To help protect and safely resolve high-risk situations on the network, organizations need SWAT force power—the kind found in the new SolarWinds® User Device Tracker (UDT).

The latest version of User Device Tracker incorporates powerful new features to help you take an even more proactive stance in controlling who and what is allowed on your network.

UDT can be tactically deployed to help you manage the onslaught of mobile devices while ensuring rogue devices stay out, with key features like:

Proactive & Actionable Controls

There are several strategic ways to proactively and actively secure access to your network with SolarWinds® User Device Tracker. First, leverage a whitelist to define a safe set of devices based on MAC addresses, IP addresses, or hostnames. Any device not on the whitelist will be seen as a rogue device and an alert will be triggered.

Second, add suspicious or unauthorized users to a Watch List so you can be notified every time they enter the network.

Finally, on detection of rogue device activity, instantly shut down the compromised network device port. This can be remotely executed while sitting at your desk.

Automatic Alerts

Being alerted at the right time is critical to take action on offending devices or unwanted network connections. With User Device Tracker, you can enable trap notifications to get connectivity information in "real time" and receive alerts whenever a device not on the whitelist connects. Additionally, you can set up alerts to notify of an endpoint port change.

Real-time Data Analysis & Reporting

UDT provides two easy methods to collect user device information:

1. Use the Domain Controller Wizard to collect user login information. For this, configure appropriate logging levels on the Windows® servers beforehand.
2. Poll devices for Virtual Route and Forwarding (VRF) data.

Additionally, you can leverage customizable, built-in report generation options to extract user and device information. For example, report on all wireless endpoints connected to the network.

Conclusion

To sum up, ensure the following ‘special weapons’ are part of your network management arsenal:

• Proactive Measures & Actionable Controls – Whitelisting, Watch List, Remote Port Shutdown
• Automatic Alerting – Trap Notifications, Endpoint Port Change Notification
• Real-time Data Analysis & Reporting – Domain Controller Wizard, Polling for VRF data, Wireless Endpoint Report

Jump into action with the SWAT power of UDT to combat rogue endpoint devices with ease and deliver active network access security.

Download a free trial today and seize control of your network!

While we continually look for ways to simplify firewall configuration and change management tasks, a simple erroneous rule can lead to very big risks in the network. However careful we may be, redundant or shadowed rules always seem to find their way in.

There’s certainly a pressing need for smart and easy ways to find and fill gaps in security rules, as well as spend less time troubleshooting errors. Let us look at 3 common Juniper firewall management challenges and some tips and best practices to address them. Read on…

1. Cleaning up a Cluttered Rulebase

An important point of concern is that new rules are continually added to the firewall, but there isn’t much effort taken to remove them when they get redundant. When the task of identifying and removing unused, redundant or shadowed rules is ignored, you end up having a cluttered rulebase that can lead to security gaps and performance issues. Keep in mind the following:

• Juniper firewall rules are defined on a Source and Destination Zone pair. Each network interface belongs to Zones that are security areas with different access policies associated with it. There may be multiple interfaces associated with a particular Zone.
• There can be multiple objects per rule - on Source, Destination and Service. As a result, the actual number of rules becomes smaller but highly aggregated.

Therefore, to increase performance and efficiency, it’s crucial that unnecessary firewall rules are regularly removed. Additional policy optimization can be achieved with structural redundancy clean-up. This helps identify and remove erroneous entries in configurations that are completely useless to the functioning of the firewall.

2. Analyzing Firewall Logs

Juniper firewalls have references connecting back to the rules that are being triggered. Therefore, analyzing these firewall configurations and logs will effectively help isolate redundant, covered, and unused rules in these devices.

Firewall usage analysis is based on log records collected through the syslog interface. There are two simple ways to do this:

• Have log data stored in a file/directory, and then use it later for analysis
• Schedule log collection for a specific period of time, and then analyze this data.

Regularly schedule rule usage analysis for continuous rule-base optimization.

3. Handling the Command Line Interface (CLI)

CLI commands can be quite complex, and not everybody is adept at using them. In Juniper firewalls, the configurations are CLI-centric and are retrieved directly from the devices using SSH/Telnet connections. Unfortunately, this can be complicated, time-consuming, and error prone.

What's really needed is a simple-to-use interface which provides a consolidated view that is easily comprehensible and offers at-hand information to quickly identify discrepancies.

