Downloaded 53 times
Uploaded byExtreme Networks
Extreme Secure Automated Smart Factory
This document discusses Extreme Networks' Secure Automated Smart Factory (SASF) solution. It provides an example of how SASF was implemented for a US car manufacturer to achieve fully automated operations, network robustness, flexible network topology, and highly secure segmentation. The SASF architecture provides infrastructure switching, network services automation, endpoint access automation, and distributed security policies. It allows for rapid service provisioning, reduced change windows, and isolation of network segments.
More Related Content
![Why+ATT[2]](https://cdn.slidesharecdn.com/ss_thumbnails/eabdf564-47e6-4419-ab55-942e8925b2bd-160310172206-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
Similar to Extreme Secure Automated Smart Factory
Extreme Secure Automated Smart Factory
- 1. ©2017 Extreme Networks,Inc. All rights reserved Extreme Secure Automated Smart Factory
- 2. ©2017 Extreme Networks,Inc. All rights reserved©2018 Extreme Networks, Inc. All rights reserved The Secure Automated Smart Factory SASF
- 3. ©2017 Extreme Networks,Inc. All rights reserved©2018 Extreme Networks, Inc. All rights reserved Introduction to Extreme’s Secure Automated Smart Factory Real life customer deployment The benefits of Extreme’s Smart Factory solution 3
- 4. ©2017 Extreme Networks,Inc. All rights reserved©2018 Extreme Networks, Inc. All rights reserved The Secure Automated Smart Factory Fully-automated Highly-robust and highly-available Flexible network topology Flexible network service availability Highly-secure
- 5. ©2017 Extreme Networks,Inc. All rights reserved©2018 Extreme Networks, Inc. All rights reserved Secure Automated Smart Factory Architecture InfrastructureWired/Wireless Switching Fabric Connect / Fabric Attach Protocol Fabric Attach ECO System Extreme Control Extreme Management Center Network Services Automation End-point Access Automation Provisioning and Monitoring Application Telemetry Built-in Analytics Distributed Policies Security Automation
- 6. ©2017 Extreme Networks,Inc. All rights reserved©2018 Extreme Networks, Inc. All rights reserved Extreme US Car Manufacturer Example Extreme Secure Automated Smart Factory solution in all their production plants Extreme Secure Automated Campus for office networks Results – The network used as Plug-and-Play utility – Phase 1 delivered a reduction of 50% of change control window requirements. – Phase 2 with Extreme control reduced change control window requirements significantly again. – By using VRF ability to replicate identical production cells (simplifies deployment and scale greatly) Next Steps – By leveraging Extreme SASF capabilities, will separate tools into independent communication domains across the plant without heavily employing firewalling
- 7. ©2017 Extreme Networks,Inc. All rights reserved©2017 Extreme Networks, Inc. All rights reserved US Car Manufacturer Requirements Ease of operations – Automated “adds/moves/changes” – Plug & Play: Refactoring should not impact network and should not require maintenance window – Automated config clean up: Residual config should be removed automatically – Rapid “time to service availability” New services should be available on demand in seconds. – Removal of human error element Manual interactions only at the access – Zero-touch network Network Robustness – Resilient network in case of link or system failure – Device SW changes should have minimal network-wide impact – Minimalizing troubleshooting requirements Visibility – IP Multicast for Analytics of sensor, tool & robot data Flexible Network Service Availability – Secure zoning Separating different plant tools & robot vendors onto securely separated zones – Video surveillance support Provide robust IP multicast video surveillance infrastructure for process and plant monitoring
- 8. ©2017 Extreme Networks,Inc. All rights reserved©2018 Extreme Networks, Inc. All rights reserved Smart Factory Example – US Car manufacturer IT controlled - Office Automation Ethernet IT controlled - Plant Automation Ethernet OT controlled - System Level Fieldbus PlantDataCenter&Offices Office Automation Server Factory Information System Servers FIS Work Cell Controller WIN Work Cell Controller Plant Floor Communications System Server Wireless Access Points Plant Firewall Robot Server Weld Data Collectors Weld Servers Robot/PLC Archive Server FIC OPC Data Collectors Programming Workstations Tools Human Machine Interface Actors Sensors Overhead Displays Activators Surveillance Performance Displays FactoryFloor (EcoSystem Partners)
