PROTECT - f5.com · TELCO CLOUD & NFV vCPE vDNS vGi-LAN VNF Container Connector for N-S L4-L7...

PROTECTEVERY STRATEGIC CONTROL POINTA GUIDE TO SECURITY FOR SERVICE PROVIDERS

2

PROTECT EVERY STRATEGIC CONTROL POINT

Attacks can interrupt your core business and disrupt your bottom line. According to a recent study, 34 percent of all service providers report that they’ve lost revenue because of attacks in the past year, while 30 percent said they lost customers or business opportunities as a result of these attacks.1

According to our 2018 F5 Labs Threat Analysis Report, 98 percent of the top 50 attacking IP addresses resolve to ISP/telecom companies and hosting providers.2

Not long ago, an unprecedented Mirai-based botnet malware attack blocked Internet access to millions of users in the U.S. The same Mirai botnet—a global network of infected cameras, printers, digital video recorders, and other Internet of Things (IoT) devices—attacked the CPE devices of a service provider and took an estimated 900,000 home routers offline in Germany.

Data security for service providers focuses on two core issues: maintaining network availability and preventing data loss. Failure in either area can irreparably damage your reputation and directly impact your business.

YOUR NETWORK AT RISK

At least 46 million home devices are thought to be vulnerable worldwide to this type of attack.2

A 2018 report3 identified more than 53,000 incidents and 2,216 confirmed data breaches in 65 countries in just one year. It identified ransomware as the most common type of malware—found in 39 percent of malware-related data breaches.

Three key measures will help ensure that your security environment is robust today—and together lay the groundwork for future growth and change:

• Apply security at strategic control points to limit network vulnerability.

• Adopt a hybrid hardware/software approach to optimize the way you mitigate volumetric attacks.

• Prepare your network to manage IoT today and as it continues its exponential growth.

ATTACKS CAN INTERRUPT YOUR

CORE BUSINESS AND DISRUPT YOUR

BOTTOM LINE.

1 http://b2me.cisco.com/en-us-annual-cybersecurity-report-2017 | 2 https://f5.com/labs/articles/threat-intelligence/ddos/the-hunt-for-iot-the-growth-and-evolution-of-thingbots-ensures-chaos | 3 https://www.verizonenterprise.com/resources/reports/rp_DBIR_2018_Report_execsummary_en_xg.pdf

http://b2me.cisco.com/en-us-annual-cybersecurity-report-2017

https://f5.com/labs/articles/threat-intelligence/ddos/the-hunt-for-iot-the-growth-and-evolution-of-thingbots-ensures-chaos

https://f5.com/labs/articles/threat-intelligence/ddos/the-hunt-for-iot-the-growth-and-evolution-of-thingbots-ensures-chaos

https://www.verizonenterprise.com/resources/reports/rp_DBIR_2018_Report_execsummary_en_xg.pdf


3

GTP & DNSSESSION DIRECTOR

MOBILE EDGE AND COREMOBILE ACCESS

EPC NETWORK SLICING

SGW PGWEPC n

EPC 2

EPC 1

•••

ACCESS NETWORK

RAN SGi-LAN Consolidation

SGI SERVICE LAN

Gi FirewallCGNAT

IoT FirewallDDoS

DNS Firewall

Tra�c SteeringDPI and Analytics

TCP OptABR Video OptURL Filtering

WIRELINE, CABLE, AND WIFI ACCESS

DSL/FTTxCable

WiFiSERVICE LAN

DPI & AnalyticsCGNAT

URL FilteringDNS Firewall

CONTROL PLANE

ENTERPRISE

ADC & Security Services

CPEEnterpriseData Center

DATA CENTER SERVICES

CloudServices

PUBLIC CLOUD

GTP FirewallDiameter Firewall

INTERCONNECT

Cloud-Based Security Services

GRX/IPXMVNO

INTERNET

CLOUD

VNF

DNS

DNS LB,Cache & Firewall

LDNS Resolver

EPC & IMS

Diameter & SIP Session Director

HSS, PCRF,OCS X-CSCF, SBC


TRADITIONAL IT

ANALYTICS

+Partners

+Partners

DDOS

Flow Collector,DDoS Scrubber

+Partners+Partners+Partners

+Partners

Virtual L4–L7 Services

TELCO CLOUD & NFV

vCPE vDNS vGi-LAN

VNF

Container Connector for N-S L4-L7 Services

MICROSERVICES

MQTT Tra�c Management &

Security

IOT PLATFORM

BNG/CMTS

VNF

SILVERLINE

SECURE EVERY STRATEGIC CONTROL POINTProtecting your entire network services infrastructure requires a disciplined, organized approach. You must adopt targeted measures to secure every potential vulnerability, including your data center, control plane, and applications. The three most effective strategic control points in your network are the data center, the network edge/SGi-LAN, and the roaming interconnect.

