Stallion Event World Leading Application Delivery Controllers 1

Stallion Event World Leading Application Delivery Controllers 1

Agenda A10 Networks Presentation The Engine: ACOS AX Series SLB and ADC Features IPv6 Features - SLB-PT IPv6 Features - LSN/CGN IPv6 Features - DS-Lite IPv6 Features - NAT64/DNS64 2

A10 Networks Company Overview Mission: The technology leader in Web Application Delivery solutions Focus: AX Series: Application Delivery Controller (ADC) Advanced Core OS (ACOS): The platform enabling technology World class engineering and experienced field teams Founder/CEO: Lee Chen - Co-founder of Foundry Networks and Centillion Headquarters: San Jose, California Expanding rapidly: Cash-flow positive, 850 AX Series customers 15 consecutive growth quarters 157% Growth between 2009 et 2010 2007 2008 2007 2008 2009 3 2010 A10 Networks CONFIDENTIAL

Three Strategic Focus Areas LSN (Large Scale NAT) Dual-Stack Lite SLB-PT NAT64/DNS64 Improve User Experience Reduce Infrastructure Increase Availability 4

Single Solution, Differentiated Value Application Delivery IPv6 Transition Cloud Computing & Virtualization Improve User Experience LSN (Large Scale NAT) L2/L3 Virtualization Reduce Infrastructure Dual-Stack Lite Soft-AX Increase Availability SLB-PT AX-V NAT64/DNS64 Virtual Chassis 5

AX Series Sample Customers Florence County 6

The Engine: ACOS 7

ACOS Highly Efficient Advanced Core Operating System (ACOS) Best Combination of Software and Hardware 64 bit Memory, processing & I/O efficiency More user connections per unit Faster application access Hardware off-load and acceleration Less Servers, Rack Space, Power, Cooling, Server Licenses Reduced Operating Costs Scalable Symmetrical MultiProcessing (SSMP) Highest industry performance Maximum headroom for growth 8

Superior System Design & Architecture SSL Acceleration Module – SSL Processing Application Memory – Session Tables, Buffer Memory, Application Data L4-7 CPUs – L4-7 Processing, Security Control Kernel – CLI, GUI, Management Tasks and Health Checking Flexible Traffic ASIC (FTA) – Distributes Traffic Across L4-7 CPUs, Efficient Network I/O, DDoS Switching & Routing ASIC – L2 & L3 Processing and Security 9

Superior System Design & Architecture AX Series Shared Memory Replicate to each core’s dedicated memory All other platforms today 10

AX Series 11

AX Series Appliances AX 1000 Throughput: 4 Gb AX 2500 Throughput: 10 Gb AX 3000-GC Throughput: 24 Gb AX 2200 Throughput: 7.4 Gb AX 3200 Throughput: 8.7 Gb AX 5100 Throughput: 40 Gb AX 5200 Throughput: 40 Gb AX 2600-GC Throughput: 18 Gb 12

AX Series Enterprise Class Performance Chart AX 1000 AX 2500 AX 2600 AX 3000 4 Gb 10 Gb 18 Gb 22 Gb Layer 4 CPS 153,000 300,000 355,000 440,000 Layer 7 RPS (unlimited CR) 275,000 700,000 740,000 800,000 DDoS Protection (SYN Flood) SYN/Sec 1 million 2.1 million 2.3 million 2.6 million SSL CPS 5,500 7,900 11,000 11,000 SSL TPS (10 transactions/conn) 18,000 57,000 85,000 85,000 SSL Bulk Throughput 1.2 Gb 1.2 Gb 2 Gb 2 Gb Application Throughput 13

AX Series Carrier Class Performance Chart AX 2200 AX 3200 AX 5100 AX 5200 7.4 Gb 8.7 Gb 40 Gb 40 Gb Layer 4 CPS 302,000 541,000 2,000,000 3,020,000 Layer 7 RPS (unlimited CR) 750,000 1,507,000 1,400,000 3,200,000 5.6 million* 9.24 million* 50 million* 50 million* SSL CPS 16,000 29,000 Option Option SSL TPS (10 transactions/conn) 45,000 90,000 Option Option SSL Bulk Throughput 1.3 Gb 2 Gb Option Option Application Throughput DDoS Protection (SYN Flood) SYN/Sec * 0% CPU utilization 14