- 9. ©2017 Extreme Networks,Inc. All rights reserved©2017 Extreme Networks, Inc. All rights reserved Fabric delivers proven results With Fabric Networking… 11x FASTER Implementation Time 7x FASTER Troubleshooting Time 7x FASTER Configuration Time 2,553x FASTER Failover Time 100% IMPROVEMENT Outages Due to Human Error Before After Implementation Time 14 days 1.3 days Configuration Time 4.6 days .7 days Troubleshooting Time 39 hrs 6 hrs Failover Time 14 min 320 msec Human-Caused Outages 3 annually 0 annually Days Waiting to Deploy a Service or Application 31 days 1 day
- 10. ©2017 Extreme Networks,Inc. All rights reserved©2018 Extreme Networks, Inc. All rights reserved Automation
- 11. ©2017 Extreme Networks,Inc. All rights reserved©2017 Extreme Networks, Inc. All rights reserved Edge Automation – Eco System Zero-Touch User & Device Attachment Automated Edge – Zero-Touch Core Edge Automation options: – Lightweight Service signaling protocol IEEE 802.1qcj (Fabric Attach) – NAC/Radius based – Out-of-band configuration Leverage Extreme’s dynamic role based policy control and automation and orchestration to secure auto-attachment of users/devices to Fabric-based services Extreme components as well as FA IoT Eco System 11 Fabric Connect & Fabric Attach EXOS switches ExtremeWireless 3900 APs Hirschmann/ Belden ERS switches Zero-Touch Edge = IoT-Ready Nexans Microsens Pelco Axis
- 12. ©2017 Extreme Networks,Inc. All rights reserved©2017 Extreme Networks, Inc. All rights reserved 11x Faster time to Service with Simple Edge Provisioning and Core Automation Video Surveillance Servers Application Servers Status Quo Hop by hop provisioning Moves, adds and changes require core reconfiguration Vulnerable to human error during change Services coupled to physical topology With Extreme Edge Provisioning only Core is hands off Moves, adds and changes on the fly (no more maintenance windows) Services abstracted from topology
- 13. ©2017 Extreme Networks,Inc. All rights reserved Edge Automation with Network Access Control Video Surveillance Servers With Extreme Edge Provisioning only Core is hands off Moves, adds and changes on the fly (no more maintenance windows) Services abstracted from topology NAC Database Device Authentication through Radius Radius
- 14. ©2017 Extreme Networks,Inc. All rights reserved Elasticity: Removes Configuration Automatically IoT’s in Video Surveillance Zone IoT moved -- zone automatically expands appropriately IoT is removed -- zone is automatically contracted Video Surveillance Servers Video Surveillance Servers Video Surveillance Servers
- 15. ©2017 Extreme Networks,Inc. All rights reserved©2018 Extreme Networks, Inc. All rights reserved Secure Segmentation
- 16. ©2017 Extreme Networks,Inc. All rights reserved The NSA’s Recommendation Limit access to important systems Segment networks and data Implement application whitelisting Remove hard-coded passcodes Fabric Connect Enhances Security: The Power of Network Segmentation Rob Joyce, Chief of Tailored Access Operations US National Security Agency “A well-segmented network means if a breach occurs, it can be contained…the difference between a contained and an uncontained breach is the difference between an incident and a catastrophe”
- 17. ©2017 Extreme Networks,Inc. All rights reserved©2017 Extreme Networks, Inc. All rights reserved Enhanced Security with Hyper-Segmentation Prevents Lateral Movements Creating Dead Ends for Hackers Without Hyper-Segmentation Isolation is fragmented and limited in scale With Hyper-Segmentation Zones effortlessly reach across entire network Campus VLAN’s and ACL’s Application Servers Financial Systems Application Servers Customer / Patient Records Micro-segmentation in the data center VLAN Chaining
- 18. ©2017 Extreme Networks,Inc. All rights reserved©2017 Extreme Networks, Inc. All rights reserved Automated Security Policy-based Service Creation & Access Financial Systems Application Servers Customer / Patient Records Individual end-to-end segments deliver secure traffic separation: Hyper- Segmentation – Isolate critical applications, information or users – Denies Hackers the borderless environment that they use to hop from one compromised system to the next Security Enhanced Without Increasing Complexity
- 19. ©2017 Extreme Networks,Inc. All rights reserved©2017 Extreme Networks, Inc. All rights reserved Extreme Policy – Automated Security Security Enhanced Without Increasing Complexity Per network role defined policies Control/Policy Active Directory / LDAP Groups