BEING ABLE TO INSTANTLY IDENTIFY AND HANDLE ATTACKS IS PARAMOUNT TO PROTECTING YOUR NETWORK.

Different types of traffic transiting to and through your network might require different security techniques. Stopping a high-volume, distributed denial-of-service (DDoS) attack requires a different approach than stopping an intruder from gaining access to hosted data storage (even through those attacks might occur to, or within, the same network). Being able to instantly identify and handle attacks is paramount to protecting your network.

Let’s look at how securing the strategic control points in your network fit together to optimize security.

NETWORK ARCHITECTURE INCLUDING ACCESS NETWORK, CONTROL PLANE, DATA CENTER, AND CLOUD

FIGURE 1Multiple security tools support each strategic control point (network edge/SGi-LAN, data center, and roaming interconnect)


4

• Apply a full-proxy, data center firewall-based approach—Adopt a comprehensive data center strategy to enhance visibility and control throughout ISO layers 4 through 7. A data center, firewall-based approach can help ensure infrastructure security while the network scales by


MOBILE EDGE AND COREMOBILE ACCESS

EPC NETWORK SLICING

SGW PGWEPC n

EPC 2

EPC 1

•••

ACCESS NETWORK


SGI SERVICE LAN

Gi FirewallCGNAT

IoT FirewallDDoS

DNS Firewall




DSL/FTTxCable

WiFiSERVICE LAN



CONTROL PLANE

ENTERPRISE




CloudServices

PUBLIC CLOUD


INTERCONNECT


GRX/IPXMVNO

INTERNET

CLOUD

VNF

DNS


LDNS Resolver

EPC & IMS




TRADITIONAL IT

ANALYTICS

+Partners

+Partners

DDOS



+Partners


vCPE vDNS vGi-LAN

VNF



Security

BNG/CMTS

VNF

SILVERLINE


MOBILE EDGE AND COREMOBILE EDGE AND COREMOBILE ACCESS

EPC NETWORK SLICINGEPC NETWORK SLICING

SGW PGWEPC n

EPC 2

EPC 1

•••

ACCESS NETWORK


SGI SERVICE LANSGI SERVICE LAN

Gi FirewallCGNAT

IoT FirewallDDoS

DNS Firewall



WIRELINE, CABLE, AND WIFI ACCESSWIRELINE CABLE AND WIFI ACCESS

DSL/FTTxCable

WiFiSERVICE LANSERVICE LAN



ENTERPRISEENTERPRISE



VNF

BNG/CMTS

VNF


INTERCONNECTINTERCONNECT

GRX/IPXMVNOMVNO

EPC & IMSEPC & IMS



TELCO CLOUD & NFV MICROSERVICES IOT PLATFORM

DATA CENTER SECURITY

Service providers are continually expanding their network to accommodate rapid deployment of data center-based services, ongoing adoption of 4G and 5G technologies, and higher customer demand for video and content streaming.

In addition to impacting service quality and increasing capital and operational expenses, these changes strain the security architecture’s ability to handle an increasingly sophisticated threat landscape. You need solutions that enable growth without sacrificing reliable, scalable security.

You can partially address these concerns in the data center with specific security measures:

DATA CENTER SECURITY

A COMPREHENSIVE DATA CENTER STRATEGY CAN PROVIDE VISIBILITY AND CONTROL THROUGHOUT ISO LAYERS 4 THROUGH 7.

leveraging granular connectivity control, security functionality, and end-to-end protection against DDoS and other attacks.

• Implement data-center security best practices—Deploy cohesive, integrated solutions that protect targeted network elements, the DNS infrastructure, devices, and applications. Key capabilities to apply include application health monitoring, a web application firewall, web access controls, web acceleration, and broad Secure Sockets Layer (SSL) support including inspection and offload.

FIGURE 2Multi-layered data center security including DNS, firewall, and DDoS protection


5

support and interoperate with IPv4 devices and content. In addition, CGNAT can provide flexible, high-speed logging capabilities.

types of attacks. This would be handled via specialized hardware that accelerates DDoS protection.

