Alcatel Automated Quarantine Engine User manual

Do you long for the time when the biggest demand on your IT department was from
users who needed help retrieving forgotten passwords?
While IT life may never be quite that simple again, Alcatel’s Automated Quarantine
Engine (AQE) can help you eliminate your biggest headache – security issues from
non-compliant external and internal devices by containing and isolating all security
threats to your enterprise network, and doing it in seconds!
Sound expensive? Actually, it will save you money because:
There’s no additional hardware required on Alcatel switches
There’s no additional software required on Alcatel switches
It’s fully interoperable with other vendor switches
It cuts network downtime keeping employees up and running
So how does this work? A good analogy is what has happened in the travel industry over
the past few years. For example, a few years ago when you arrived at an airport, you
would get in a check-in line that wrapped back-and-forth endlessly. Ticketing and check-in
was a labor and time intensive operation. Airlines realized that if they could offload labor to
an automated check-in process, that they could save money by cutting staff costs, and help
passengers by expediting the process.
Now, most travelers are able to walk up to an airline’s kiosk, insert an identification card
such as a driver’s license, select a seat, and get a boarding pass in less than a minute and
be on their way. Problem passengers are isolated and required to check-in via an agent, but
only as a last resort, saving the airline money, and most passengers a great deal of time.
Your network security should be this automated and fast!
Automated Quarantine Engine
The automatic isolation of non-compliant network devices

> 4 ALCATEL
Enterprise security today
Most enterprise networks constantly struggle with new security threats from
outside as well as within. All it takes is one contaminated device with a
virus or worm to infect the network within minutes and take
it down for hours or days, tying up IT resources and
frustrating users.
For example, the IT staff works on identifying the signature
and locates the user manually with available tools. Once
identified, the user is denied network access, doesn’t
understand why so he moves to another port, continuing to
spread the virus. Again, the IT staff tries to contain the virus
and manually loads patches to infected computers, playing
a never-ending game of catch-up. Add to this mix wireless
users and your staff stays busy putting out infections and trying to prevent
unauthorized access instead of focusing on projects that are more productive.
Automated Quarantine Engine
To address these security issues, Alcatel offers the Automated Quarantine
Engine (AQE). AQE is a combination of hardware and software, which
provides an automated mechanism that denies access to an endpoint that is
not secure to the network infrastructure, including wireless devices. The AQE is
designed to actively poll the network and quarantine network devices that
have violated any security policy as detected by an intrusion detection /
prevention system (IDS/IPS). These policies can be any or a combination
of the following:
• Virus related signatures (traffic patterns)
• Blocked web sites
• Hacker attempts (traffic indicating an attempt to launch
an attack)
• Violation of any policies that have been set up in the IDS
AQE is designed to push the front-line of security out to the
edge of the network to find insecure network devices before
they can negatively affect the network and isolate the
infected machines at the point of entry, the edge port.
For example, the following diagram shows an infected
station attacking a sever (e.g., port scan). IDP identifies the
attack and source of attack. IDP then notifies OmniVista of
the type of attack, and the source of the attack. The user is
moved into a quarantine VLAN or denied network access.
Typical virus containment solution
Alcatel’s trusted network intrusion prevention
through network response.

ALCATEL 5 >
The network then identifies the problem and automatically downloads the necessary patches.
When the threat is dealt with, AQE automatically allows the device to rejoin the network.
This active approach contains and eliminates security threats that could not normally be
handled by any single portion of the network.
The benefits of AQE
AQE transparently and dynamically applies policies to an individual switched port based on
the device or user accessing the port. The automatic reconfiguration reduces the response
time to security threats and removes the need to have a network engineer create and apply
a policy (VLAN, ACL) to manage network access, which minimizes the need for manual
configuration and application of network user policies.
Furthermore, AQE does not require any additional network software or hardware beyond
the basic Alcatel switch from a network infrastructure viewpoint, and is fully interoperable
with other vendors’ switches.
Once implemented AQE reduces operating expenses, automates configuration of edge-port
security parameters, and allows for mobility of users at the edge of the network – minimizing
configuration changes when users move.
Why Alcatel?
Ask your current vendor if they can automatically contain a rouge or non-compliant device,
isolate it and have the network diagnose the device and automatically load the necessary
patches. Ask if they provide self-help such that the user doesn’t require any intervention
on the part of IT! Odds are, your current vendors locks the offending device out of the
network, leaving it to hang until someone from IT can get around to manually cleaning and
inspecting the offending device. Only Alcatel provides self healing, just like the self-help
kiosks at the airport! In seconds, the user is on his way to connecting to the network without
any IT intervention.
To find out more about how Alcatel’s AQE can automatically protect your network, contact
your local Alcatel representative or visit: www.alcatel.com/enterprise
Automated Quarantine Engine

Product specifications contained in this document are subject to change without notice. Contact your local Alcatel
representative for the most current information. Copyright © 2004 Alcatel Internetworking, Inc. All rights reserved.
This document may not be reproduced in whole or in part without the expressed written permission of Alcatel
Internetworking, Inc. Alcatel®and the Alcatel logo are registered trademarks of Alcatel. All other trademarks are the
property of their respective owners.
P/N 031551-00. 11/04
Alcatel
26801 West Agoura Road
Calabasas, CA 91301 USA
Contact Center
[phone] US/Canada
[phone] Outside US
www.alcatel.com/enterprise