- 20. ©2017 Extreme Networks,Inc. All rights reserved©2017 Extreme Networks, Inc. All rights reserved Automated Security Policy-based Service Creation & Access Financial Systems Application Servers Customer / Patient Records Individual end-to-end segments deliver secure traffic separation: Hyper- Segmentation – Isolate critical applications, information or users – Denies Hackers the borderless environment that they use to hop from one compromised system to the next Leverage Extreme policy and/or control to secure auto-attachment of Users/Devices to hyper-segment – Enables granular control over who and what has access to a segment Both hyper-segmentation and policy enforcement for auto-attach are dynamic Security Enhanced Without Increasing Complexity
- 21. ©2017 Extreme Networks,Inc. All rights reserved Video Surveillance Servers Enhanced Security with Stealth: Keeps topology hidden. What you can’t see you can’t attack Without Stealth Capability All network nodes and devices can be viewed With Stealth Capability There is no reachability in or out of a segment. Video Surveillance Cameras Financial Systems Customer / Patient Records Video Surveillance Servers Video Surveillance Cameras
- 22. ©2017 Extreme Networks,Inc. All rights reserved©2018 Extreme Networks, Inc. All rights reserved Robust and Highly Available Network
- 23. ©2017 Extreme Networks,Inc. All rights reserved©2017 Extreme Networks, Inc. All rights reserved Fabric Connect is Resilient: Delivering fast Network Recovery (typically 200ms) • Load balanced, active / active network • Full network recovery in milliseconds (L2/3, even multicast) • Eliminates the domino effect of protocol overlays • Recovers so quick that upper layer communications protocols are unaffected. Instantaneous Recovery Video Surveillance Servers Video Surveillance Cameras
- 24. ©2017 Extreme Networks,Inc. All rights reserved©2018 Extreme Networks, Inc. All rights reserved Flexible Network Topology
- 25. ©2017 Extreme Networks,Inc. All rights reserved Flexible topology with scalable Multicast support by Eliminating Complex PIM Protocols Camera Recording Multicast Application Camera Recording Multicast Application Status Quo (PIM based multicast) With Extreme (PIM free multicast) Complex to configure Slow recovery (overlays) Strains CPU Low scalability Complicated troubleshooting Simple to configure Fast recovery Fast performance Removes scalability limitations Simplified troubleshooting
- 26. ©2017 Extreme Networks,Inc. All rights reserved©2018 Extreme Networks, Inc. All rights reserved Summary Ease of operations – Automated “adds/moves/changes” – Plug & Play Refactoring should not impact network and should not require maintenance window – Automated config clean up: Residual config should be removed automatically – Rapid “time to service availability” New services should be available on demand in seconds. – Removal of Human Error element Manual interactions only at the access – Zero-touch network Network Robustness – Resilient network in case of link or system failure – Device SW changes have minimal network-wide impact – Minimalizing troubleshooting requirements Flexible Network Service Availability – Secure Zoning Separating different plant tool vendors onto securely separated zones – IP Surveillance Provide robust IP surveillance infrastructure for process and plant monitoring
- 27. ©2017 Extreme Networks,Inc. All rights reserved©2018 Extreme Networks, Inc. All rights reserved “We have already created 14 virtual networks using Fabric Connect. We can create and configure a virtual network from one side of the company to another in one hour, with zero configuration mistakes. Before the implementation this would take up the whole day, and errors were easy to make. Thanks to Fabric Connect, ŠKODA is no longer dependent on a fixed physical topology and we have reduced provisioning by 50%” – Martin Polak, Coordinator, Network Planning, ŠKODA AUTO Another SASF Example: The Power of Fabric Connect
- 28. ©2017 Extreme Networks,Inc. All rights reserved WWW.EXTREMENETWORKS.COM
Editor's Notes
