Procera Networks - Policy Enforcement in Motion

The PacketLogic Real-Time Enforcement platforms (PRE) utilize multiple hardware platforms that run the same operating software. Each of the platforms offer consistent feature richness enabled through the different PacketLogic software modules: LiveView, Filtering, Traffic Shaping, and Statistics. The PacketLogic hardware platforms offer a range of configurations from the entry-level 4 Mbps PL5600 through 2 Gbps PL7720. The mid-range PL8720 is a 2RU unit with up to 16Gbps throughput. At the top of the line are the PL8820 - a 30Gbps appliance in a compact 2 RU form factors, and PL10000 series with capacity up to 120Gbps and 10M subscribers per system. It consists of a modular AdvancedTCA (ATCA) chassis solution in two sizes – PL10005 6RU and PL10014 13/14RU.

The PL8720 is Procera’s 15Gbps Intelligent Policy Enforcement (IPE) platform, with support for up to 4 channels of 10Gigabit Ethernet or 8 channels of Gigabit Ethernet that can be used for traffic processing, network redundancy, or traffic diversion all in a compact 2RU size. The PL8720 was specifically designed for customers that are rapidly growing their network bandwidth beyond 1Gbps of capacity, and need flexibility to support both 1GE and 10GE in the same system.

Rather than needing to do a forklift upgrade or purchase more expensive systems, the PL8720 can be deployed as a 1Gbps per second and easily upgraded to full capacity through software licenses. Gigabit Ethernet and 10 gigabit Ethernet interfaces can be mixed in the system, with up to four I/O modules available for use. This enables the PL8720 to be deployed in very dense configurations for network redundancy or in aggregation points in the network where network I/O is greater than actual traffic throughput. The PL8720 also provides easily accessible hot swap capable power supplies, fans and hard drives. It also supports FlowSync and QueueSync, which enable full support for asymmetric traffic and simplified clustering for network and capacity growth beyond single system limits. The system supports multiple redundancy and high availability methods, including support for bypass interfaces.

PL8720 Datasheet PL8720 Datasheet (A4)

Procera Bypass Switch (PBS) is an active external bypass switch that adds an extra level of resilience to PacketLogic™ deployments that require exceptional availability. This enables even the most cautious network manager to deploy PacketLogic inline.  The use of configurable heartbeat pulses allows PBS not only to detect a link failure but also system failures where the heartbeat packet fails to pass. Heartbeat frequency as low as 10 ms allows instant fail-over in case of a failure. With PBS you can also manually switch to bypass mode for systems maintenance.  PBS is configured and administered via a serial communication console port. An intuitive web GUI (graphical user interface) makes setup and administration quick and easy. The PBS can also be administrated via CLI or SNMP and supports SNMP traps for failure notification.  PBS consists of a 1RU host system that can hold up to four PBS bypass modules. This enables one single PBS host system to manage the redundancy for one to four PacketLogic units. The PBS comes with redundant power supplies and can be ordered with either 48V DC or 90-240V AC. The stand-alone and external architecture of PBS enables it to manage installations with any PacketLogic system, i.e. from the entry-level PL5600, through PL7720, PL8720 all the way up to the PL10000 Series.  

 Procera Bypass Switch Datasheet  Procera Bypass Switch Datasheet (A4)  

The PL7720 is Procera’s 2Gbps Intelligent Policy Enforcement (IPE) platform, with support for up to 2 channels of Gigabit Ethernet that can be used for traffic processing, or traffic diversion in a compact 2RU size. The PL7720 is designed for customers that are rapidly growing their network bandwidth from 100Mbps up to 1Gbps of capacity, and want a system that can be software upgraded to support their bandwidth needs. Two Gigabit Ethernet channels are supported in the system, with either copper, LX, or SX interfaces available for use.

The PL7720 is ideal for broadband customers deploying policy enforcement at peering points or in their access network for distributed deployments. Since the PL7720 is a small form factor, low power system, it can be more easily deployed in a decentralized access deployment than a larger, more expensive chassis-based system. PL7720 also provides easily accessible hot swap capable power supplies, fans and hard drives. The PL7720 supports network redundancy through bypass modules or through use of Layer 2 or Layer 3 network redundancy configurations.

The PacketLogic firmware consists of four software modules – LiveView, Traffic Shaping, Filtering and Statistics. All software modules rely on Procera’s state-of-the-art identification and classification engine DRDL. The modules are fully integrated which means that everything is managed in the same user interface. It also means that common objects are used to define groups of users (local hosts), applications, properties etc. A change to an object will affect all occasions where that object is used. This gives an easy overview of the network traffic as well as the PacketLogic administration.