• Intelligent DNS firewall—Shield the DNS infrastructure from infected subscribers and undesired DNS queries/responses by leveraging an intelligent DNS firewall. Service providers use DNS to enable subscriber access to critical services and web applications. If DNS is unavailable, services will fail to function properly, leading to network and service degradation or failures. An intelligent DNS firewall can inspect and validate protocols while dropping invalid requests or refusing to accept unsolicited responses.

• CGNAT—Carrier-grade NAT (CGNAT) capabilities offer high-performance, highly scalable tools that enable you to successfully migrate to IPv6 while continuing to

MOBILE ACCESS

RAN

MOBILE ACCESS

RAN

SGW PGWEPC n

EPC 2

EPC 1

•••

ACCESS NETWORK

SGi-LAN Consolidation

Gi FirewallCGNAT

IoT FirewallDDoS

DNS Firewall



DSL/FTTxCable

WiFi



CONTROL PLANE




CloudServices

PUBLIC CLOUD


INTERCONNECT


GRX/IPXMVNO

INTERNET

CLOUD

VNF


LDNS Resolver

EPC & IMS




TRADITIONAL IT

+Partners

+Partners



+Partners


TELCO CLOUD & NFV

vCPE vDNS vGi-LAN

VNF


MICROSERVICES


Security

IOT PLATFORM

BNG/CMTS

VNF

SILVERLINE

EPC & IMSEPC & IMS





GRX/IPXMVNOMVNO

CLOUD

Cloud-BasedSecurity Services

SILVERLINESILVERLINE

CloudServices

PUBLIC CLOUDPUBLIC CLOUD

+Partners


TRADITIONAL ITTRADITIONAL IT



TELCO CLOUD & NFVTELCO CLOUD & NFVLO

vCPE vDNS vGi-LAN

VNF

Container Connectorfor N-S L4-L7 Services

MICROSERVICESMICROSERVICESE

MQTT Tra�cManagement &

Security

IOT PLATFORMIOT PLATFORMA

ANALYTICS DNS DDOSMOBILE EDGE AND CORE


ENTERPRISE


EPC NETWORK SLICING SGI SERVICE LAN

SERVICE LAN

NETWORK EDGE/SGI-LAN SECURITY

The network edge/SGi-LAN is a crucial network segment in which IoT services meet the network infrastructure. A multi-faceted approach can provide security at the network edge/SGi-LAN and help you manage risks posed by the growing diversity of online devices.

• Advanced firewall—An advanced firewall located at the network edge/SGi-LAN can defend your network infrastructure and subscribers from attacks, regardless of the source. This capability includes mitigation of large-scale DDoS attacks. In a mobile network, an advanced SGi firewall can prevent congestion and overloading of the control and bearer planes by detecting and stopping these

YOU NEED A MULTI-FACETED APPROACH TO PROVIDE SECURITY AT THE NETWORK EDGE/SGI-LAN.

NETWORK EDGE/SGI-LAN SECURITY

FIGURE 3Multi-layered network edge security including DNS, firewall, DDoS, and CGNAT

• Managed Security—You can also provide your enterprise customers with managed security services at the network edge/SGi-LAN by leveraging high-throughput capable DDoS mitigation hardware and other advanced security capabilities.


6

• General Packet Radio Service Tunneling Protocol (GTP)

security solutions—GTP security solutions can scale and protect both control and data plane traffic while implementing FS.20 protections on roaming traffic. Protections include the ability to filter many aspects of the GTP control protocol per roaming partner, such as access point names (APN), information elements, and message types. Invalid and malformed messages can be blocked or reported, and tunnels with an unknown tunnel endpoint identifier (TEID) can be blocked.

