Nortel road map stresses security

Nortel next month is expected to start revitalizing its enterprise switching business by introducing a new endpoint security product, which may be followed by a series of LAN resiliency and security announcements throughout the year.

The new Secure Network Access Switch (SNAS) is an appliance that works with LAN switches to block or quarantine potentially dangerous devices without requiring permanent client software on PCs, laptops or other devices. Observers say this clientless approach gives Nortel a competitive multi-vendor network access control (NAC) offering.

"Nortel needed to do something like this," says Zeus Kerravala, an analyst with The Yankee Group. After a tumultuous year of executive shakeups, laying out a switching road map with a focus on security should help - at least somewhat - to eliminate concerns about the vendor's enterprise intentions.

How Nortel wants to upgrade switch security - Interview with Sanjeev Gupta, director of Nortel's Ethernet switching business.

Additional announcements expected from Nortel include the ability to run full Check Point firewall or Sourcefire intrusion-detection system (IDS) and intrusion-prevention system (IPS) packet inspection on every port on core Nortel switches. Also planned is near-SONET-speed failover for switches with Nortel's redundancy protocol, Split Multi-Link Trunking, as well as added support for SMLT across more product lines.

Nortel's SNAS - in beta and set for release in mid-February - is a network appliance that attaches to an aggregation-layer switch and controls network access through wiring closet-level switches at the LAN edge.

When a machine accessing a LAN requests an IP address from a local DHCP server, the connection is directed to an SNAS, which authenticates the device and downloads a temporary Java applet to the machine. This software, which deletes itself after logoff, inspects the machine and verifies its anti-virus status and other software profiles (see graphic).

"It's very easy to administer because you don't have to manage clients," says Pat Patterson, director of Nortel's enterprise security solutions group. "Most solutions we've seen that try to use a clientless approach require all traffic to go through an appliance. . . . Our approach won't screw up [a customer's] latency-sensitive traffic by creating that kind of bottleneck."

Nortel includes an endpoint security technology with its SSL VPN products, which allows users to scan and block PCs and laptops entering a corporate network through a remote connection. The SNAS brings this capability to LANs.

"We're really interested in locking down Ethernet ports," says Sheng Guo, CTO for the State of New York Unified Court System, which uses Nortel gear in all state-run courthouses and judicial offices. "This is definitely a hole that needed to be filled and something we're looking forward to."

One of the ways Guo's staff secures the network is by turning off unused LAN switch ports. But this is time-consuming and non-exact, he says. "You may be right or wrong - and if you shut down the wrong port, you can cause a lot of headaches." A system that automatically secures every port based on the device attached could help solve this issue, he says.