePro APSolute Attack Prevention includes the following layers of defense:

First layer: Network-based Protection—protects against DoS/DDoS flood attacks.

Second layer: Application-based Protection—protects against server-resource misuse and server

cracking.

Third layer: User-based Protection—detects infected clients and prevents the spread of the client

malware.

Fourth layer: Stateful Signature-based Protection—protects against known attack vulnerabilities.

The DefensePro x420 hardware platform design is specifically suited to the layered approach. Each layer

is handled by a suitable hardware component.

The following diagram illustrates the layered hardware design.

Figure 2: Hardware Platform Designed for Attack Mitigation

DefensePro x420 Page 5

Hardware Platform Designed for Attack Mitigation The DefensePro x420 platform retains, and even improves upon, the benefits of previous DefensePro

platforms. The DefensePro x420 platform houses an industry-leading DoS Mitigation Engine, capable of

25-MPPS attack mitigation. Compared with other security solutions, what is different about this engine

is the fact it is facilitated by a dedicated ASIC; the attack-mitigation capacity does not affect the capacity

for the processing of legitimate traffic.

Figure 3: Attack size does not affect legitimate traffic processing

For the more deterministic types of threats—such as known application-vulnerability–exploitation

attacks in which a signature is already available, DefensePro provides a proactive security-update

service, which automatically downloads recent attack signatures to the system’s attack database.

DefensePro inspects incoming and outgoing traffic and compares each packet in real-time to the

signatures in the database, while adding minimal latency.

Radware’s hardware accelerated String Match Engine is used for this purpose.

The String Match Engine is a ASIC-based solution capable of multi-gigabit L7 (application layer), deep-

packet, full-content inspection. This includes inspection for attack signatures that span across multiple

packets (that is, supporting cross-packet inspection) or attack signatures that can only be written

through regular expressions to avoid false positives or false negatives.

DefensePro x420 Page 6

Multi-Tenancy Along with the increase in traffic is the requirement to enable shared tenancy, both in the service

provider scenario and in the carrier scenario. This has been considered in the hardware design.

DefensePro x420 supports a set of increased capabilities, allowing for multiple tenants to share a single

platform, as follows:

From policies to specific protection profiles, x420 supports increased capacity and is equipped with

separate processing capabilities per tenant.

The DefensePro management system has added role-based access-control capabilities to enable

view permissions and management permissions per policy. This lets providers limit customer access

(for monitoring and management) only to resources relevant to the relevant customer.

Monitoring capabilities have been enhanced to support traffic monitoring at the network policy

level.

Historical reporting and event management systems support user-based access control,

personalized dashboards, reports, and monitors.