- #10 Customer Study Information Source: Fabric Connect Customer Experience Research, Dynamic Markets, January 2015 We have been touting the benefits of a fabric-based network for some time now, and we felt that we wanted to quantify the benefits of the technology. So, we engaged a research company called, Dynamic Markets, to reach out to our current customer base of Fabric Connect users to measure and quantify the benefits of Fabric Connect. Each customer was interviewed and asked to report performance of their network before Fabric Connect and the performance afterward. The bottom line is that we were thrilled with the results. Customers reported that implementing the network was 11 times faster and that configuring and troubleshooting was 7 times faster. Let’s put this into perspective. If every time that you needed to configure a service, it took you nearly 5 days, but now you could do it in less than 1 day, could you think of something cool that you could do with an extra 4 days for every service that you roll out? If it takes you on average nearly 40 hours to troubleshoot issues, but you were able to drop that down to 6 hours, do you think you could find something productive do with the 34 hours of savings for every issue? Now, the next stat was particularly interesting to us. The average failover time for Fabric Connect was 320 milliseconds. Honestly, that number wasn’t surprising to us, but the “before” number was. Before implementing Fabric Connect, customers reported an average failover time of nearly 14 minutes. At first we questioned the results, then after validating with the research company we started understand what was happening. If a network is taking 30, to 60 or more seconds to recover, applications start to fail. Not only do the likely 4-6 legacy protocols have to converge together, but the applications now have to recover in order too. To keep applications up, network recoveries need to be undetectable. Now, since with Fabric Connect, you don’t have to configure the network core, we also asked about outages due to human errors. The average came out at 100% improvement with a prior average of 3 outages per year. So, full disclosure, the average time since implementation was approximately one year, so things could still happen, but nonetheless, we like the direction of the results. We have made this report public on Avaya.com; so please take a deeper read.
- #12 Campus Automation Rollout 1) Fabric attach proxy / client support on EXOS switches – EXOS 22.4 (November) 2) Fabric attach client support on ExtremeWireless 3900 APs – ExtremeWireless 10.41 (October?)
- #17 As a backdrop to our first capability, the NSA has an organization whose role is to infiltrate systems. In a recent conference, Rob Joyce, Chief of Tailored Access Operations, gave four fundamental tips to organizations to better protect their network and IT assets. Number two on the list was to segment networks and data. His reason for stating this is two fold. First, network traffic that is segmented is isolated from other traffic and unseen from outside the segment. Second, a well segmented network means that if a breach occurs, it can be contained… the difference between a contained and uncontained breach is the difference between an incident and a catastrophe. So, let’s look at hyper-segmentation… Full Quote: “If you really want to make the NSA’s life hard…limit access privileges for important systems to those who need them; segment important data to make it harder for hackers to reach your jewels; patch systems and implement application whitelisting; remove hardcoded passwords and legacy protocol that transmit passwords in the clear.” Source: — Rob Joyce, Chief of Tailored Access Operations US National Security Agency: “Disrupting Nation State Hackers”, USENIX Enigma, January 2016. https://www.usenix.org/conference/enigma2016/conference-program/presentation/joyce
- #18 Here is a depiction of how network segmentation is generally done today. VLAN’s came about to form broadcast domains at the edge of the network. Access Control Lists simply map user permissions to systems. Micro segmentation secures connections mainly between servers in a data center. Attempts to create an end-to-end segment either involves a costly and complex MPLS LAN implementation or using VLAN chaining when IT organizations configure switch-by-switch a VLAN path across the network – including configuring the network core which becomes very risky. With hyper-segmentation, only the network end-points are configured and the end-to-end control plane takes care of everything else. In fact, by just plugging a device into the network a segment can be automatically configured on the network end-point – but more on that later. Because of the ease of configuration, creating hundreds or thousands of unique virtual networks becomes practical. The limit is 16 million. Once Hyper-segments are created, organizations experience a reduction in the attack surface, a quarantine function if a segment is breached, improvement of anomaly scanning, and greater firewall efficiency. Imagine being able to have secure isolated zones for financial transactions, customer records, video surveillance, physical security, R&D groups, executives, IoT devices, kiosks, etc… And one of the best parts is yet to come.
