*cisco global cloud index 2016. **statista global machine-to-machine (m2m) data traffic from 2014 to...

�� –�� Gigamon��

Simon Chien ��Gigamon � ��

3Confidential and Proprietary. For Internal Use Only. © 2015 Gigamon. All rights reserved.

• Gigamon ��• ��• �� (Security delivery platform) ��• �� • ��

��


Gigamon Quick Facts –4��+

3000+��/�

#

- $ 1'�56�

902

�3(

2004(IPO 2013)

81%Fortune 100�#�0.

~ 800�/��&

��7:�&=<

~25K>40% ��*.

%��!�>"9��8"�%)�,�#��',�;9��

Gigamon Vision


As of Q4 2015

� ��

©2016 Gigamon. All rights reserved.

ENTERPRISE SERVICE PROVIDERFEDERAL

TECHNOLOGY INDUSTRIAL RETAIL FINANCE HEALTHCARE AND INSURANCE


��

©2016 Gigamon. All rights reserved.

��

��


Gigamon �� – ��

!


�� – ��65432

Phishing &zero day attackHP"P %$

Back door0��I9�

Lateralmovement�=.� +

Datagathering :�-�DC

ExfiltrationMJ�="�5��9�

1

ReconnaissanceO�*�

*Trustwave Holdings, Inc. "2016 Trustwave Global Security Report." 2016. Accessed April 5, 2017.

**Verizon. "2016 Data Breach Investivation Report." 2016. Accessed April 5, 2017.

D��&4��6�>718*41%81

��,B��#N8'K*F�D��@�G=E��;Q)L**

89%8!3(<?�)�/��8AD��72*97%

http://go.trustwave.com/URzU0DM0lF0Rqs03gc000Zc

http://www.verizonenterprise.com/resources/reports/rp_DBIR_2016_Report_en_xg.pdf


��#��"� –�%�(��"�#�(� + �&�� + , ��"�� = #��%�' * + +)� + ��

*Cisco Global Cloud Index 2016.**Statista Global machine-to-machine (M2M) data traffic from 2014 to 2019 (in petabytes per month)

Time

Volu

me Network Data

Security Tool

#�!��$��&�#�(��

Data Center transition to 40~100Gb

Emergenceof Big Data

Internetof Things

Machine to Machine

4.7ZB of global data center traffic in 2016*

1.7PB of M2M traffic in 2017**

6.7 ns available to process a network packet on a 100Gb link


1 Source: Gartner “Predicts 2017: Network and Gateway Security”, December 13 2016.2 Source: SSL Performance Problems, NSS Labs3 Source: 2016 Trustwave Global Security Report

��.��'#- – SSL��3(��

>80% 2019��.��3�/080%1

33% #Malware$��"��3

SSL�3#�+5� �� %��2* (Internet servers, Cloud services)

80% SSL��3��.�,�#)!�&4�180%2

https://www.nsslabs.com/linkservid/13C7BD87-5056-9046-93FB736663C0B07A/%202013/

https://www2.trustwave.com/GSR2016.html?utm_source=redirect&utm_medium=web&utm_campaign=GSR2016


E��<5'F,�#C2&��5E�()�1.B-�O5E�C

��

GM�P��*��=�0%K>L%K�� J

�9HN8�;E��5*�1.L+P��

:60

/I@" /A� D��8Q�0�L7�1?��$

SSL��/I��=E��1.4!$

3


*Source: Gartner Data Center Infrastructure Operations and Management Conference, December 2016

��GARTNER � ADAPTIVE SECURITY ARCHITECTURE ��


�+�� '��$.(1#'!��

�^�V��O: B7EV��%bP$�,+,�1#!��4*��"��&)/ %��3�!�0

• 0fKXGh��( �-:�Jh)

• � !�A=(YT *[ST

• !��"RdA=�_MF?

• Q.�<*`I;A=F?�>\

• #�HA%L4�V1��X'A=F?