Management 15

Manageability Flexible Configuration Powerful External Healthchecks Python, Perl, TCL, Bash Multi Layer aFleX Cisco Like CLI Simple to use GUI TCL based Application Control aXAPI REST Format Quicker implementation than SOAP Less code Less complex Easier to understand/support 16

Virtualization: Layer 2/3 Virtualization Solution for AX Virtualization Expanded capability within Application Delivery Partitions (ADPs) for 64-bit platforms Granular Layer 2/3 network virtualization per ADP Completely separate from those in other partitions, each ADP (up to 128) has has its own: Layer 2 Virtual resources MAC table and ARP table IPv4 and IPv6 route tables VLANs, Ethernet (VE) interfaces & Static MAC entries Layer 3 resources IP addresses, ARP entries & Routing tables 17

Virtualization: Layer 2/3 Virtualization Benefits for AX Virtualization High performance multitenancy between applications & organizations Reduces the number of Application Delivery Controllers required Cost-effective production quality multi-tenancy Eases transition to multitenant configurations No virtualization (hypervisor) performance penalty Management complexity Integrated natively to ACOS, no 3rd party software/licenses 18

AX Series Virtualization Products SoftAX AX-V Appliance AX virtual machine (VM) on commodity hardware Powers multiple AX virtual machines AX Virtual Chassis Scale multiple AX devices 19

SLB and ADC Features 20

The AX Series Solution Load Balance any IP protocol For availability For scalability For performance Accelerate servers by off-loading computationally intensive functions Faster end user experience Reduce number of servers 21

Server Load Balancing Monitor Server Health Load Balancing Round Robin Least Connections Fastest Response Weighted Priority Session Persistence TCP Level Health Checks Application Layer Health Checks HTTP and HTTPS Scriptable Health Checks External Health Checks Source IP Cookie-based SSL Session ID URL AX Redundancy Active/active or Active/passive 22

GSLB – Global Server Load Balancing a.k.a. Intelligent DNS DNS Proxy Disaster recovery AX AX AX Site 1 Disaster Recovery Multi-Site Load Balancing Send client connections to the datacenter with the highest combined score Most active servers Send client connection to the datacenter with the most available capacity Weighted values Site 2 Send client connections to the fastest responding datacenter Session capacity Provide extra level of High availability to important applications RTT AX This method is the most commonly used global server load balancing as it does not disrupt customers’ existing name resolution Send client connections to the datacenter with the most available active servers Geo-location Send client connection to the “closest” datacenter 23

Optimize Your Application Delivery TCP Optimization Compression Static and Dynamic Caching SSL Acceleration and termination Source IP Req Rate Limiting DNS RAM Caching DNSSEC Support aFleX Rules 24

TCP Offload 25

TCP Connection Reuse 26

Compression HTTP & HTTPS Compatible with all modern day web browsers Reduce the amount of data and packets being sent to the client Offload compression from the servers Improve client access performance over the WAN 27

Static and Dynamic Caching Additional Request Initial Request 28

High Performance SSL Acceleration Hardware based SSL Processing Eliminate CPU intensive server-based SSL Recover server resources Improve server capacity Central Certificate Management Eliminate need for server certificates Simplify certificate management 29

Dynamic Traffic Management and Protection: Geo-location Based Connection Limiting per VIP Solution Connection Limits based on geographic location lists Mitigate DDoS attacks from specific countries or regions automatically Benefit Regional traffic flows unhindered. Prioritize traffic from specific regions 30

Dynamic Traffic Management and Protection: Selective DNS Caching Solution allows per VIP caching Granular DNS caching polices, e.g. on a per domain basis Selective caching based on preconfigured limits & query criteria Transparent to the user Previously on a global basis only Benefits: DNS server off-load Automatic addition of performance as needed Users have uninterrupted DNS availability Responsive during unexpected traffic conditions or attacks 31

