HP ProCurve Alliance + Dr Carl Windsor CISSP Major Account Manager cwindsor@fortinet.com February 2008

What is the HP ProCurve Alliance? Membership alliance program run by HP ProCurve to offer customers security and mobility solutions with interoperability with HP ProCurve products Members are Fortinet, Mitel, AirWave, DVTel and ShoreTel Fortinet Confidential 2

Why ProCurve? Complete portfolio of LAN, WAN, WLAN segments Strong product features, combined with very cost-effective pricing ProCurve provides Industry Standard Solutions Best Warranty in the Industry Lifetime hardware warranty Free phone support Free software updates

Why ProCurve? - Synergies with Fortinet Cisco growing presence in the security space Traditionally Cisco has taken a “build everything” approach ProCurve provides an attractive alternative to Cisco ProCurve will establish alliances to build up security functionality ProCurve and Fortinet are leaders in their respective industries Opportunity for Fortinet to grow its presence in new markets

Why Fortinet? - Synergies with ProCurve External threat protection UTM feature set (Firewall, IPS, VPN, Anti-virus, Anti-spam, Content Filtering) Internal threat protection IDS/IPS Broad portfolio of UTM appliances and management tools SMB to Enterprise level solutions UTM appliances are interoperable with ProCurve Network Immunity Manager

Why ProCurve and Fortinet? Unified Threat Management Network Deployment Location Edge – Users Connect Distribution – Aggregation Core & Data Center Perimeter Distribution All deployment scenarios Security Functionality NBAD (via sFlow) L2/L3 Switching VoIP Firewall, IPS, Antivirus, Antispyware, Antispam, IM/P2P Control, Web Filtering Complete security from L3-L7 plus application layer +

Network Immunity Manager Standalone Detection Analysis Duplicate IP IP spoofing IP fan out DNS tunneling Packet size deviation used Protocol anomalies TCP/UDP Fan out ProCurve Manager Network Immunity Manager NBAD/sFlow based virus alert sFlow samples Possible Virus or attack identified by anomaly engine Per port response, Reconfiguration of switch The Network Immunity (NI) Manager is a plug in to PCM and is on a server Virus detection The ProCurve switches send sampled traffic using sFlow technology to the NI Manager which runs NBAD (Network Behavior Anomaly Detection) on the data to detect virus attacks The NI Manager can also accept virus alerts from switches running Virus Throttle Response The Network Immunity Manager can respond to a virus attack by reconfiguring the switch to take the actions listed on the slide on the source port of the attack Risk that traffic is misidentified Response Methods Quarantine VLAN Offender MAC lockout Offender port shutdown Offender port rate limiting Offender port mirroring for deeper analysis Enable sflow at the offender port Email notification Network switches

Network Immunity Manager with FortiGate One Arm IPS Detection Analysis Duplicate IP IP spoofing IP fan out DNS tunneling Packet size deviation used Protocol anomalies TCP/UDP Fan out ProCurve Manager Network Immunity Manager NBAD/sFlow based virus alert sFlow samples IDS/AV alert Possible Virus or attack identified by anomaly engine Traffic correctly identified One-Arm IPS Build Per port response, Reconfiguration of switch The Network Immunity (NI) Manager is a plug in to PCM and is on a server Virus detection The ProCurve switches send sampled traffic using sFlow technology to the NI Manager which runs NBAD (Network Behavior Anomaly Detection) on the data to detect virus attacks The NI Manager can also accept virus alerts from switches running Virus Throttle Response The Network Immunity Manager can respond to a virus attack by reconfiguring the switch to take the actions listed on the slide on the source port of the attack The NBAD software detects viruses but it does not detect the virus using virus signature file matching like and IDS/IPS security appliance An IDS/IPS virus signature file match provides a high confidence a known virus is present and it provides the name of known viruses while NBAD software provides broad coverage and detection of zero day attacks (new viruses) If a virus signature file match is desired for known viruses, a customer has the option to have the NI Manager configure the switch to remotely mirror suspect traffic as identified by the NBAD software to an IDS/IPS/UTM security appliance that can perform a virus signature file match and then generate a virus alert to the NI Manager that will then respond (the security appliance must be in IDS mode and be connected to a ProCurve switch that supports remote mirroring) A IDS/IPS appliance is in IDS (intrusion detection system) mode if it is just monitoring traffic that’s mirrored to it to detect viruses, it’s in IPS (intrusion prevention system) mode if it’s inline as a bump in the wire to detect viruses and then block traffic to prevent the spread of the virus. Mirror Suspect Traffic Response Methods Quarantine VLAN Offender MAC lockout Offender Port shutdown Offender Port rate limiting Offender Port Mirroring for deeper analysis Enable sflow at the offender port Email notification Network switches

Network Immunity Manager with FortiGate Inline Detection Analysis Duplicate IP IP spoofing IP fan out DNS tunneling Packet size deviation used Protocol anomalies TCP/UDP Fan out ProCurve Manager Network Immunity Manager IPS alert Inline UTM The Network Immunity (NI) Manager is a plug in to PCM and is on a server Virus detection The inline IPS sends and alert to NI Response The Network Immunity Manager can respond to a virus attack by reconfiguring the switch to take the actions listed on the slide on the source port of the attack Per port response, Reconfiguration of switch Response Methods Quarantine VLAN Offender MAC lockout Offender port Shutdown Offender port rate limiting Offender port mirroring for deeper analysis Enable sflow at the offender port Email notification Network switches

ProCurve / Fortinet Integration The sensitivity with which the HP ProCurve switch port detects traffic anomalies is configured as appropriate

ProCurve / Fortinet Integration Network Immunity Manager is configured to understand the Fortinet SNMP Trap format and Signature ID

ProCurve / Fortinet Integration When the FortiGate identifies malicious traffic, it notifies the Network Immunity Manager via an SNMP Trap

ProCurve / Fortinet Integration The Network Immunity Manager responds by reconfiguring the switch according to the pre-set rules

For more information please visit http://www.fortinet.com Questions? For more information please visit http://www.fortinet.com 14

For more information please visit http://www.fortinet.com Backup Slides For more information please visit http://www.fortinet.com

ProCurve Switch Functionality