Nortel Application Switches

The Nortel Application Switch line (initially labeled with the Alteon Application Switch brand) provide traffic balancing, acceleration, and management features for the enterprise or service provider, primarily via built-in Layer 4-7 identification and filtering features. According to the vendor, the switches are able to manage the traffic of any IP-based application; supporting the creation and utilization of filters at the header, URL, cookie, or data payload inspection levels. The vendor further bills the switches as able to provide "...layer 4-7 inspection at layer 2 speeds." Up to 2,048 filters can be utilized per appliance.

The switch is commonly deployed in data centers, server farms, etc. and features "special function" load balancing support for specific server scenarios; including firewall, IDS, Web Services, VoIP, VPN, WAN Link, WAP, and RTSP load balancing. In addition to content filter-based load balancing features, the switches additionally support usr-scriptable server, link, and application health checking capabilities; allowing traffic to be routed away from servers on which the specifically targeted application is not responding properly.

The switches additionally feature security mechanisms for the blocking of DoS attacks. Standard DoS protection features include Deleayed Binding, protection from excessive ICMP, TCP, UDP, and ARP traffic, Layer 7 filters for some recognized viruses such as Nimda/Code Red, and Application Abuse Protection, which allows the administrator to limit the rate of new TCP connections to application servers on a per-client basis. Advanced DoS capabilities (a separate license) include a database of DoS attacks and TCP/UDP pattern matching capabilities, among other additional features.

Advanced traffic management capabilities are provided in the form of the Intelligent Application Traffic Management option, which allows for per-flow traffic application identification with monitoring/reporting, discarding, or rate shaping/bandwidth management capabilities. The Advanced DoS capabilities described above are a subset of Intelligent Application Traffic Management.

Four main models are currently offered in the Application Switch line; ranging from the 2208 with 8 10/100 ports and 2 SFP GBICs to the 3408 with 8 10/100/1000 ports and 4 SFP GBICs. In the center is the 2424, with 24 10/100 ports and 4 SFP GBICs and the 2216 with 16 10/100 ports and 2 SFP GBICs. A fifth model, the 2424-SSL, is the same as the 2424 but with added SSL VPN and SSL acceleration features. All the units are 1U in form; performance ranges from 600K to 2 million concurrent sessions, and 15K to 51K Layer-7 sessions per second.

New to the Application Switch line is the Symantec Intelligent Network Protection (SINP) option (which requires the Intelligent Application Traffic Management option). SINP is targeted as assisting the organization in protecting their servers from vulnerabilities between the time the vulnerability is discovered and a patch is deployed; and is therefore billed as a complement to existing network protection infrastructure. It focuses only on the blocking of threats that have been deemed severe to critical (8-10) and are able to be detected with "extremely high reliability" (10). Signatures are updated automatically via Symantec's LiveUpdate mechanism.

The Nortel Application Switches are available now; the Symantec Intelligent Network Protection option will be subscription priced and is expected to be available in June. Pricing ranges from $16,000 to $39,000 for the switch; the Intelligent Traffic Manager is priced at $12,000 per switch and the Symantec Intelligent Network Protection subscription is priced at $5,000/year.

Visit the Nortel Networks Web site for further details.