Network security review: ConSentry LANShield Switch

Policy-based switching and great reporting add muscle to network security

Traditionally, many IT specialists have seen networks as an open channel. They allow an infinite variety of devices to communicate, and the best networks make communication simple, free, and instantaneous -- like the air we breathe. Back in the early days of the Internet, shell accounts were gratis for the asking. Few people used passwords. It was an easy and altruistic era.

But that was a long time ago.

We have long since learned that we have to protect ourselves from the more aggressive Internet users, whether those who do it for nefarious purposes or those who contend that they are just trying to make us aware of our vulnerability. Firewalls, traffic filters, intrusion detection and prevention, and other security devices are now assumed components of a responsible network infrastructure. We feel protected from those external forces. The problem is that those forces have ways of getting inside our perimeter. So we need more protection.

This is where policy-based networking enters the fray. Comprising a range of technologies, including NAC (network access control), traffic analysis, filtering, and reporting, policy-based networks proactively address both organizational requirements and the realities of an unfriendly world. The goal of a well-designed policy-based network is to look free and open to all valid traffic, while coming across as a bit bucket to anything unauthorized.

In earlier NAC reviews (see "NAC smorgasbord: Four ways to police the network" for our reviews of Enterasys, McAfee, Symantec, and Trend Micro, and "NAC appliances reveal who's rapping at your network door" for a look at Caymas -- now Citrix -- as well as Lockdown, Nevis, and Vernier), we began the process of differentiating approaches to policy-based network solutions even as the hype around NAC grew to a fever pitch. After all, the point is solving the business and security problems.

In this and a series of companion upcoming reviews, we will look at the continually evolving world of NAC and policy-based networking. There is some confusion in terminology, since Cisco Network Admission Control (CNAC) is a Cisco-proprietary solution for network access control. We will be reviewing a wide range of NAC solutions (including CNAC), so all references to NAC refer to the more generic concept of controlling access to a network. For each review, we look at the product's ability to address a set of typical enterprise policies and distinguish the ways in which the product does that. As you read all of these articles, the key is to consider your requirements from within the universe of possible policies, especially in terms of the granularity of both the policies and their enforcement. You will also want to consider how you want to interact with the system and whether ease of policy creation, policy modification, or reporting are your most vital requirements.

For this test, we followed the same testing scenarios as in the February 2007 tests.

ConSentry LANShield Switch
The ConSentry LANShield Switch is available in both 24- and 48-port versions. The 24-port version includes 24 Gigabit Ethernet ports and two combo SFP (small form-factor pluggable) gigabit ports. The 48-port version includes 44 Gigabit Ethernet ports, four combo SFP gigabit ports, and two 10Gbps ports. Both switches have an option for PoE (power over Ethernet). Functionally, the two switches are identical, offering layer-2 and layer-3 policy control, thereby allowing customers to choose based on their connectivity requirements.

ConSentry also offers the LANShield Controller, a layer-2 device that is designed to sit between the edge and the enterprise network core. LANShield OS is common to the two device configurations.

System management comes via ConSentry InSight, element-management-style software designed to monitor and administer the infrastructure. With InSight, you set up your policies, adjust them when needed, and monitor the state of your devices and infrastructure using the extensive reporting (the best we've seen -- more about this later).

Policy setup and application
ConSentry designed its architecture to interact with back-end AAA (authentication, authorization, and accounting) servers, and its current systems are able to talk to either Microsoft Active Directory Services, LDAP, or RADIUS. PAMs (pluggable authentication modules) allow the system to authenticate Linux, Mac, and Novell users, as well. The switches are able to snoop the traffic to see authentication requests and responses, using the information discovered to determine identity and, thus, apply appropriate policies.

Setting up policies, then, starts with AAA infrastructure integration. Once installed, InSight allows you to see the registered users and groups, then create policies based on them. The policy editor is straightforward, much like a firewall filter editor, allowing you to assign policies of arbitrary granularity. For example, you can select the types of packets that are allowed for specific IP address ranges, type of device, or user group. As with all policy-based networking, designing policies to reflect your requirements before creating them is vital. After policies are established, you can apply one or more policy to any group of users.

Once they're in place, the policies are enforced as expected, with all scenarios tested successfully.

One challenge, however, is the device-based focus on InSight. Policies are pushed to the devices, so you can manage all of your devices at once, but the devices do not respond together to changes in the network, such as the blocking of a specific device or user on the basis of an alert from an IPS. This may be a limitation for larger installations and dynamic environments that require a tighter feedback loop.

Rich reporting options
Put simply, ConSentry has nailed reporting for policy-based networking. Its extensive and comprehensive reports and customizable dashboard present a benchmark for reporting. It is clear at a glance what is happening on the network, how many of what states of devices are connected to the network, what users are doing, and so on. The reporting interface is a clear Java-based graphical system that brings to mind the best of the business metrics management systems available today.

Pre-defined reports provide a broad range of options for addressing compliance, auditing, and other requirements. Using the available reports, it is simple to customize a reporting environment to suit even the most complex requirements.

We were able to quickly create a dashboard containing a set of metrics that were of interest to us, and the array of possible reports is comfortingly large.

The most recent release of LANShield OS (3.2) includes a number of enhancements to the reporting, including a more detailed view of users' activities. Using these reports, administrators can review network traffic for individual users and groups, as well as correlate applications to their users. This can be particularly helpful in corporate policy making and enforcement.

Comprehensive strengths
ConSentry provides a comprehensive set of products that allows for a heterogeneous installation of edge and core components to provide a logical migration for a typical non-greenfield environment. Using the LANShield Switches at the edge as additional or replacement switches and the LANShield Controller to manage traffic from existing edge systems, enterprises will find a solid approach with ConSentry's offerings.

Due to the broad range of offerings, a ConSentry solution can be effective for midsize companies to large enterprises. The most comprehensive implementations will include replacement of edge switches in the most susceptible areas of the network. ConSentry's special strength is in reporting and information presentation, offering a best-of-breed dashboard for policy-based networking that other vendors would do well to emulate.

InfoWorld Scorecard
Policy Enforcement (20.0%)
Setup (15.0%)
Manageability (20.0%)
Value (10.0%)
Reporting (15.0%)
Scalability (20.0%)
Overall Score (100%)
ConSentry LANShield Switch 9.0 8.0 6.0 8.0 9.0 7.0 7.8