MOBILE ACCESS

RAN

MOBILE ACCESS

RAN

SGW PGWEPC n

EPC 2

EPC 1

•••

ACCESS NETWORK


Gi FirewallCGNAT

IoT FirewallDDoS

DNS Firewall



CONTROL PLANE


CloudServices

PUBLIC CLOUD



GRX/IPXMVNO

CLOUD

VNF

EPC & IMS




TRADITIONAL IT

+Partners


+Partners


TELCO CLOUD & NFV

vCPE vDNS vGi-LAN

VNF


MICROSERVICES


Security

IOT PLATFORM

SILVERLINE



CloudServices


+Partners


TRADITIONAL ITTRADITIONAL IT



TELCO CLOUD & NFVTELCO CLOUD & NFVLO

vCPE vDNS vGi-LAN

VNF


MICROSERVICESMICROSERVICESE

MQTT Tra�cManagement &

Security

IOT PLATFORMIOT PLATFORMA

ANALYTICSMOBILE EDGE AND CORE




DSL/FTTxCable

WiFiSERVICE LAN



ENTERPRISE



BNG/CMTS

VNF

WIRELINE, CABLE, AND WIFI ACCESSWIRELINE CABLE AND WIFI ACCESS

DSL/FTTxCable

WiFiSERVICE LANSERVICE LAN



ENTERPRISEENTERPRISE



BNG/CMTS

VNF

INTERNET

DNS


LDNS Resolver

+Partners

DDOS


DNSDNS


LDNS Resolver

+Partners

DDOSDDOS


INTERCONNECT

ROAMING INTERCONNECT SECURITY

IP-based mobile networks are inherently susceptible to security attacks that are increasing both in volume and diversity. Equally troublesome are signaling storms associated with operational issues or due to malicious attacks. Roaming agreements and third-party content providers complicate the situation by adding outside network connections. Several specific policies and measures can help to reduce roaming interconnect security risks.

• Consolidated diameter signaling platform—You can help protect against signaling security threats with a

TO BLOCK ROAMING ATTACKS FROM PENETRATING YOUR INFRASTRUCTURE, YOUR ENTIRE NETWORK MUST BE PROTECTED.

consolidated diameter signaling platform. This helps to ensure that attacks from the roaming environment do not penetrate your network.

ROAMING INTERCONNECT SECURITY

FIGURE 4Roaming interconnect security including Diameter and GTP security


7


CloudServices

PUBLIC CLOUD


TRADITIONAL IT


+Partners


vCPE vDNS vGi-LAN

VNF



Security

TELCO CLOUD & NFV MICROSERVICES IOT PLATFORM

MOBILE ACCESS

RAN

MOBILE ACCESS

RAN

SGW PGWEPC n

EPC 2

EPC 1

•••

ACCESS NETWORK


Gi FirewallCGNAT

IoT FirewallDDoS

DNS Firewall



DSL/FTTxCable

WiFi





VNF

BNG/CMTS

VNF

MOBILE EDGE AND CORE


ENTERPRISE



SERVICE LAN

CONTROL PLANE


INTERCONNECT

GRX/IPXMVNO

INTERNET

CLOUD

EPC & IMS



ANALYTICS

+Partners

EPC & IMSEPC & IMS





GRX/IPXMVNOMVNO


LDNS Resolver

DNS

+Partners


DDOS


SILVERLINE

HYBRIDIZE YOUR SECURITY ENVIRONMENT MULTI-TIER DDoS MITIGATION

The ability to Instantly upgrade, move, modify, and spin up or spin down services is a service provider’s holy grail. Leveraging virtualized network functions is how you will get all of that done, but becoming fully virtualized will be an evolution.

Security is one area that is often best served by hardware options in production environments due to the requirements of high-bandwidth applications. But dedicated-hardware solutions can be expensive. Hybrid hardware/software strategies blend high performance, flexibility, and cost effectiveness to optimize your investments.

BLEND HIGH PERFORMANCE, FLEXIBILITY, AND COST EFFECTIVENESS TO OPTIMIZE YOUR INVESTMENT.

A software firewall is commonly used in the data center, but a hardware firewall is typically deployed at the SGi-LAN or network edge to provide enhanced security performance.

A best practice for optimizing network security against sophisticated attacks is to apply a hybrid of dedicated hardware and virtualized capabilities in a multi-tiered architecture. Consider a three-tiered DDoS mitigation scheme:

• The first tier of defense would be aimed at mitigating volumetric attacks that occur inside the service provider network. When volumetric attacks are detected, the routers are instructed to drop traffic or redirect it to a “scrubbing center” featuring dedicated high-throughput hardware that will clean the traffic and reinject it into the data path.

• The second tier of defense is an inline solution that is either deployed as a clean pipe service on the customer premises

(for an enterprise), or at the service provider data center in front of application servers and control plane elements.

• For off-net subscribers, a third tier can be delivered by F5® Silverline™, our cloud-based DDoS mitigation service. This service mitigates against attacks aimed at saturating peering and/or transit links. No “on-network” solution can isolate an attack that saturates incoming peering links.

