Go to:

IT Jobs

Hewlett Packard has extended its ProCurve networking family onto the wide area network by announcing its first WAN routers. The company also said that it had enhanced the security of its network edge products via an access control module that added wired and wireless LAN security to a ProCurve 5300xl switch.

The ProCurve 7000 series WAN routers are designed to connect small to mid-size branch offices back to a central site. They support multiple carrier WAN links, with VPN capabilities and a built-in firewall. HP claimed that they provide standard WAN routing protocols and security features, but cost 40 percent to 50 percent less than competing Cisco branch-office routers.

Also new is a module for the ProCurve 5300 series switches, which gives every port on the box WLAN switch features, such as WLAN client authentication, fast access-point-to-access-point connection hand-off, and security features such as 802.1x and encryption. This removes the need for separate WLAN switches such as HP's ProCurve 700wl, said Bill Johnson, director of R&D at HP Labs.

"Putting access control inside the switch gives much higher performance," he said. "The 5300 now looks very much like a wireless switch. Currently it doesn't have RF control, but that is something we are concerned about and are investigating."

He added that the €3999 access control module (ACM) can work alongside a PoE module in the 5300, to power wireless access points. It can also secure wired ports, for example to provide visitors with Internet access via a dedicated VLAN.

The 7102dl, which is comparable to Cisco's 1700 or 2600 series routers and costs from €1273, has two WAN interface slots, up to 128MB of memory, and can support a maximum of four T-1 links. The 7203dl has three WAN slots, with support for up to eight T-1s, and up to 256MB of RAM. The 7203dl chassis can be outfitted with a redundant power supply and is priced from €2548. HP said that both come with lifetime warranties, so they do not need service contracts, unlike Cisco equivalents.

Both 7000 series routers include a stateful packet-inspection firewall and can be upgraded to support remote access or site-to-site VPNs via a daughtercard. The VPN acceleration card supports IPSec VPNs and point-to-point protocol tunnelling.

"The WAN has become the edge of the network, so it needs some management," Johnson said. "It's impossible to address the WAN without rich security."

In addition to basic WAN, VPN and firewall features, the 7000 series therefore includes management features, that HP claimed were unique to the devices. One feature is the ability to load multiple router operating system images on a single box. This lets a technician roll back a router configuration to a previous version if something goes wrong during a software upgrade.

Johnson also discussed a free software update software for the 5300xl that enables it to throttle back network ports where abnormal traffic blasts are detected. This provides a first line of defence against virus attacks at the critical "day zero" start of an outbreak, before new anti-virus signatures can be developed and deployed.

He said that the anti-virus throttle works on the basis that infected machines try to contact others much more often than healthy machines. For example, a machine with SQL-Slammer makes more than 800 connection attempts a second - the virus infected 75,000 servers worldwide in its first 30 minutes.

"The throttling technology builds a model of normal behaviour over time, and then looks for deviations," said Johnson. "For example, some network ports do make thousands of connections normally, and you don't want to block those."

He added that HP plans to move more and more functionality inside its network switches. "Five years from now, the ACM features will be integrated into the switch ASIC," he said. "But we have new ideas for other things to run on a similar module." These include a RADIUS server and sFlow traffic monitoring, he added.

According to HP, the new hardware should become available in April, and the virus throttle software for the 5300xl is downloadable now.

Read more of our interview with Bill Johnson here.

Latest White Papers

Ten top problems network technicians encounter
>> Download whitepaper

Are all VoIP services the same?
>> Download whitepaper

Brocade solution guide: Deploying PoE and PoE+ solutions in the campus network
>> Download whitepaper