��&-*�!2�

• �#�U�a52�6&cKX

• @ZKeHDEV�/N�)8Cg

• V��]��9U�3��-��W

Internet

PublicCloud

User Behavior Analytics

Advanced Persistent

Threat

Email Threat Detection

SIEM

Next-Generation Firewall

Data Loss Prevention

SIEM




Advanced Persistent

Threat





Advanced Persistent

Threat

SIEM


Routers

“Spine”Switches

“Leaf”Switches

VirtualizedServer Farm


Internet

PublicCloud: AWS


Advanced Persistent

Threat


SIEM



SIEM




Advanced Persistent

Threat





Advanced Persistent

Threat

SIEM


Routers

“Spine”Switches

“Leaf”Switches

VirtualizedServer Farm

��26�K�/7D�MG?$4'�3�+),

��+H3�A�M�J��+H�$�;

Inline bypass .��E�%&0 ��A�

�9�"@=N�L9<> 9

��(38B#�1�M!�EC3I:-5�

E�C�*F�Security Delivery Platform

�� – ��LOOK INSIDE THE NETWORK

Security Delivery Platform: A foundational building block to effective security





Advanced Persistent Threat

SIEM


GigaSECURE® ��

ü �.��('�$ü "�!,(��*�)�

ü ��*�)��$

Legacy Approach Without Gigamon

Enterprise LAN

Security Tool Security Tool Security Tool Security Tool

IrrelevantTraffic

RelevantTraffic

With Gigamon Security Delivery PlatformSecurity Tool Security Tool Security Tool Security Tool

Enterprise LAN

RelevantTraffic

• &�-#+/�(• ��%�� (

• *()��$��


Tools & ApplicationsSecurity | Experience Management | Monitoring | Analysis

Any NetworkData Center and Private Cloud | Public Cloud | Service Provider Networks | Remote Sites

De-duplication

Slicing

FlowVUE®

MaskingGTP Correlation

Header Stripping

TunnelingSSL Decryption

Adaptive Packet Filtering

Application Session Filtering

NetFlow and Metadata Generation

VisibilityNodes

TrafficIntelligence

GigaVUE-FMOrchestration APIvCenterNSX Manager

Intelligent Visibility Public Cloud Virtual Traffic Aggregators Network TAPs

Flow Mapping® Clustering Inline Bypass GigaStream®

API


• In-Line Bypass��• IPv4/IPv6� Netflow��• Inline SSL ��

��


In-Line Bypass /+8�D,*":�41;-$��F

SiSi SiSi

Firewall1

Switch x 2

Switch x 2

Switch x 2

IPS1

WAF1

Firewall2

IPS2

WAF2

:�5�B41;E��<)

��:�5-7�, �� /.?5, (#�0, ��31;=�C

��:�5�F�3��1;=��A

��5'6!, �B��@=�-%>�'6, �3'6!1;=�� 22-�A

Active-Standby &9��

InlineBypass


Use Case�In-Line Bypass �DA�#<=��>/�A�=9B73, �N

SiSi SiSi

Firewall1

Switch x 2

Switch x 2

Switch x 2

IPS1

WAF1

Firewall2

IPS2

WAF2

JA�?��)E, "(.1�G

��A�?�3@ , �%�/4H?�, 2*�6, ��L9BE

A�#<9B�I0GF:;K9BM�;�

$��! Inline, '! Out-of-Band, Flow-based ?�& GigaSECURE®��O+-

5�A�C8+-

SiSi SiSi

heartbeats

heartbeatsheartbeats

heartbeats

10G10G

WAF IPSFirewall1 Firewall2

InlineBypass


Use Case�In-Line Bypass �+�#;�9�C/�37; ��8'�;�73<1,&��F

SiSi SiSi

Firewall1

Switch x 2

Switch x 2

Switch x 2

IPS1

WAF1

Firewall2

IPS2

WAF2

>�(B�0A);��6,(B�2?%�;�9�,

>4E��+*

��,�5�B�:�#Inline;�9��"-.; ��3(B, @� 3;�C/��$

SiSi SiSi

heartbeats

heartbeatsheartbeats

heartbeats

10G10G

WAF IPSFirewall1 Firewall2

InlineBypass

TA/HC1

��out of band��

��Inline��

��

�3��A�InlineD!�$�out of band-.+=


NetFlow 1:1o�, � - “/q:7” U�I:• ^S�_Netflow��@�'>T+UZ�GyC�U(Gb*�i �t�DH)VI

• �Gy�#WNetflowUf��w0��. (End-to-End) k$|X�>;��IC&C�aYphs`dK

• c�SIEM,%1NetFlow]g{j*��>\�u��b!��=o�6��NetFlow v5/v9/IPFIX59/�@i

• �QP!BMetadatak<SIEM�@*��IT+ME

N>32:• Router/SwitchesQP"yNetFlow[zr0i vn• 4B(Sampling) UNetFlow[zLFJlk$�@�R• x�Router/Switch �86NetFlowo�• �RNetflow]g*�9_mGyQ�NetflowLFw��_�}A"�i �0?O~