In Summary:

1. Clean up your Juniper firewall rulebase regularly
2. Analyze firewall logs for effective rule management
3. Handle CLI commands from an intuitive management console

SolarWinds Firewall Security Manager is an easy-to-use firewall management solution that helps you better manage your Juniper and multi-vendor firewall devices from a single, intuitive interface for improved network security and administrative ease. Download a free trial today.

Welcome to SolarWinds blog series “Diving Deeper with NetFlow – Tips and Tricks”. This is the first of 6 part series where you can learn new tips by understanding more about NetFlow and find some everyday use cases for effective network monitoring.

Network problems seem to be a never ending condition for administrators who are charged with both maintaining network performance and delivering advanced network services to their organizations. The restraint in IT budgets and increasing pressure to ensure constant uptime, has pushed network engineers to try and manage existing resources and control costs. For engineers, troubleshooting network related problems and solving bandwidth issues can be achieved by taking advantage of existing flow technologies in your routers and switches. By using NetFlow, monitoring your network traffic not only becomes much easier but also provides greater visibility, by collecting and analyzing the flow data in your network.

What is NetFlow?

NetFlow is a network protocol developed by Cisco Systems for collecting IP traffic information, which eventually became the universally accepted standard on traffic monitoring and is supported on most platforms. NetFlow answers the questions of who (users), what (applications) and how network bandwidth is being used.  By understanding NetFlow much deeper, you can probe more into the insights and everyday uses that you haven’t thought about.

Effectively troubleshoot network issues with NetFlow

NetFlow data contains information about the network traffic, which helps network administrators to attend to issues related to application slowness and network performance degradation. Using NetFlow you can:

• Identify the hosts involved in a network conversation from the source and destination IP addresses, and its path in the network from the Input and Output interface information.
• Identify which applications and protocols are consuming your network bandwidth by analyzing the Source and Destination Ports and Protocols.
• Analyze historical data to see when an incident occurred and its contribution to the total network traffic through the packet and octet count.
• Ensure the right priorities to the right applications using ToS (Type of Service) analysis.

Flow data helps you keep track of interface details and statistics of top talkers and users, which can help determine the origin of an issue when a problem is reported. With Type of Service (ToS) in NetFlow records, you can understand traffic pattern per Class of Service (COS) in your network. With that you can verify Quality of Service (QoS) levels achieved and optimize network bandwidth for your specific requirements. Additionally, NetFlow data helps you to analyze usage patterns over a particular time and find out who or what uses most of the network bandwidth. NetFlow provides support to quickly troubleshoot application and performance related problems in your network.

Maintaining Network Uptime with NetFlow

Network uptime is critical to an organization’s revenue and an understanding of traffic behavior helps you maintain that. Excessive use of network bandwidth by users and applications can be controlled by identifying the top talkers from real-time and historical data. Manually collecting the flow data and analyzing it is a humongous task. By using a NetFlow analyzer, you can capture NetFlow data from different points in your network and convert them into easy-to-interpret information that help with better management of your enterprise network.

To learn more about NetFlow, check out our NetFlow V9 Datagram Knowledge Series.

The ‘Diving Deeper with NetFlow – Tips and Tricks’ webcast is scheduled on 23^rd May 2013. Register here and become an expert in understanding and implementing NetFlow in your enterprise networks.

Targeted espionage in simple terms is the practice of illegally spying and investigating competitors, mostly to gain business advantage. The target may be financial information, a trade secret such as a proprietary product specification and so on. You may think that your organization is not a high-value target, but that’s not true.

There is always a hunt for sensitive and personal information like credit card and social security numbers, patient records, etc. In most cases, a highly targeted attack precedes an APT, and it may exploit a maliciously crafted document or executable, which is emailed to a specific individual, or a group. APT or Advanced persistent threat refers to an entity or a group with both the capability and the intent to persistently target a specific organization or a network, etc.

A recent survey conducted by Verizon on data breach, revealed the victims by Industry:

     • 37% - Financial Organizations
     • 24% - Retail and Restaurants
     • 20% - Manufacturing, Transportation and Utilities
     • 20% - Information and Professional services

So how does the attack typically happen?
The factors that contribute to attacks like this are known as ‘threat actors’ and they can be classified into three categories:
     • External - The ones outside the victim organization
     • Internal - These threat actors are the ones within the victim organization
     • Partners - Partners can be any third party that share a business relationship with the organization

Most attacks come with an intent to crack the financial data, sometimes business information. Hence the attacks can come in the form of data theft attempts, SQL injection, spyware, phishing attempts, hacking and other kinds of malware.

