Top Layer Networks Inc.s IDS Balancer 3500 switch-and-software combo improves the performance of installed intrusion detection system sensors by mirroring network data flows to load balanced IDS groups, allowing sites to monitor all the traffic entering and leaving the network.
In eWeek Labs tests, the IDS Balancer proved to be an innovative, easy-to-use appliance that fine-tuned the performance of IDS systems—the crucial second line of network defense against hackers and illegitimate traffic such as denial-of-service attacks. Many sites also employ IDSes to monitor internal network traffic to prevent users from compromising security, and the IDS Balancer proved effective in this capacity as well.
Top Layers is the only IDS load balancer weve seen, and the package works with most popular IDS systems, including those from Internet Security Systems Inc. and NFR Security Inc., and open-source IDSes such as Snort. However, the IDS Balancer, which shipped in November, is priced at $20,000; although this price is comparable to that of most Web appliances, its on the high end for a switch that is dedicated to IDS balancing. It also lacks failover capabilities, and its load balancing is limited to a round-robin scheme.
The IDS Balancer has dual Gigabit Ethernet and 12 10/100M-bps Ethernet ports. Depending on network topology, IT managers can configure the IDS Balancer to monitor their network via the Gigabit Ethernet port and attach multiple IDS groups to the 10/100M-bps ports. If the site has an IDS that can handle Gigabit Ethernet network traffic, the IDS Balancer can forward traffic flows from multiple 10/100M-bps network segments to the IDS sensor on the Gigabit Ethernet network.
For sites that dont need the Gigabit Ethernet connection, Top Layer also offers the IDS Balancer 3531, which has 12 10/100M-bps ports, for $12,000.
IDS Balancer uses Top Layers Flow Mirror technology, which selectively copies network traffic to multiple IDS devices, to load balance all or specific application flows (for example, HTTP, FTP and so on). This ensures even distribution of workloads on each IDS, thereby increasing the overall performance of the site.
Although the IDS Balancer can load balance up to a gigabit of network data to a maximum of four IDS groups, it supports only a single, round-robin load balancing scheme. This approach works well for sites that have IDS software installed on similar hardware systems, but most sites will have an IDS installed on systems with faster CPUs or more memory, and the round-robin scheme might not effectively distribute the load.
Because the IDS Balancer can support as many as four IDS groups, sites can set up redundant groups of IDSes so network data will still be monitored if a couple of IDS boxes fail. The IDS Balancer offers an extra power supply for hardware redundancy, but it lacks failover capability. In the event of a complete hardware failure, the IDS devices attached to the IDS Balancer will not be able to monitor the network.
The IDS Balancer evenly load balanced network traffic to the IDS groups on our test network. To simulate a typical workload environment, we configured the IDS Balancer to monitor a network segment via the Gigabit Ethernet port and set up two groups of IDSes using ISS RealSecure Version 6.0. We installed RealSecure on a pair of desktop computers and attached them to another network segment with the IDS Balancer.
When we tested the IDS sensors behind the IDS Balancer, they ably detected Nessus port scans on a Linux box installed on our network and alerted us to the intrusion. The IDS Balancer also mirrored and load balanced all the traffic we generated to the IDS groups.
Setting up the IDS Balancer is very simple, thanks to the intuitive Web user interface and configuration wizards. We used them to set up the IDS Balancer to monitor incoming traffic flows to IDS groups, and we could selectively direct application flows to specific groups of IDS groups.
Much like application-based server load balancing, the IDS Balancer can direct network flows to IDS groups based on the application. This is useful to prevent the IDS systems from wasting resources by analyzing traffic that isnt necessarily threatening, such as Secure Sockets Layer transactions.
The IDS Balancer also comes with free logging software that provides useful graphs and charts of monitored data flows in HTML format. The log files can also be exported to Microsoft Corp.s Excel for further analysis.
Technical Analyst Francis Chu can be reached at francis_chu@ziffdavis.com.
IDS Balancer 3500
IDS Balancer 3500
|
USABILITY |
B |
|
CAPABILITY |
C |
|
PERFORMANCE |
B |
|
INTEROPERABILITY |
B |
|
MANAGEABILITY |
B |
Top Layers IDS Balancer 3500, the first IDS load balancer weve seen, is most useful for service providers and security-conscious sites that wish to balance workloads between IDS sensors, improving overall site security. However, for a dedicated server, its pricey, and it lacks failover capabilities found in other Web appliances.
SHORT-TERM BUSINESS IMPACT // The IDS Balancer can mirror network traffic to IDS groups right out of the box. Implementation isnt difficult, thanks to the intuitive Web-based user interface.
LONG-TERM BUSINESS IMPACT // The IDS Balancer lacks failover capabilities, so IT managers who need fail-safe operation will have to set up multiple redundant IDS groups or buy another box to ensure consistent network monitoring.
PROS: Performs application-based IDS load balancing; easy to set up and manage.
CONS: Expensive; supports only round-robin load balancing scheme; lacks failover capabilities.
Top Layer Networks Inc., Westboro, Mass.; (508) 870-1300; www.toplayer.com