Without Gigamon With Gigamon

Use Case��_Netflow/IPFIX�Metadata P0ROUTER/SWITCHLFQP��}eUNETFLOW�&��=o�b!��NETFLOW V5/V9�IPFIXU59/�@*�i

ApplicationPerformance

Network Performance

Security

Production Network Tools and Analytics

NetFlow Records

N

N

N

ApplicationPerformance

Network Performance

Security

Production Network Tools and Analytics

NetFlowGeneration


* Planned

Netflow / IPFIX�Metadata �"

*#HTTP. �%!DDOS�� 4+(��/��

HTTP Response Codes

DNS transactions�%!��&�"C&C��4)8��

DNS Discovery*DNS

C&C

Bots

� HTTPS certificates �%!$��1�"

HTTPS Certificate Anomalies*

7,Kerberos 21-DHCP05�6�)8�', IP (hostname and IP)

-��3��

Mapping User, Hostname & IP Address*

Metadata

User

Machine IP

NetFlow / IPFIXGeneration

Any forward-looking indication of plans for products is preliminary and all future release dates are tentative and subject to change.


SSL/TLS ��CPU�� Gigamon��GS��

SSL�;��&*�)�21�� SSL / TLS �;�&*

Web Proxies Or Firewalls

• -C4A�;�$6/�• �6�Proxy"FW7�0�.,��0

SSL Decryptors

• -C�G4A�.3B��-C• �#��%8�H�!(E• .,��<�bypass�=? 9

Decryptor

InlineTool(s)

L7 Load Balancers

• Config/script<�+:F��'5@�'�D

• 7><�8�#��.,�Bypass

Inline Tool(s)FW Proxy


APF/ASF

Metadata

��

��

�� metadata �� SIEM � UBA

SSL�0GigaSMART®�� /�� .�4��82��#;+:1'�6"7��5�*#;�,%

SSLDecryption

Virtu

al GigaVUE-VM

GigaVUE-VM

Tunnel Termination

��Flow Mapping®,+:<34�*;�2$��9& (Adaptive packet filtering) ��)(Netflow0��*Metadata-��!01'

Phys

ical

FlowMapping®

User Behavior Analytic

s


Any forward-looking indication of plans for products is preliminary and all future release dates are tentative and subject to change.

Use Case�SSL ��OUT OF BAND�IN-LINE�� Encrypted Traffic Decrypted / Unencrypted Traffic

Internet Servers

Corporate Servers Clients

NGFW

IPS

NetworkForensics

Anti-malware

Active, InlineAppliance(s)

Passive, Out-of-BandAppliance(s)

• Corporate servers• �� server keys• RSA key exchange• Gigamon ��2014� Out of band�

1

• Corporate servers• Diffie-Hellman (DH) key exchange• Emerging TLS 1.3 standard•�� inline �� SSL�

2

• Internet Servers or SaaS services•�� Internet server keys•�� inline �� SSL�

3

?

Clients

Internet

1 RSA 2 DH, PFS

3 RSA/DH


Inline Tool 1E.g. IPS / Firewall

SSL �+�%� '�(-.!/��-�

Out-of-Band ToolE.g. SIEM

SSL SessionLeg 1

(encrypted)

SSL SessionLeg 2

(encrypted)

1

2

2

3Encrypted trafficDecrypted traffic

Inline Tool 2E.g. Anti-malware

4

Highlights• �,Servers/clients ��1��1• �3*�Private keys�+�• &��#RSA, DH, PFS

• ��inline'out-of-band��,

� $0 �Bypass�-.�(�'��2�)�Heartbeat�"


�� POC��

Challenge:


Without Gigamon

Use Case: �)(#��0'$PoC�1�-�%�!��*��"�" !.��/��*��!�&3,�+

��*��1��3,�+ ��*��"" !.� �2��+�1

With Gigamon

POC #1 – Vendor X Tool POC #2 – Vendor Y Tool POC #3 – Vendor Z Tool

1 month 2 month 3 month

POC #1Vendor XTool

POC #2Vendor YTool

POC #3Vendor ZTool

1 month 2 month 3 month

Tool tested w/ NWSegment – 4 weeks

Tool tested w/ same NWSegment – 4 weeks

Tool tested w/ same NWSegment – 4 weeks


�� ( ��)