The PacketLogic software is managed and monitored through the graphical (GUI) admin client that is available for Windows, Linux and Mac. Other interfaces include SNMP, Syslog, CLI (command line interface) for systems configuration, and a complete Python API for automation of PacketLogic administration. PacketLogic’s centralized management manages common rule-sets and firmware editions across multiple PacketLogic systems.

LiveView

The traffic is presented in real-time in the PacketLogic module LiveView. This is the first view that meets the PacketLogic administrator. LiveView shows all traffic going through the PacketLogic system, from overview down to a specific connection. The real-time capability enables you to support your users on the fly and resolve issues when they actually occur.

Traffic Shaping and Filtering

Policies are enforced in the Traffic Shaping and Filtering PacketLogic modules. Traffic Shaping can force certain traffic to a defined level. It can also be used to secure that it does not exceed a set threshold. This way capacity can be designated to critical and sensitive traffic. The Traffic Shaping module also contains prioritization where traffic based on labeling is forwarded in a certain order in case of congestion. PacketLogic uses a pure non-disruptive queuing mechanism.

The Filtering module is a capable Layer 7 firewall. Traffic can be filtered or allowed based on all granular properties provided by DRDL. This enables forensic control of unwanted and hazardous traffic. The Filtering module also provides rewrite functionality that can redirect traffic, change the QoS label DSCP (DiffServ) and perform automated DoS/DDoS protection.

Statistics

The data presented in real-time in the LiveView module is aggregated in the PacketLogic Statistics module. Statistics validates that the policies provide the intended results. This is valuable information for Marketing and Product Management to explore what the users do online, for Abuse Management to track malicious behavior, and for Company Management to get weekly reports.

The PL10000 is Procera’s multi-10 Gbps Intelligent Policy enforcement (IPE) platform, with support for up 120 Gbps of throughput in a single system, and multi-system performance scaling up to 2 Tbps. The PL10000 was specifically designed for customers that are rapidly growing their network bandwidth beyond 10Gbps of capacity, and need flexibility to grow their network deployment to handle the explosive growth of bandwidth usage in broadband networks. It was also specifically designed for today’s high connection, high growth Internet, where social networks have dramatically increased the number of active connections on the network, and video streaming continues to grow daily.

The PL10000 comes in two models, the PL10005 (a 6RU chassis) and the PL10014 (a 13/14RU chassis), each using the same hardware modules. Up to six 10 Gigabit Ethernet ports can be used for traffic processing, network redundancy, or traffic diversion. It also supports FlowSync and QueueSync, which enable full support for asymmetric traffic and simplified clustering for network and capacity growth beyond single system limits. The system supports redundancy and high availability, including internal N+1 redundancy for some modules.

The PL10000 combines policy enforcement with industry-leading awareness. The PL10000 leverages DRDL™ (Datastream Recognition Definition Language), PacketLogic’s unique traffic identification engine and the PacketLogic Subscriber Manager to combine application and content awareness with visibility into network, subscriber, device, and location information. DRDL provides full Layer 7 visibility into applications, providing unparalleled visibility into application behavior and service properties, enabling network operators to make fine-grained distinctions in managing services and congestion on their networks. DRDL is the most accurate traffic identification engine available, which is critical when Policy Enforcement is used for service creation and charging.

PL10000 Datasheet PL10000 Datasheet (A4)  

The PL5600 is Procera’s 200Mbps Intelligent Policy Enforcement (IPE) platform, with support for up to 3 channels of Ethernet that can be used for traffic processing, network redundancy, or traffic diversion all in a compact 1RU size. The PL5600 is designed for customers that are rapidly growing their network bandwidth from 4Mbps up to 100Mbps of capacity, and want a system that can be software upgraded to support their bandwidth needs. Three Ethernet channels are supported in the system, with copper interfaces available for use. The interfaces have built-in hardware support for bypass to simplify network redundancy.

The PL5600 is ideal for broadband customers deploying traffic management at peering points or in their access network for distributed deployments. Since the PL5600 is a small form factor, low power system, it can be more easily deployed in a decentralized access deployment than a larger, more expensive chassis-based system. The PL5600 supports network redundancy through bypass modules or through use of Layer 2 or Layer 3 network redundancy configurations.

 PL5600 Datasheet  PL5600 Datasheet (A4)