- #19 Here is a depiction of how network segmentation is generally done today. VLAN’s came about to form broadcast domains at the edge of the network. Access Control Lists simply map user permissions to systems. Micro segmentation secures connections mainly between servers in a data center. Attempts to create an end-to-end segment either involves a costly and complex MPLS LAN implementation or using VLAN chaining when IT organizations configure switch-by-switch a VLAN path across the network – including configuring the network core which becomes very risky. With hyper-segmentation, only the network end-points are configured and the end-to-end control plane takes care of everything else. In fact, by just plugging a device into the network a segment can be automatically configured on the network end-point – but more on that later. Because of the ease of configuration, creating hundreds or thousands of unique virtual networks becomes practical. The limit is 16 million. Once Hyper-segments are created, organizations experience a reduction in the attack surface, a quarantine function if a segment is breached, improvement of anomaly scanning, and greater firewall efficiency. Imagine being able to have secure isolated zones for financial transactions, customer records, video surveillance, physical security, R&D groups, executives, IoT devices, kiosks, etc… And one of the best parts is yet to come.
- #21 Here is a depiction of how network segmentation is generally done today. VLAN’s came about to form broadcast domains at the edge of the network. Access Control Lists simply map user permissions to systems. Micro segmentation secures connections mainly between servers in a data center. Attempts to create an end-to-end segment either involves a costly and complex MPLS LAN implementation or using VLAN chaining when IT organizations configure switch-by-switch a VLAN path across the network – including configuring the network core which becomes very risky. With hyper-segmentation, only the network end-points are configured and the end-to-end control plane takes care of everything else. In fact, by just plugging a device into the network a segment can be automatically configured on the network end-point – but more on that later. Because of the ease of configuration, creating hundreds or thousands of unique virtual networks becomes practical. The limit is 16 million. Once Hyper-segments are created, organizations experience a reduction in the attack surface, a quarantine function if a segment is breached, improvement of anomaly scanning, and greater firewall efficiency. Imagine being able to have secure isolated zones for financial transactions, customer records, video surveillance, physical security, R&D groups, executives, IoT devices, kiosks, etc… And one of the best parts is yet to come.
- #22 Here is what you see without hyper-segmentation. Since IP (internet protocol) is a flood and learn technology, IP scanning tools can be used to figure out the topology of a network. Unlike traditional technology, Fabric Connect delivers hyper-segments that are not exposed to the vulnerabilities of Internet Protocol (IP). This means is that in the event the organization is breached outside of a hyper-segment, the hacker only sees darkness. If the breach is within a segment the hacker is unable to see anything outside that segment – this is important – this is difference between a simple breach and a catastrophe. Containment is key. Now, here is the big difference between our solution and others… This is where the native part becomes important. Where most companies are using firewalls to block access to data, with Fabric Connect, segment traffic is inherently invisible as it traverses the entire network. It is difficult to hack what you cannot see. So, the last capability ties it all together…