Innovation: DNS Application Firewall Reduce load and servers up to 70% For Large DNS Infrastructures Legitimate DNS protocol traffic only, surge protection and increased capacity Increased security for backend servers Quarantine malicious traffic for inspection and mitigate DDoS attacks 32

DNSSEC Support Compatibility Benefits High Performance solution to minimize increased DNSSEC overhead No interruption of service transitioning to DNSSEC Validated by VeriSign 33

Flexibility aFleX - ADVANCED SCRIPTING Inspect all application traffic types beyond traditional Layer 4-7 Looks into application traffic flow to identify decision criteria Switch, drop, or redirect based on aFleX policies aFlex development environment simplifies policy creation and maintenance 34

IPv6 Features 35

Classic NAT for Server Load Balancing Network Address Translation (NAT) is critical feature for server load balancing The AX offers multiple types of NAT Destination NAT (half-NAT): Dst IP changed from VIP to real server IP Source NAT (full-NAT): Both Src IP and Dst IP are changed so traffic comes back to AX Reverse NAT: Translates real server’s private IP to public IP allowing real server to initiate session to clients Direct Server Return (DSR): Only the destination MAC is NAT’ed, the DST IP is still the VIP 36

Advanced NAT: Carrier IPv6 Transition Solution Traditional NAT/NAPT SLB-PT IPv4-IPv4 Dual-stack lite NAT IPv6 VIP - IPv4 Servers IPv4 VIP - IPv6 Servers Combination modes Large Scale NAT (LSN) - also known as Carrier-Grade NAT (CGN) IPv4-IPv4 with ALGs for FTP, RTSP, MMS, SIP Large Scale NAT IPv6 NAT-PT/NAT64 IPv4-IPv6, IPv6-IPv4 37

SLB-PT/SLB-IPv6 38

SLB-PT (SLB - with Protocol Translation) Same high performance SLB, but with address family translation Facilitates transition to IPv6 Enterprises Content Providers Various modes IPv4 VIP - IPv6 Real Servers IPv6 VIP - IPv4 Real Servers IPv4 VIP - Combination of IPv4 and IPv6 Real Servers IPv6 VIP - Combination of IPv6 and IPv4 Real Servers 39

SLB-PT – Topology IPv4 Content (IPv4 Servers) AX SLB-PT IPv6 VIP IPv4 Internet IPv6 Internet IPv4 Clients IPv6 Clients 40

SLB-PT – Full Topology IPv4 and IPv6 Servers AX SLB-PT IPv4 VIP IPv4 Internet IPv4 Clients AX SLB-PT IPv6 VIP IPv6 Internet IPv6 Clients 41

LSN / CGN 42

Large Scale NAT (LSN/CGN) Solutions ? IPv6 Long term solution Large Scale NAT Proposed (Interim) Solution Adoption underway but still a long way to go IPv4-only nodes and content will still be around Also known as Carrier-Grade NAT What is Large Scale NAT ? Sharing of “Public” IPv4 addresses among multiple customers 43

Large Scale NAT Topology (NAT444) Two Layer of NAT Customer Premise Equipment NAT (Proprietary NAT) Service Provider NAT (LSN) Public IPv4 Internet Large Scale NAT Provider Private IPv4 Network CPE NAT CPE NAT Consumer Private IPv4 44

Large Scale NAT Topology (NAT44) Single Layer of NAT Provider assigned end devices Ideal for mobile handsets Public IPv4 Internet Large Scale NAT Provider Private IPv4 Network 45

Traditional NAT issues Needs ALG’s in some cases for applications which embed information in the packet (e.g DNS, FTP, SIP, MMS, RTSP, etc) Encryption can hide information required for correct Nat operation All forward and reverse traffic needs go through the same device. Logging of translations for auditing purposes. Needs to be well thought out to cope with traffic volumes 46

