-: Specialized Network Devices. 2 2
Now there are many different types 3 3
of network devices out there, 4 4
and there are lots of them that are outside 5 5
of the standard routers, switches, hubs, bridges, 6 6
servers, and workstations we've already talked about. 7 7
Other devices out there are going to perform 8 8
specific functions they'll improve our usability, 9 9
our performance, or our security. 10 10
Many of these devices include things like VPN concentrators, 11 11
firewalls, proxy servers, 12 12
and content engines and switches. 13 13
We're going to talk about each of those in this lesson. 14 14
The first one we're going to cover is a VPN concentrator, 15 15
also known as a VPN head-end. 16 16
Now a VPN is a virtual private network, 17 17
and it's used to create a secure VPN 18 18
or virtual tunnel over an untrusted network 19 19
like the internet. 20 20
If you're at home and you want to be able to dial 21 21
into your office, 22 22
either over a dial up connection 23 23
or over the internet using broadband, 24 24
you can do that using a VPN connection, 25 25
which creates an encrypted tunnel 26 26
so nobody can see what you're doing, 27 27
but you get from your home to your office securely 28 28
over that public network. 29 29
Now the device that terminates this VPN tunnel 30 30
is called a VPN concentrator or VPN head-end. 31 31
This allows this device to have multiple VPN connections 32 32
coming into one location. 33 33
Now, if you have a good firewall, 34 34
most of them will have this function. 35 35
But logically, when it's doing this function, 36 36
it's still functioning, not as a firewall, 37 37
but as a VPN concentrator. 38 38
So keep that in mind for the exam. 39 39
The VPN concentrator is this function. 40 40
It can be a device or part of another device 41 41
like a UTM or a firewall as well. 42 42
Now if I have a headquarters 43 43
in Washington, DC, for example, 44 44
and I have two other branch offices 45 45
in Los Angeles and New York, 46 46
I can actually tunnel all the traffic 47 47
from Los Angeles and New York 48 48
back to DC using these tunnels. 49 49
In this case, I would use 50 50
what's known as a site to site tunnel. 51 51
These would allow those locations to connect back 52 52
to my headquarters securely through the internet 53 53
and save me the cost of having to use leased lines. 54 54
Now when you hear the term VPN head-end, 55 55
remember this is a specific type of VPN concentrator, 56 56
and it's used to terminate IPSec VPN tunnels 57 57
within a router or another device. 58 58
Again, we're going to talk more about VPNs 59 59
and VPN security in a separate lesson, 60 60
because they're really important to the security 61 61
of our networks and there's a lot to cover there. 62 62
The next thing we're going to talk about is a firewall. 63 63
Now a firewall is a network security appliance 64 64
that's placed at the boundary of your network. 65 65
Firewalls can be either software or hardware, 66 66
and they come in stateful and stateless methods. 67 67
We're going to talk more about firewalls in depth 68 68
in their own video, but for now, 69 69
I just want you to remember that firewalls 70 70
allow traffic to go from inside your network 71 71
to outside your network like to the internet 72 72
and they can block stuff coming from outside your network, 73 73
like the internet, to the inside of your network. 74 74
Now on the screen, 75 75
I have three different ways to show you 76 76
how firewalls will look inside of network diagrams. 77 77
The first way is what Cisco likes to use. 78 78
They call this a Pix firewall 79 79
cause that's their brand of firewall 80 80
and it almost looks like a diode with a triangle 81 81
and a line on it. 82 82
A diode is essentially an electrical component 83 83
that only lets things go one direction, 84 84
which is why they represent a firewall in this way. 85 85
Now the next one that some people will use 86 86
is just to put a brick wall in their diagrams 87 87
and that will represent a firewall. 88 88
The third thing we can use is have your firewall 89 89
combined with your router and basically make it look like 90 90
a router with a brick wall wrapped around it. 91 91
These are the three ways you'll see it in network diagrams 92 92
when you're looking at firewalls. 93 93
All three of these icons are used to demonstrate 94 94
that there's a firewall there inside your diagram 95 95
and most of the time, 96 96
what you're going to see is that brick wall. 97 97
That's pretty much the standard these days. 98 98
Besides a regular firewall, 99 99
we have these things called NGFWs 100 100
or next generation or next gen firewalls. 101 101
These can conduct deep packet inspection at layer seven. 102 102
A regular firewall is really going to block things 103 103
based on your IP address and maybe the port and protocol, 104 104
but these next generation firewalls, 105 105
they can look through your traffic 106 106
to detect and prevent attacks. 107 107
They are much more powerful 108 108
than your basic stateless firewall 109 109
or even your stateful firewalls. 110 110
They're continually going to be connected 111 111
to the cloud resources, get the latest threat information, 112 112
to be able to make sure they know what those signatures are 113 113
to do that deep inspection. 114 114
Again, we're going to talk a lot more about firewalls 115 115
in their own lesson. 116 116
Next, we have IDS and IPS, 117 117
which is intrusion detection systems 118 118
or intrusion prevention systems. 119 119
IDS' and IPS' can recognize attacks 120 120
through signatures and anomalies. 121 121
They can also recognize and respond if they're an IPS. 122 122
Now a detection one can only see it and log it. 123 123
But if you're using a protection one, 124 124
they can actually see it, log it, 125 125
and then try to stop it by shutting off ports and protocols. 126 126
These IDS and IPS' 127 127
can be host based or network based devices, 128 128
depending on how you want to set it up in your network. 129 129
And they're going to be on one of these two lines 130 130
going left and right with a circle through them. 131 131
This is considered an IDS or an IPS sensor, 132 132
and it's the same diagram that's going to be used 133 133
for both of these devices. 134 134
The only difference is you'll see an IDS or IPS written 135 135
on it to dictate which one it is and the diagram. 136 136
Again, we're going to talk more about IDS and IPS in-depth 137 137
in their own video because they're really important 138 138
