Industries such as finance and retail are accustomed to dealing with the common challenges of remote site management.
However, while virtual network computing (VNC) has made IT systems administration easier from a desktop interface, network architecture has not enjoyed the same level of remote management innovation.
Isnt' it time all network adminstrators have remote management access?
As you continue to add more security appliances and monitoring tools both to your headquarters and to your remote sites, on-site configuration and management will become increasingly inefficient.
Under today’s dynamic network demands, network administrators must have comprehensive remote management capabilities to ensure in-line security appliances and out-of-band network monitoring solutions have guaranteed uptime and 100% traffic visibility.
In the past, network architects could get away with implementing static network TAPs with a “set-it-and-forget-it” mentality. You could take a laptop to your remote sites, plug into the network TAPs, and configure them to copy traffic 24/7. However, the security arena is becoming increasingly complicated by the minute and your baseline traffic might not be the same today as it was a few months ago, or in the case of an attack – a few moments ago.
To meet the rapidly changing needs of today’s networks, you - and your IT staff have to be able to tap into your remote sites and manage appliances and traffic patterns without traveling to the site or employing on-site IT departments.
Consider the following scenario for modern network design, made possible by our modular packet broker system with remote management capabilities.
Here, you’ll see the headquarters is equipped with a 2U chassis packet broker system connected to two in-line security appliances. Connected via the cloud, these firewalls analyze traffic from three separate satellite offices, which are set up with their own independent chassis systems and NGFWs.
Rather than shipping the chassis systems back and forth to configure modular network TAPs, the network administrator at the headquarters can access the configuration and functionality of every individual module at each remote site. Additional concurrent login sessions allow for multiple users at different admin roles to access the network as well. Now, network administrators can respond to evolving demands at each unique remote site without needing to plug into on-site equipment.
But how does this remote management work?
The new 1G Modular Packet Broker System (in either a 1U or 2U chassis) comes with an optional management card that gives you access to via an Ethernet GUI or Serial CLI controller for remote management capabilities.
Aside from access to basic network configuration, syslog, keypress timeout and other settings, the remote management card provides comprehensive access to change and view module configurations. At a high level, the interface shows a clear map of each module and their operating states in the chassis at your remote site.
You can then dive deeper into each module to see how each network and monitoring port is configured in each module, including access to change link speeds (when possible) and media types as necessary.
Because the network TAPs in your chassis are hot swappable, you have the freedom to customize the design for your specific needs. For example, a top row of filtering TAPs in conjunction with two full rows of bypass TAPs would give you a full-fledged packet broker system that could ensure visibility and uptime for any in-line security appliance or out-of-band monitoring tool.
The most important point is that as your network demands change, you can simply log into the management interface and update network configurations at remote sites without actually leaving the headquarters. If your network is being attacked, you could quickly change filtering rules to adapt to threats. Or if your security appliances are misfiring, you can take them offline without being on-site and without interrupting network uptime.
At a time when flexibility and scalability are essential to any good network design, remote management capabilities are a must-have for industries that constantly deal with satellite office challenges. When you design your own 1G chassis with modular TAPs that fit your needs (breakout, aggregation, filtering or bypass), you can overcome common issues while saving time and money.
If you want to learn more about the customizable new 1G Modular Packet Broker System, contact us today for a free Design-IT session and discover how your remote site management can become much easier.
If the inline security tool goes off-line, the TAP will bypass the tool and automatically keep the link flowing. The Bypass TAP does this by sending heartbeat packets to the inline security tool. As long as the inline security tool is on-line, the heartbeat packets will be returned to the TAP, and the link traffic will continue to flow through the inline security tool.
If the heartbeat packets are not returned to the TAP (indicating that the inline security tool has gone off-line), the TAP will automatically 'bypass' the inline security tool and keep the link traffic flowing. The TAP also removes the heartbeat packets before sending the network traffic back onto the critical link.
While the TAP is in bypass mode, it continues to send heartbeat packets out to the inline security tool so that once the tool is back on-line, it will begin returning the heartbeat packets back to the TAP indicating that the tool is ready to go back to work. The TAP will then direct the network traffic back through the inline security tool along with the heartbeat packets placing the tool back inline.
Some of you may have noticed a flaw in the logic behind this solution! You say, “What if the TAP should fail because it is also in-line? Then the link will also fail!” The TAP would now be considered a point of failure. That is a good catch – but in our blog on Bypass vs. Failsafe, I explained that if a TAP were to fail or lose power, it must provide failsafe protection to the link it is attached to. So our network TAP will go into Failsafe mode keeping the link flowing.
Single point of failure: a risk to an IT network if one part of the system brings down a larger part of the entire system.
Heartbeat packet: a soft detection technology that monitors the health of inline appliances. Read the heartbeat packet blog here.
Critical link: the connection between two or more network devices or appliances that if the connection fails then the network is disrupted.