Challenge:


1. 6�()+ �=��0�� (VM)*?2. VM&�;�7�7> (VDI&'1)3. VM-VM :&!9�3�#6��=2�4. �0��40�6��&6"/�-

5. V-motion�, �5<2.��,�3�()

Virtual Visibility: 0�%��3�$ 825 ��

HYPERVISOR

SERVER

VIRTUALIDS VM1

VIRTUAL ANTI-

MALWARE

VIRTUALAPM VM

HYPERVISOR

SERVER

GigaVUE-VMIDS

ANTI-MALWARE

APM

LEGACY APPROACH MODERN APPROACH


OS

DB

DB Server

Leaf

Core Core

Leaf Leaf

Spine

Leaf

Spine

D'8�3U�I� : GigaVUE-VMLIGHTWEIGHT VM�Z��;NFV013U(Y

�� APM

�� NPM

��

��

GigaVUE-VM • Flow Mapping™

• $VM�tcp/udp�PEQ6• ��G�• �OR,�N��L�

��• �XTH��• ) M+SA• Source Port2>• F[=X

• -V"K• !97�Q6• NetFlow Generation• SSL��J�

NetworkTunnel Port

Tunneling

DB

GigaVUE-VM andGIgaVUE® Nodes

#.�/� C?@(��4[�:;*&�,��WB�/��%\�WB�/5<�


��


• [@%!"�V!��iMNO(IPS))e�J+j�7T�a�• lX1_LIPSY��:l64Bypass�]D�• g'I;Firewall�IPS�T2 Inline Bypass��:n64h&(Mirror)�

(Intranet)U#(Internet)LPbFf2 1GPb�mLWebsense�>• l�S$BQb'$�(�Y��`�J• POCGZY�:HE�<

– A-3��Mirror Portd$HE^W– @�GZY�.nInline��Q:\8Qbc/9Q– GZY�K*HE�:0k

=,RGigamon?C� 5�o


��Gigamon��


��Gigamon��

Catalyst 2960 Plus Series PoE-8

PoESPEEDDPLXSTATRPSSYST

MODE

1 2

1X

2X

11X

12X

POWER OVER ETHERNET

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

13X

14X

23X

24X

CONSOLE

MODE

STAT DUPLX SPE ED STACK

SYS T ACTV XPS S-PWRUIDCatalyst 3850 XS 10G SFP+

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

MODE

STACKSPEEDDUPLXSTATMASTRRPSSYST

1 2 3 4 5 6 7 8 9 10 11 12

1X

2X

11X

12X

13 14 15 16 17 18 19 20 21 22 23 24

13X

14X

23X

24X

Catalyst 3750 SERIES

1 2

Catalyst 2960 Plus Series PoE-8

PoESPEEDDPLXSTATRPSSYST

MODE

1 2

1X

2X

11X

12X

POWER OVER ETHERNET

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

13X

14X

23X

24X

CONSOLE

MODE

STAT DUPLX SPE ED STACK

SYS T ACTV XPS S-PWRUIDCatalyst 3850 XS 10G SFP+

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

MODE

STACKSPEEDDUPLXSTATMASTRRPSSYST

1 2 3 4 5 6 7 8 9 10 11 12

1X

2X

11X

12X

13 14 15 16 17 18 19 20 21 22 23 24

13X

14X

23X

24X

Catalyst 3750 SERIES

1 2

(1)(2)

(3)

��Active

6509Active

FANSTATUS

C6509-E-FAN

1

2

3

4

5

6

7

8

9

WS-C6509-E

1

FANOK

OUTPUTFAIL

2

INPUTOK

SWITCH MUST BE IN OFF “O” POSITION TO INSTALL/REMOVE POWER SUPPLY. FASTENER MUST BE FULLYENGAGED PRIOR TO OPERATING POWER SUPPLY.

CISCO SYSTEMS, INC.

INPUT 2100-240V ~16A60/50 Hz

INPUT 1100-240V ~16A60/50 Hz

INSTALL

RUN

1

FANOK

OUTPUTFAIL

2

INPUTOK


CISCO SYSTEMS, INC.