Solution: Large Scale NAT (LSN/CGN) Requirements for an ISP NAT device ? Highly transparent Well defined NAT behavior so that new user applications can easily be developed Consistent Deterministic Fairness in resource sharing so that existing user applications continue to work Minimal to no impact on customers User guarantees and protection Works for both client-server (traditional) and clientclient (P2P) applications 47

Large Scale NAT (LSN/CGN) Based on the following IETF RFCs and Drafts LSN Advanced NAT Features BEHAVE-TCP (RFC 5382) BEHAVE-UDP (RFC 4787) BEHAVE-ICMP (draft-ietf-behave-nat-icmp-09) CGN (draft-nishitani-cgn-00) Sticky Internal IP to External IP mapping Full Cone NAT Hair-pinning support Fairness in sharing the resources – User Quotas Tolerance for various kinds of traffic patterns and protocol behavior As a requirement for Carriers, LSN is the NAT engine embedded in all the IPv6 transition protocols 48

LSN features – AX LSN scalability # LSN sessions # New LSN sessions/sec LSN pool IPs LSN Throughput AX5200 128 M 1.5 M 10K 40Gbps AX5100 128 M 1.0 M AX3000 64 M 175 K AX2600 32 M 145 K AX2500 32 M 125 K (default 2k)1 10K (default 2k)1 4K (default 500)1 2K (default 500)1 2K (default 500)1 40Gbps 22Gbps 18Gbps 10Gbps LSN pools/groups All AX platforms: 500 LSN pools (list of public IP@) 200 LSN groups (group of individual LSN pools) Each LSN group can have up to 25 individual pools 49

Large Scale NAT (LSN/CGN) Advantage – Helps ISPs continue growing their business by temporarily alleviating the IPv4 address shortage issue Disadvantages/Considerations – Double NAT – Two layers of NAT Addressing issues NAT in the ISP network NAT in the customer premises Private address conflict on NAT in customer premise Subnets on ISP and customer side need to be different Limited number of RFC 1918 addresses Does not provide a transition path to IPv6 Proposed Alternative: Dual-Stack Lite (DSLite) 50

DS-Lite 51

But LSN alone is just a solution to wait, not a real transition step Two separate options/networks 52

Dual-Stack Lite (DSLite) IETF Draft - draft-ietf-softwire-dual-stack-lite-02 Leverages LSN to scale IPv4 addresses But provides a strong IPv6 transition path Alleviates the addressing issues with native LSN Single NAT device (only in the ISP domain) Enables incremental IPv6 deployment Simplifies management of the service provider network by having only one layer of NAT and more IPv6-only equipment in the network 53

Dual-Stack Lite (DSLite) – Core Concepts Large Scale NAT (LSN) device to handle IPv4 address scaling in the provider network ISP network is IPv6-only ISP only assigns IPv6 addresses to Customer Premises Equipment (CPE) access routers Transparent to the end customers (they can continue to use IPv4) Communication between the CPE and CGN is over IPv4-in-IPv6 packets Provides service to increased number of users without having to deploy multiple levels of NAT Supports both native IPv6 and traditional IPv4 concurrently 54

DS-Lite Solutions Allow IPv4 Clients to Connect Over the Service Provider IPv6 Network to the IPv4 Internet Support legacy IPv4 clients on new IPv6 network 55

The AX Series DS-Lite Solution Enables IPv6 Deployment The AX Series communicates with the service provider IPv6 and the IPv4 networks 56

DS-Lite features – AX DS-Lite scalability # DS-Lite sessions # New DS-Lite sessions/sec AX5200 64 M 1.0 M AX5100 64 M 650K AX3000 32 M 120 K AX2600 16 M 100 K AX2500 16 M 85 K DS-Lite pool IPs DS-Lite Throughput 10K 40Gbps (default 2k)1 10K 40Gbps (default 2k)1 4K 22Gbps (default 500)1 2K 18Gbps (default 500)1 2K 10Gbps (default 500)1 DS-Lite pools/groups All AX platforms: 500 LSN pools (list of public IP@) 200 LSN groups (group of individual LSN pools) Each LSN group can have up to 25 individual pools 57

