1. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 1 Enterprise Network Architecture SAFE Suhento Gunawan Systems Engineer CCIE #16940 suhento@cisco.com

2. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 2 Common Requirement  Secure  Reliable  Scalable  Modular A Network Blueprint is Required

3. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 3 SAFE Secure Architecture For Enterprise A comprehensive security blueprint that enables organizations to safely engage in e-business

4. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 4 Cisco SAFE Modular deployment Scalable & Reliable Pay as you grow Modules are not dependant on the security of the surrounding network Principle of layered security Attack mitigation is the foundation for all designs and best practices Technology focused, product agnostic

5. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 5 Modules  Core  Management  Server Farm … Data Centre  Building Network … Your Office Network  WAN … HQ to Branch Office  Extranet … Connectivity to other Department  Internet … Connectivity to Internet/ISPs  VPN & Remote Access … Supporting Teleworkers  E-Commerce

6. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 6 SAFE Modules Campus Edge SP Edge Building Distribution Management Server Farm Core E-Commerce Corporate Internet VPN & RA WAN ISP B ISP A PSTN Frame/ ATM Extranet Edge Distribution

7. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 7 Management Module OOB Console OOB LAN To VPN/RAS Devices:  Terminal Console Server Cisco Router with Async. Ports  Network IDS Cisco IDS Appliance  L2 Switch w/ Private VLAN  Router with FW&IPSEC Cisco Router FW/IPSEC Feature  Syslog Server  Ciscoworks Server  OTP Server  Cisco ACS Radius Server  VMS Server  Enterprise NMS Framework

8. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 8 Core Module To Server Module To Building Distribution Module To Edge Distribution Module Devices:  High end L3 Switch Gigabit Ethernet Module

9. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 9 Building Distribution Module To Core Module To Users Access Module Devices:  High end Multilayer Switch Network Analysis Module (NAM) Gigabit Ethernet Module

10. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 10 Server Module To Server Module Devices:  High end Multilayer Switch Network Analysis Module (NAM) Gigabit Ethernet Module  Network IDS  Internal Server Department Server Cisco CallManager  Cisco Security Agent (Server)

11. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 11 Edge Distribution Module To Core Module To E-Commerce Module To Internet Module To VPN Module To Extranet Module To WAN Module Devices:  High end Multilayer Switch Network Analysis Module (NAM) Gigabit Ethernet Module

12. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 12 E-Commerce Module Devices:  High end Multilayer Switch Network Analysis Module (NAM) Gigabit Ethernet Module  Network IDS  Firewall  Server Load Balancer  E-Commerce Server WWW Front-End Server Application Server Database Server  Cisco Security Agent (Server)  Modular Internet Router

13. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 13 Internet Module Devices:  High end Multilayer Switch Network Analysis Module (NAM) Gigabit Ethernet Module  Network IDS  Firewall  Server Load Balancer  Cache Engine  Servers SMTP, DNS, FTP, WWW URL Filtering  Cisco Security Agent (Server)  Modular Internet Router

14. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 14 VPN/RAS Module Devices:  Multilayer Switch  Network IDS  Firewall  VPN Concentrator  Dial-in Server Router with analog/digital modem

15. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 15 Extranet Module To Edge Distribution Module To VPN/RAS Module Devices:  High end Multilayer Switch Network Analysis Module (NAM) Gigabit Ethernet Module  Network IDS  Firewall  Server Load Balancer  Application Server  Cisco Security Agent (Server)

16. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 16 WAN Module To Edge Distribution Module To Link Provider Devices:  High end Modular Router

17. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 17 Medium Branch Module To Link Provider To ISP To PSTN Devices:  High end Multilayer Switch Network Analysis Module (NAM) Gigabit Ethernet Module  Network IDS  Firewall  VPN Concentrator  Servers  Cisco Security Agent (Server)  Cisco Security Agent (Desktop)  Internet Router  WAN Router

18. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 18 New SAFE ISP A Internet ISP B PSTN Provider Secured Server Secured Client Cisco CallManager Terminal Server Cisco Router Cisco Router With FW Multilayer Switch With FW&IDS&CSM Multilayer Switch With FW&IDS&VPN L2 Switch Multilayer Switch Multilayer Switch With IDS Management ModuleUsers Core Building Distribution Server Module Edge Distribution E-Commerce Internet VPN/RAS Extranet WAN Medium Branch Small Branch Remote Users OOB Console OOB LAN To VPN/RAS OTP Server Radius Server Syslog Server VMS Server NMS Server E-NMS Server Dial-in Server Multilayer Switch With FW&IDS

19. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 19 Q and A

20. © 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 20 © 2003 Cisco Systems, Inc. All rights reserved.