INPUT 2100-240V ~16A60/50 Hz

INPUT 1100-240V ~16A60/50 Hz

INSTALL

RUN

STATUS

PHONE

WS-X6148-RJ-21V

37 38 39 40 41 42 43 44 45 46 4847363533 3431 3229 3027 2825 26242321 2219 2017 1815 1613 1412119 107 85 63 41 2

STATUS

PHONE

WS-X6148-RJ-21V

37 38 39 40 41 42 43 44 45 46 4847363533 3431 3229 3027 2825 26242321 2219 2017 1815 1613 1412119 107 85 63 41 2

STATUS

PHONE

WS-X6148-RJ-21V

37 38 39 40 41 42 43 44 45 46 4847363533 3431 3229 3027 2825 26242321 2219 2017 1815 1613 1412119 107 85 63 41 2

WS-SUP720-3BXL

SUPERVISOR 720 WITH INTEGRATED SWITCH FABRIC/PFC3BXL

SYSTEM

STATUS

ACTIVEPWR

MGMT EJECT

DISK 0

EJECT

DISK 1

CONSOLE PORT 2

PORT 1

LINKLINK

LINK

RESET

3850Active

3750GActive

GigamonActive

FirepowerActive

��Backup

6509Backup

3850Backup

3750GBackup

FANSTATUS

C6509-E-FAN

1

2

3

4

5

6

7

8

9

WS-C6509-E

1

FANOK

OUTPUTFAIL

2

INPUTOK


CISCO SYSTEMS, INC.

INPUT 2100-240V ~16A60/50 Hz

INPUT 1100-240V ~16A60/50 Hz

INSTALL

RUN

1

FANOK

OUTPUTFAIL

2

INPUTOK


CISCO SYSTEMS, INC.

INPUT 2100-240V ~16A60/50 Hz

INPUT 1100-240V ~16A60/50 Hz

INSTALL

RUN

STATUS

PHONE

WS-X6148-RJ-21V

37 38 39 40 41 42 43 44 45 46 4847363533 3431 3229 3027 2825 26242321 2219 2017 1815 1613 1412119 107 85 63 41 2

STATUS

PHONE

WS-X6148-RJ-21V

37 38 39 40 41 42 43 44 45 46 4847363533 3431 3229 3027 2825 26242321 2219 2017 1815 1613 1412119 107 85 63 41 2

STATUS

PHONE

WS-X6148-RJ-21V

37 38 39 40 41 42 43 44 45 46 4847363533 3431 3229 3027 2825 26242321 2219 2017 1815 1613 1412119 107 85 63 41 2

WS-SUP720-3BXL

SUPERVISOR 720 WITH INTEGRATED SWITCH FABRIC/PFC3BXL

SYSTEM

STATUS

ACTIVEPWR

MGMT EJECT

DISK 0

EJECT

DISK 1

CONSOLE PORT 2

PORT 1

LINKLINK

LINK

RESET

GigamonBackup

FirepowerBackup

Internet

(4)


�� In-Line ��

Edge Switch

LLB

Firewall

Firewall

Core Switch

Core Switch

CISCO Firepower

SPAN

SPAN

(1)

(2)

(3)(4)


• Y�2_0=f�– SX^$Y�8Vi2_�lN �– IY�7g:h<��De�W�Bypass� Q`c��,k– HMap Rule�G>C%De`.�� ;10GbDe�VH4Gb8V�Y��#�

• &�'��'!"R`JDeKadIPSY�• �'!JhttpbRKadWebsenseY��AF

• m(+/– �3��j��iB+/�5 H@*�E]– �6MiB�[9��Y�7g6M(Fail Open�Fail Close)– Y�FZ�P\��O�:R�4�?�1Tc�08

Gigamon)U-8L


��$�)��!;.!6I�0,K�>=7��

� A/

+�)��!�,K6IG-�F$1

��* (��B%��J?�!#�D�+

?5��

�-��)��+&(A�N8EP�C�9�)

��%��D�� !8EC��'�2�O

+�,#�&"�'��B%�Q8E�<"8E�M4

8ED�L3�:�*

�@��H�0$1


#wefightsmart

*cisco global cloud index 2016. **statista global machine-to-machine (m2m) data traffic from 2014 to...

Documents