NAT64 58

Enterprise IPv6 Solution NAT64 Advantage : Considerations : Enterprise LAN/WAN can be in full IPv6 IPv6 makes easier the Enterprise Consolidation (Multiple private LANs concatenation) But what about IPv4 Internet Enterprise needs ? Proposed Solution: NAT64 & DNS64 59

IETF-71 Philadelphia – 1st NAT-PT Worked with Comcast Double-NAT Project using 2 AX2200s All attendees would access the v4 internet through a wireless access point The 2 AX’s provided the IPv4-IPv6 and IPv6-IPv4 translation Ran for the duration of the conference without any issues 60

IPv6 and DNS IPv4 Hostname to IP Address IP Address to Hostname IPv6 A Record: AAAA Record: www.abc.test A 192.168.1.30 www.abc.test A AAA 2001:db8:c18:1::2 PTR Record: PTR Record: 30.1.168.192.in-addr-arpa. PTR www.abc.test 2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.0.0.0.8.1.c.0. 8.b.d.0.1.0.0.2.ip6.arpa PTR www.abc.test 61

NAT64 & DNS64 IETF standard track draft-ietf-behave-v6v4-xlate-stateful-xx (NAT64) draft-ietf-behave-dns64-xx (DNS64) NAT64 is a mechanism for translating IPv6 packets to IPv4 packets and vice-versa. DNS64 is a mechanism for synthesizing AAAA records from A records. The synthesis is done by adding a IPv6 prefix to the IPv4 address to create an IPv6 address. These two mechanisms together enable client-server communication between an IPv6-only client and an IPv4only server. 62

NAT64 & DNS64 Topology AAAA www.example.com Error AAAA Query www.example.com A www.example.com 192.2.0.33 AAAA Response: 2001:DB8:122:344::192:0:2:33 IPv6 Network DNS64 IPv4 Internet IPv6 Clients www.example.com 192.2.0.33 NAT64 DNS64 owns IPv6 Prefix 2001:DB8:122:344:::/96 63

NAT64 & DNS64 Topology IPv6 Clients DNS64 IPv4 Internet www.example.com 192.2.0.33 SIP: 2002:ACE:888:007::101:1024 DIP 2001:DB8:122:344::192:0:2:33:80 NAT64 SIP: 204.16.75.101:1024 DIP : 192.0.2.33:80 NAT64 owns IPv4 Address Pool 204.16.75.0/24 64

Features of NAT64 and DNS64 Supports peer-to-peer communication between IPv4 and IPv6 nodes, including the ability for IPv4 nodes to initiate communication with IPv6 nodes. End Point Independent Mapping and Filtering Full Cone NAT Support for DNSSEC (Roadmap) Support for IPSec (Roadmap) 65

Summary 66

Summary A10 has the most suitable, cost effective platform to deploy NAT and IPv6 Solutions A10 has carrier capable IPv6 and NAT solutions for deployment into carrier networks TODAY Evaluations and Demonstrations have been under way since 2007 Development of IPv6 and NAT solutions have been carried out in conjunction with Carrier customers using real requirements. We continue to develop new features and deploy them rapidly 67

Q&A Stefaan Eens Channel Manager EMEA [email protected] 32 478 25 90 16 Mischa PETERS SE Northern EMEA [email protected] 31 6 2181 8161 Manuel MARTINEZ Presenter [email protected] 68

AX Series Deployement modes 69

Deployment Considerations 64.x.x.x Router 192.168.x.x Load Balancer 1. Routed Mode 2. One-Arm Mode Load Balancer 192.168.x.x Router 192.168.x.x Servers Router The Modes of Server Load Balancing 192.168.x.x 192.168.x.x Load Balancer 3. Transparent Mode 4. DSR Mode Load Balancer 192.168.x.x Servers Router Servers 192.168.x.x Servers 70