Network visibility, security and DDoS protection in one tool
Industries:
TelecommunicationProducts:
FlowmonChallenge
- Quick detection of DDoS attacks and automatic mitigation using both on premises and out of band scrubbing center
- Detection of outgoing malicious traffic
- Possibility to orchestrate defense strategies using multiple techniques and equipment
Solution
- Flowmon ADS
- Flowmon Collector (Virtual)
- Flowmon DDoS Defender
- Flowmon Probe (Virtual)
Result
- Fast deployment
- Easy generation of NetFlow/IPFIX for traffic originating from non-Netflow/IPFIX capable devices
- Extensive and detailed reporting on a per customer base
- Customized reporting and alerting for predefined events enables efficient and no time consuming network monitoring
Full Story
Challenge
Cyso is a leading Dutch provider of managed internet services, platforms and infrastructure for the corporate market. Cyso provides custom solutions and management for complex, business critical platforms and applications. Their customer portfolio covers financial institutions, IT professionals, internet service providers, government agencies and software vendors. Cyso believes strongly in working closely with their customers and partners to lift services to a higher level.
Cyso owns and runs a network spanning two locations in Amsterdam, interconnected using dark fibres with a total capacity of 160 Gb/s. Several 10 Gb/s connections to transit providers and AMS-IX and NL-ix ensure fast and highly redundant Internet connectivity. The network hosts a large number of tailor made platforms that Cyso built and maintains for its customers.
Solution
The Flowmon solution analyses all traffic going in and out of the Cyso network. Span ports mirror all traffic to Flowmon Probe, which sends the generated NetFlow/IPFIX to a Flowmon Virtual Collector. Besides the standard on-board analysis of the collector providing full IP traffic visibility, Cyso uses DDoS Defender and Flowmon ADS to make sure that malicious traffic is detected and acted upon fast and effectively.
Flowmon Virtual Collector is running on VMware ESX, allowing for easy upgrades when more resources (CPU, memory, disk space) are needed. The Flowmon deployment is linked with the Dutch out of path mitigation initiative NaWas. The setup was easy to implement. Currently Cyso uses both Arbor Peakflow TMS and Flowmon + NaWas.