DDOS MITIGATION STRATEGY EXAMPLE

FIGURE 5Hybrid security including out-of-path (control plane), inline, and cloud-based (Silverline) DDoS


8

Two important capabilities can help secure your IoT landscape:

• Device-aware IoT firewalls—Device- and subscriber-aware IoT firewalls enable mobile operators to manage and control security policies via the SGi-LAN on a per-IoT-device basis. With such devices, you can use a single IoT

MOBILE ACCESS

RAN

MOBILE ACCESS

RAN

SGW PGWEPC n

EPC 2

EPC 1

•••

ACCESS NETWORK


Gi FirewallCGNAT

IoT FirewallDDoS

DNS Firewall



DSL/FTTxCable

WiFi





VNF

BNG/CMTS

VNF

MOBILE EDGE AND CORE


ENTERPRISE



SERVICE LAN

CONTROL PLANE


CloudServices

PUBLIC CLOUD


INTERCONNECT


GRX/IPXMVNO

INTERNET

CLOUD

DNS


LDNS Resolver

EPC & IMS




ANALYTICS

+Partners

+Partners

DDOS



+Partners


TELCO CLOUD & NFV

vCPE vDNS vGi-LAN

VNF


MICROSERVICES


Security

SILVERLINE

+Partners+Partners


TELCO CLOUD & NFVTELCO CLOUD & NFV

vCPE vDNS vGi-LAN

VNF


MICROSERVICESMICROSERVICES

CloudServices


+Partners



DNSDNS


LDNS Resolver

EPC & IMSEPC & IMS



+Partners

DDOSDDOS




GRX/IPXMVNOMVNO

CLOUD

TRADITIONAL IT IOT PLATFORM

IOT RISKS AND OPPORTUNITIESThe explosive growth of IoT is driving digital transformation toward a connected society. Gartner forecasts that there will be at least 20.4 billion connected devices worldwide by 2020.4 5G will be a key wireless technology that supports the continued evolution of IoT.

Billions of diverse devices are already flooding IoT with real-time communications. These communications expose network vulnerabilities, but with the emergence of even more advanced mobile and fixed-network capabilities, the volume and variety of attacks will only increase. Every device carries the potential to become a target for hackers and denial-of-service attacks.

EVERY DEVICE CARRIES THE POTENTIAL TO BECOME A TARGET FOR HACKERS AND DENIAL-OF-SERVICE ATTACKS.

access point name (APN) to aggregate a wide variety of use cases, avoiding network redesigns and simplifying service rollout.

• IoT MQTT traffic management and security—Integrated SSL offloading, Message Queuing Telemetry Transport (MQTT) message validation, MQTT message transformation, and intelligent MQTT load balancing are all techniques that can enhance your ability to protect resource availability and data security on your network. The objective is to scale and secure IoT brokers, platforms, and applications.

MANAGING IOT RISKS IN THE NETWORK

4 https://www.gartner.com/newsroom/id/3598917

FIGURE 6IoT security including IoT firewalls and MQTT traffic management and security

https://www.gartner.com/newsroom/id/3598917

F5 has the expertise and experience to help you navigate the uncertainties and demands

of your changing landscape. We are driven to provide industry-leading service provider

solutions that help you address traffic management, network function virtualization,

advanced mobile architectures, cable and fixed networks, and infrastructure security.

Our proven ability to deliver high-performance enterprise IT capabilities informs the way

in which we address every service provider-focused concern and requirement.

We’re here to help you make the best infrastructure choices and to deploy the most

cost-effective, secure, and robust solutions possible.

Learn about our comprehensive approach to securing

service provider networks F5.com/serviceprovider.

OUR SERVICE PROVIDER COMMITMENT.

US Headquarters: 401 Elliott Ave W, Seattle, WA 98119 | 888-882-4447 // Americas: [email protected] // Asia-Pacific: [email protected] // Europe/Middle East/Africa: [email protected] // Japan: [email protected] ©2018 F5 Networks, Inc. All rights reserved. F5, F5 Networks, and the F5 logo are trademarks of F5 Networks, Inc. in the U.S. and in certain other countries. Other F5 trademarks are identified at f5.com. Any other products, services, or company names referenced herein may be trademarks of their respective owners with no endorsement or affiliation, expressed or implied, claimed by F5. EBOOK-SP-243323203 | 7.18

http://F5.com/serviceprovider

Date post:	10-Jul-2020
Category:	Documents
Upload:	others
View:	0 times
Download:	0 times

PROTECT - f5.com · TELCO CLOUD & NFV vCPE vDNS vGi-LAN VNF Container Connector for N-S L4-L7...

Documents