Security Services

1. Security services overview

The cloud DCN solution provides the following security services:

1. IPsecVPN

This is a VPN tunnel access mode in which the IPsec protocol is used to provide encryption. If secure communication is required between an enterprise DC and an enterprise private network, IPsec VPN can be used to implement secure communication and transmission of tenant data on the Internet. The solution uses north-south firewalls to provide IPsec VPN services, and the key used for IPsec encryption and authentication can be dynamically negotiated using the Internet Key Exchange (IKE) protocol. IKE can automatically generate a shared key, which improves the security of the key and simplifies IPsec management.

2. Source NAT (SNAT)

SNAT translates private IP addresses into public IP addresses and supports QoS of bidirectional traffic limiting based on public IP addresses. When an internal IP address in a DC needs to access services on the public network (for example, accessing an external website), the internal IP address is used to initiate a connection request. The firewall translates this address into a public IP address and hides the original one. In some scenarios, SNAT is also used for east-west traffic in a DC.

3. EIP

EIP provides elastic IP address services for VMs while also supporting QoS of bidirectional traffic limiting based on elastic IP addresses. EIP binds a public IP address to a tenant network’s private IP address, so that various tenant network resources can provide services to the external network using a fixed public IP address and devices on the tenant network can access the external network. In some scenarios, EIP is also used for east-west traffic in the DC.

4. Firewall-based bandwidth management

Bandwidth management refers to firewall management and control of traffic based on the inbound interface/source zone, outbound interface/destination zone, service, and interface number. Bandwidth utilization is improved, while the bandwidth exhaustion caused by attacks is avoided. The cloud DCN solution supports a bandwidth management service that restricts the number of firewall sessions based on five-tuple.

5. Anti-DDoS

DDoS attacks use zombie hosts to send a large number of malicious attack packets to a target. These attack packets may congest network links and exhaust system resources, resulting in the target failing to provide services for authorized users. Zombie hosts are online hosts controlled by an attacker, and a network of zombie hosts is known as a botnet. The cloud DCN solution provides firewall-based anti-DDoS to defend against common types of DDoS attacks.

6. Security policy

The cloud DCN solution provides integrated firewall policies for traffic filtering and security inspection, as well as supporting security policies in a VPC, between VPCs, and between a VPC and an external network. In addition to the 5-tuple, the solution supports security policies based on EPGs, address pools, and a combination of attributes such as the service type and time range.

7. Content security detection

The cloud DCN solution also provides a firewall-based intelligent awareness engine to implement integrated inspection and processing of traffic contents, involving such security functions as antivirus, IPS, and URL filtering.

As a security mechanism, the IPS analyzes network traffic and detects intrusions (including buffer overflow attacks, Trojan horses, and worms). It can automatically discard intrusion packets or block attack sources to terminate intrusions in real time. The IPS identifies packet application layer information, as well as specific characteristics based on the packet content, and compares this information with IPS signatures. If they match, the IPS blocks the packets or generates an alarm based on the configured action.

Antivirus software identifies and processes virus files to ensure network security. Viruses are malicious programs that can be attached to applications or files, and are generally transmitted through emails or file sharing protocols. Antivirus software utilizes a professional intelligent awareness engine and a continuously updated virus signature database to detect and process virus files, preventing data damage, permission changes, and system crashes. When a file containing a virus is detected, the system either blocks that file or generates an alarm based on the action specified in the antivirus configuration file. If file reputation detection is enabled, the FireHunter sandbox can be used to further inspect related files.

URL filtering controls the URLs accessible to users, prohibits them from accessing certain web page resources, and standardizes Internet access behaviors to prevent unauthorized or malicious website access which may result in disclosure of confidential information and even threats such as viruses, Trojan horses, and worms. URL filtering can identify URL access requests, and may block the request or generate an alarm if a certain rule is matched.

2. Security service architecture

Figure 8.23 shows the security service architecture in the cloud- network integration scenario of the cloud DCN solution.

The security service architecture has the following components:

• • Cloud management platform (for example, Huawei ManageOne): supports the orchestration and provisioning of standard security services (such as NAT, FWaaS, and IPsec VPN) defined by OpenStack, as well as extended security services (such as IPS and antivirus).
• • OpenStack: orchestrates and provisions standard security services defined by OpenStack, including NAT, FWaaS, and IPsec VPN.
• • Network controller (such as iMaster NCE-Fabric): manages DC switches, connects to OpenStack L2 to L7 plug-ins, orchestrates and provisions basic networks, and distributes standard NAT, FWaaS, and IPsec VPN service requests orchestrated and provisioned by the cloud platform to the security manager.