For instance, databases are increasingly becoming targets for hackers which has resulted in information security becoming one of the most important drivers for security investments. You need to have visibility and protection over security & compliance, and protection of your data. To ensure this, you need to collect and consolidate log data across the IT environment and correlate events from multiple devices in real-time.

A recent report showed that a decade-long espionage operation used the popular TeamViewer remote-access program and proprietary malware to target political and industrial figures in Hungary

So it’s high time that you get proactive and shield yourself against possible threats. You need to continuously monitor the activities on your web server, firewalls and endpoints. By deploying a logfile
analyzer tool, you can identify anomalies, deviations in policy definitions and baseline your IT environment for vulnerabilities, and shield them.

Recently, the Geeks at the SolarWinds Lab landed themselves in a bit of a pickle. Which one is faster – installing a virtual appliance with Hyper-V ^® or VMware ^®?

Our Head Geeks, Lawrence Garvin and Patrick Hubbard, were certain that there was only one way to get to the bottom of the situation – A Virtual Application installation bout!

Our head geeks also explain why noisy pagers or flooded mailboxes are not the only problems for IT. The biggest challenge is to have all your alerts in one place for analysis, adding notes and performing initial triage before assigning it to the right person in the right department.

Pick your favorite early and root for your favorite geek or hypervisor! (Remember, this is not a competition, it is only an exhibition - please, no wagering.)

Did your favorite Geek win? Well ,there are no losers in this battle. All IT specialists receive a gold medal with our free SolarWinds Alert Central - the perfect tool to consolidate and manage all your alerts. Just follow along with Lawrence and Patrick to install it on your virtual machine and fire it up to:

• Consolidate your alerts from all your IT monitoring software
• Setup automatic escalation workflows that work for each team
• Schedule on-calls using the intuitive calendar interface
• View status/priority of alerts with easily distinguishable icons

Put an end to those critical ignored alerts that get lost in somebody’s inbox that only your boss seems to know about.

Alert Central is not just one of our many free tools.  It’s a free product capable of handling tens of thousands of alerts for hundreds of users.

Download Alert Central for Hyper-V or VMware and get your weekends back.

We keep hearing about Denial of Service (DoS) attacks, owing a large part of it to our dependency on the Web. A typical DoS situation could be a website going offline. Also, you may have faced situations where a sudden increase in traffic causes the site to load very slowly. Sometimes the traffic can be good enough to shut the site down completely. A perfect case for Distributed Denial of Service (DDoS).

In short, DoS and DDoS attacks are some of the most inventive hacking practices on the rise bringing down businesses critical services, and inhibiting user Web access and business continuity.

So, the question is what exactly are DoS and DDoS? More importantly, how do we guard our IT assets from them?

Denial of Service

It’s an attack where the attempt is to prevent legitimate users from accessing information or services. It usually targets your system and its network connections, or the network of critical sites that you may often use. The most common type is flooding a network. For example, when you type a URL of a particular website, what you actually do is send a request to access the page. There are only a certain number of requests that the site’s web server can process at a time and hence cannot process your request, precisely “Denial of Service”.

For most hackers, Web servers are the ideal choice for launching attacks as they have more computing and network capacity compared to a home PC. A very similar thing happened with Mt. GOX servers recently. So, to crash a web server, a DoS threat attacks the following services:

• Network bandwidth
• Server memory
• Application exception handling mechanism
• CPU usage
• Hard disk space
• Database space
• Database connection pool

To a large extent, organizations tend to rely on firewalls to defend their networks against DoS attacks. Although firewalls are a key component of an organization's security solution, they are not individually capable enough to thwart a targeted DDoS attack.

Distributed Denial of Service

In a DDoS attack, the hacker is likely to take control of the security vulnerabilities to control  your system and use it to attack other systems in the network. A perfect example for this is sending out spam, sending overloaded information to a website. In simple terms, the attack is distributed, where the user uses multiple computers to launch the DoS attack.

Symptoms like slow network performance, sudden spike in receiving spam content, and inability to access certain websites suggest that there are chances your network is under attack. It’s best to be proactive and shield yourself against possible threats. You need to continuously monitor the activities on your web server, firewalls and endpoints. Using a security information and event management software would be an ideal choice.  It helps you by monitoring all the logs collected from various entities in your IT environment, and analyzing and correlating events in real time for advanced incident awareness.

