P-Series (Security Appliance)
Overview
P-Series Overview
High Performance Traffic Inspection, Monitoring, and Capture at 10 Gbps
The Force10 P-Series 10 GbE inspection appliance is the first to deliver comprehensive deep packet inspection for line-rate 10 GbE applications. Based on patented Dynamic Parallel Inspection (DPI) technology, the P-Series uses an innovative, new processing architecture to simultaneously apply thousands of rules to each packet. Through the use of an FPGA-based rule engine, the P-Series can also dynamically reprogram hardware rules to deliver predictable performance and total signature flexibility under all traffic conditions.
Using an open framework, the P-Series supports Open Source and customizable network monitoring applications, enabling users to specify capture and filtering policies from public domain signatures, standard network monitoring libraries, or user-defined custom rule bases.
Key P-Series Applications
- High speed programmable network probe delivers inspection and flexible capture rules for lawfully authorized electronic surveillance and CALEA applications
- 10 GbE stateful filtering applications
- Pre-processing and filtering capabilities to scale existing solutions to 10 GbE in the core or at the WAN edge
- Open application program interface for creating custom line-rate monitoring, packet capture, and network security applications
Key P-Series Features
- Line-rate 10 GbE deep packet inspection with support for jumbo frames and LAN or WAN PHY
- Ethernet Frame Deencapsulation (EFD) removes 802.1Q or MPLS headers and passes the raw Ethernet frame with a correct CRC through to devices that cannot understand the encapsulated frame
- Up to 16 Virtual Network Interfaces (VNIs) that support parallel and independent Layer 3 - 7 rules for different filtering or analysis applications
- Dynamically write rules directly into hardware for greater flexibility in responding to malicious traffic and line-rate performance regardless of traffic conditions or number of rules
- Support for both active inline or passive monitor/capture deployments
- Extensive counters for VLAN, subnet and zone-based rules
- Support for both active inline or passive monitor/capture deployments
Flexible Inspection Capabilities
The P-Series runs at full line-rate for 10 GbE network links with full deep-packet inspection and stateful signatures/policies enabled. Anchored content constructs allow flexible custom rules to be written that match the Layer 7 payload at a specific offset from the packet header, or offset from a pattern in the packet.
Line-rate and Low Latency Performance
As a pure hardware-based inspection system, the P-Series is inherently 100% predictable in how operations are performed and always compiles a rule base that runs at line-rate. This leads to identical performance, throughput, and latency under any traffic load, and with any number of rules applied.
Management
Text-based rule management screen that enables users to:
- Start and stop the interface; turn each rule on and off
- Manage runtime parameters such as flow length and timeout
- Set capture/ignore and block/forward policies for each rule
Web-based Node Manager with support for:
- Rule and image management
- Traffic and counter monitoring
- System status and health monitoring
Integration with Sguil, an Open Source network security monitoring and reporting system that provides the ability to:
- Collect, monitor, and correlate security events/alerts in the network
- Analyze security events based on context
- Categorize and escalate events for intrusion response decisions
Monitoring statistics with the P-Series Node Manager
P-Series Specifications
Go