FIGURE 8.23 Security service architecture in the cloud-network integration scenario of the cloud DCN solution.

• • Security manager (such as SecoManager): manages security devices and connects to the network controller to implement standard NAT, FWaaS, or IPsec VPN service modeling and automatic configuration defined by OpenStack. In some scenarios, the security manager can also provide an SDN controller to directly connect to the cloud management platform in order to implement modeling and automatic configuration of extended security services.
• • Security device: A firewall provides security services such as NAT, FWaaS, IPsec VPN, and content security detection.
• • Layer 2 and Layer 3 network: A network resource pool is abstracted from the spine-leaf network consisting of DC switches.

Figure 8.24 shows the security service architecture in the network virtualization scenario of the cloud DCN solution.

The security service architecture has the following components:

• • Network controller (such as iMaster NCE-Fabric): manages DC switches and third-party security devices, orchestrates bidirectional or unidirectional networks between the network and security devices, and delivers configurations.
• • Security manager (such as SecoManager): manages security devices, orchestrates and delivers security services, and provides VAS functions such as NAT, FWaaS, IPsec VPN, bandwidth management, anti-DDoS, and content security detection.

FIGURE 8.24 Security service architecture in the network virtualization scenario of the cloud DCN solution.

• • Security device: (Huawei) Firewalls provide security service functions such as NAT, FWaaS, IPsec VPN, bandwidth management, anti-DDoS, and content security detection.
• • Third-party security device: The scope of third-party security devices depends on the security capabilities of the devices.
• • Third-party security service orchestrator: orchestrates and delivers third-party security services. The scope of orchestration depends on the capabilities of the third-party security management platform.

Note:

There are three common management solutions available for third-party VAS devices (including security devices) within the industry.

• - Service Manager Mode: The network controller manages the network and orchestrates the Layer 2 and Layer 3 networks between the network and third-party VAS devices, while the third-party management platform orchestrates and delivers third-party VAS policies.
• - Service Policy Mode: The network controller manages networks and VASs, orchestrates policies, and delivers configurations for all third-party VASs.
• - Network Policy Mode: The network controller does not manage third-party VAS devices, and is only responsible for unidirectional interconnection and traffic diversion orchestration from the network to third-party VAS devices.
• 3. Security policy service of the SDN security manager

The security manager supports fine-grained legacy security policy management for firewalls, tenant-oriented OpenStack standard FWaaS service based on logical firewalls, and tenant-oriented security policy automation service by service scenarios. The security policy automation service synchronizes logical network information, EPG information, and SFP information from the network controller to detect the network topology and implement automatic orchestration and distribution of security policies. The network and related security are highly collaborative, and logical VASs do not require manual selection. This, in turn, simplifies the security policy configuration. In addition, security policies can be dynamically updated and adjusted based on network changes. The following describes the process of security policy automation based on service scenarios provided by the security manager.

• 1. The security manager detects logical network information through the network controller, including the associated mapping information of the logical router, logical switch, logical firewall, external network, and subnet. In this way, the security manager can obtain the protected network segment data of the logical firewall (the associated mapping between the subnet and the logical firewall).
• 2. The security manager uses the network controller to automatically learn the mapping between subnets and EPGs, SFC instance information, and VPC communication instance information, and in order to detect the logical firewall selected during the orchestration of SFC instances and VPC communication instances.
• 3. When orchestrating security policies based on EPGs or IP addresses, the security manager automatically selects a logical firewall based on the detected logical network, SFC instance, and VPC communication instance information and delivers security policy configurations based on the following principles, as shown in Figure 8.25.
• - IP-based security policy (for mutual access within a VPC): The security manager matches traffic with the protected network segment, which is obtained during logical network information synchronization, and automatically identifies the protection type (east-west or north-south). For east-west traffic, the security manager delivers configurations to the east- west logical firewalls on the corresponding logical network in order to implement security policies. For north-south traffic, the security manager selects the north-south logical firewalls.
• - IP-based security policy (for cross-VPC access traffic): The security manager automatically selects the logical firewall

FIGURE 8.25 Security policy configuration.

that is selected during VPC communication instance orchestration, delivering configurations and implementing security policies based on the synchronized VPC communication instance information.

• - Application group EPG-based security policy: The security manager automatically selects the logical firewall that is selected during SFC instance orchestration based on the SFC instance information synchronized in order to deliver configurations and implement security policies.
• - If an IP-based security policy matches an EPG but does not match any logical firewall, the security manager uses an algorithm to select a logical firewall to carry the security policy. The SDN controller of the network controller is then instructed to automatically create an SFC instance and divert traffic to that logical firewall.

300 ■ Cloud Data Center Network Architectures and Technologies