If you want to safeguard your IT against DoS and DDoS threats, you need to ensure that your SIEM tool uses active responses to respond to critical security events, and shuts down threats immediately. Some key built-in responses that you might need for sure are:

• Send incident alerts, emails, pop-up messages, or SNMP traps
• Add or remove users from groups
• Block an IP address
• Kill processes by ID or name

Quick—why do YOU transfer files from point A to point B?  Our experience shows that many of you are trying to:

• Back up your data
• Match up two different folders, or
• Transfer a really big file without having to wait around

Did you know you can do all of those things and more with SolarWinds free FTP Voyager client?   This article shows you how, with five quick "file transfer recipes."  (Remember to download FTP Voyager before trying any of this on your own.)

How to Back Up Files From Your Desktop or Laptop

1. Obtain an account on either a remote FTP, SFTP or FTPS server such as Serv-U MFT Server
2. Open up the FTP Voyager Scheduler
3. Use the Backup Wizard to select local & remote folders
4. Schedule & run the backup

How to Synchronize Two Folders

1. Open FTP Voyager & open a connection to your FTP, SFTP or SFTP server

2. On your left pane, click into the local folder you want to synchronize

3. On your right pane, click into the remote folder you want to synchronize
4. Click the "Compare Folders" button between the two panes
5. Transfer files back and forth between the folders until all the files that are listed appear in green

How to Shut Down After a Big (Unattended) Transfer

1. Open FTP Voyager & open a connection to your FTP, SFTP or SFTP server

2. Perform a test to make sure transfers work by downloading one or two small files

3. Go to the "Transfer Queue"

4. Change "On Queue Completion" to "Shut Down Computer"

5. Start the large file transfer & leave

6. Your computer will now automatically shut down when the big file transfer finishes

How to Synchronize Entire Folder Trees

1. Open FTP Voyager & open a connection to your FTP, SFTP or SFTP server

2. On your left pane, click into the local folder you want to synchronize

3. On your right pane, click into the remote folder you want to synchronize

4. Go to the "Tools" ribbon &  click on the "Synchronize" button

5. Confirm the parameters of the synchronization by looking at the Sync preview & making any necessary adjustments

6. When everything is set, click the "Synchronize" button

7. FTP Voyager will automatically make all necessary transfers & deletions to synchronize your folders & all their subfolders

How to Get Email Alerts When Files Arrive

1. Open FTP Voyager & then open your Site Profiles

2. Select the server that you want to watch & select "Copy to Scheduler" from the menu
3. Open FTP Voyager Scheduler
4. Create a new transfer task
5. Add a "Download" action that points to your expected file
6. Reopen your "Download action & go to the "Events" tab
7. Add a "Send Email" event action to send you an email when the "File Downloaded" event occurs

Try It Yourself

To try out any of these recipies yourself, download FTP Voyager Free FTP Client today.

Network administrators are tasked with deploying advanced network services, maintaining network performance, and reducing costs with fewer resources.  One of the biggest factors impacting your network performance is network traffic and bandwidth usage. By understanding how to take advantage of the flow technology that is built into routers and switches, IT professionals can monitor, troubleshoot and solve bandwidth related problems. Join us in this free webcast where our NetFlow experts will help you understand some cool tips and tricks to make the most of the NetFlow data from your networking devices.

The Agenda

In this webcast, we’ll dive deeper into NetFlow, discuss day-to-day networking challenges, and highlight common use cases that will help you better leverage the flow technology and its applications to troubleshoot many networking problems. This webcast covers some key topics including

• Introduction to NetFlow and other flow technologies
• Configuring your network to collect flow data
• Some everyday use cases for effective network monitoring
  • Troubleshooting network issues
  • Anomaly detection
  • Tracking cloud performance
  • Monitoring the impact of BYOD traffic
  • Monitoring Quality of Service (QoS) and Type of Service (ToS)
  • Capacity Planning
  • How SolarWinds Network Performance Monitor and NetFlow Traffic Analyzer can help

When is the webcast?

Register for this free webcast and learn new tips and tricks to become an expert at understanding and implementing NetFlow in your enterprise networks.

APAC

Tuesday, 21 May 2013

11:00 AM SGT, 01:00 PM AEST

REGISTER NOW

North America/Latin America/EMEA

Thursday, 23 May 2013

10:30 am CT

REGISTER NOW