to the security of our networks. 139 139
Next, we have a proxy server 140 140
and this is another type of specialized device 141 141
and this one is going to make request to an external network 142 142
on behalf of a client. 143 143
Essentially, it's a middleman or a go between. 144 144
Now, why would we want to do that? 145 145
Well, there's really two functions. 146 146
The first was for security because 147 147
it can perform content filtering and logging. 148 148
On my network, I have a proxy server in my home network. 149 149
So if my kids are trying to go online, 150 150
it actually goes to the proxy server first. 151 151
It checks what's allowable for them 152 152
and then it decides whether or not 153 153
to let them go out or not. 154 154
For instance, if they tried to go to a pornographic website, 155 155
it's going to block that. 156 156
They try to go to Disney channel, 157 157
it's going to allow that. 158 158
Now workstation clients are going to be configured 159 159
so that all their traffic is going to have to go 160 160
through a proxy server in your corporate network. 161 161
Here, you can see this on the diagram 162 162
that if my son's computer and he wants to go make a request, 163 163
he's going to go to the proxy server. 164 164
Then the proxy server is going to check 165 165
if it's on the allowable list. 166 166
If it is, it goes out to something like disneychannel.com, 167 167
gets the information, brings it back to the proxy server 168 168
and then the proxy server gives it back to my kid. 169 169
That would be function one. 170 170
Now the second function of a proxy server 171 171
is they can have a cache in there 172 172
that can actually store a copy of that information 173 173
that was requested by the user. 174 174
In my case, I have two kids. 175 175
Let's say my son goes to Disney Channel 176 176
and then right after, 177 177
my other son decides he wants to go to Disney Channel. 178 178
Well, the proxy server already made that request 179 179
and has it locally. 180 180
So once he gave it to my first son, 181 181
it can then give it to my other son 182 182
without even having to go back out to the internet again 183 183
and this saves bandwidth and saves resources and time. 184 184
Proxy servers are really good at that, 185 185
but they are not the best. 186 186
Instead, we have another device out there 187 187
which is called a content engine. 188 188
These are dedicated devices that are there 189 189
just to do cashing functions of a proxy server. 190 190
They're basically more efficient than a proxy server 191 191
when it comes to caching and we call them content engines 192 192
or caching engines. 193 193
Where there's really going to be a big benefit here 194 194
is if you have a big headquarters 195 195
with a big beefy internet pipe, 196 196
but then you have the small branch office 197 197
kind of in the middle of nowhere. 198 198
It's really expensive for a good internet connection. 199 199
If you have a lot of data that goes across a small pipe 200 200
like a VPN or a lease line, 201 201
this can actually be a big data bog 202 202
and slow down inside of your network. 203 203
So what you'd want to do is put a content engine 204 204
at the branch office. 205 205
This way in the middle of the night, 206 206
the headquarters can actually sync up data 207 207
and update that content engine and then during the day, 208 208
anytime somebody requests that information, 209 209
they get it locally from that office 210 210
with the content engine 211 211
and that way they're getting over a gigabit ethernet 212 212
instead of going up a slow dial up 213 213
or at least line connection back to the head office. 214 214
Now, this is a very, very useful thing to use 215 215
inside a remote branch office. 216 216
Otherwise, if you're in a big headquarters 217 217
and there's a big branch office that has a big pipe, 218 218
you probably don't need a content engine 219 219
because you can just go out over the large connection 220 220
of the WAN and get that information from the headquarters. 221 221
Again, if you're trying to speed up local access, 222 222
content engines are really good for that. 223 223
Next, we have a content switch. 224 224
This is also known as a load balancer. 225 225
Now a content switch or load balancer is going to distribute 226 226
your incoming requests across various servers 227 227
in a server farm. 228 228
This is why we call it a load balancer 229 229
because they're balancing the load. 230 230
Now, why do we need these? 231 231
Well, let's take the example of amazon.com. 232 232
Do you think amazon.com 233 233
can handle all of the amount of traffic 234 234
it gets on a daily basis with just one physical server? 235 235
Of course not. 236 236
They have millions of users accessing their content 237 237
all at the same time. 238 238
Instead they have server farms with hundreds 239 239
and thousands of servers out there. 240 240
And all these have to be able to answer up 241 241
for a single domain name, amazon.com. 242 242
And that's where the content switch comes in. 243 243
When you go to amazon.com, 244 244
it actually goes through their router 245 245
and to their content switch. 246 246
And then it starts handing out those requests 247 247
to different servers. 248 248
If it's a big task, 249 249
it might actually split that up across 20 different servers. 250 250
For example, if I have a big task at work to do, 251 251
I can actually break that down into pieces 252 252
and give it out to 20 different people 253 253
to help me get it done. 254 254
In this case, I will be acting as the content switch. 255 255
I break the load down to small parts and hand it out. 256 256
So my boss comes to me and said hey, 257 257
here are a hundred things I need done. 258 258
I would then break those apart and give four or five 259 259
to each person and hand them out 260 260
and that way they can start doing the work. 261 261
When they're done with it, they hand it back to me. 262 262
I consolidate it and then I give it back to my boss. 263 263
That's essentially what a content switch is doing. 264 264
It's handing out those requests to different people 265 265
based on their ability to perform the workload. 266 266
In this case, those people are servers. 267 267
That's exactly what a load balancer or content switch does. 268 268
It's going to send the request and distribute the workload 269 269
across all the different servers 270 270
in order to provide the best response times 271 271
and prevent a single server from becoming too overloaded.