Best Deployment : Offering Security And Flexibility On Networks

Atul Ltd is a member of Lalbhai Group, one of the oldest business houses of
India, with interests mainly in textiles and chemicals. Atul operates through
six business divisions, namely, agrochemicals, aromatics, bulk chemicals and
intermediates, colors, pharma­ceuticals and intermediates and polymers. Its
registered office is in Ahmedabad.

The requirement

Atul was looking for a compre­hensive security solution that would fulfill the
following security requirements: Web filtering, bandwidth manage­ment, load
balancing and failover, intrusion prevention system and on-appliance reporting.

Atul Chemical's network comprises multiple LANs which consist of two ISP
links (RIL, BSNL) that provide separate Internet access facilities for its
diverse end users. They needed a solution that would give them the flexibility
to configure WAN, LAN, DMZ and VPN zones as per their requirements. Most of the
solutions they found had hard coded the zones on the interfaces.

So they needed a confi­gurable port device which would give them excellent
security and blend seamlessly into their existing network. These two WAN links
feed the multiple LAN network to provide round the clock connectivity to fulfill
the requirements of the corporate users, Atul School, Atul Township and remote
offices in Ahmedabad, Mumbai and Ankleshwar.

Pic: computer-networks-webdesign.com

Finding resolutions

The main challenge was to connect and provide round-the-clock connectivity
to Atul corporate office users, Atul School and Atul Township in Vapi along with
remote offices in Ahmedabad, Mumbai and Ankleshwar through their two WAN links
which feed the multiple LAN network. There was also a need to customize the
Internet usage policies for the traffic passing through the corporate line and
from the non-corporate line. For corporate and other non-corporate users, they
wanted to selectively provide Internet access and download rights, amount of
downloads along with time and kind of files format that a group of users can
access. Once they are grouped, they are provided access based on functional
requirements. Granular controls ensure flexible policies for diverse Internet
requirements. Deployed in a single location, the single Cyberoam appliance was
able to meet all the diverse Security, Connectivity and Productivity needs of
the organization.

Non-work related surfing was resulting in inadequate bandwidth for critical
business applications. Unrestricted surfing was the primary cause of declining
productivity and intrusions in the form of blended threats would cripple their
network infrastructure.

“We were looking for a comprehensive Internet security solution that would
cater to our corporate and day-to-day normal Internet security, connectivity and
productivity needs,” said Jignesh Patel, Consultant of IT Infrastructure, Atul.

A Cyberoam 500i unit in gateway mode was deployed. Atul has a firewall at the
gateway. In the face of blended threats the organization was looking for a
comprehensive security solution that could blend seamlessly into their existing
network. Another factor that helped Atul was Cyberoam's multiple link load
balancing and gateway failover. This was instrumental in making optimal use of
their ISP links. A single CR appliance has the power to scale from a family's
Internet requirement to a corporate requirement.

Atul wanted to use all the ports of Cyberoam because they had got multiple
local networks configured in Cyberoam. “They needed a solution that would give
them the flexibility to configure WAN, LAN, DMZ and VPN zones as per their
requirements. To use it to the maximum, they wanted to assign zones to the port
on their own as per their requirement. Most of the solutions, they found had
hard coded the zones on the interfaces. Cyberoam's interfaces are configurable
as per end-users' requirements. This gives them the flexibility to assign zones
to ports as per their requirement. Patel assigned the zones to the ports as per
their needs.

Customizing requirements

Cyberoam interfaces are configurable as per end users' requirements. Hence an
inter­face is not hard coded to be used for WAN or LAN only. This enabled Patel
to create custo­mized user identity-based policies which are found in all the
Cyberoam features. Multiple LANs have different users and different needs. Since
require­ments are different, the LAN IPs were grouped as per the need. For
corporate users, he could now selectively provide Internet access and download
rights according to their working needs. He could even specify the amount of
downloads that a group of users were allowed and at what time. The kind of files
that a group can download is regulated too. Once they are grouped, they are
provided access based on functional require­ments. Cyberoam's granular controls
filter out bandwidth-intensive downloads such as streaming media and Internet
video thus reducing unpro­ductive burden on the bandwidth.

Additional features

Driven by business need of inter-office connectivity over Internet, Atul has
two ISP links. Cyberoam's Multi-Link Manager intelligently load balances the
traffic and manages link failover between the RIL and BSNL broadband links.

The Intrusion Prevention feature of Cyberoam protected the web server from
external and internal intrusion attempts. All IM and P2P traffic is blocked to
ensure that no sensitive information is leaked and no malware enters the
network.

Atul had taken demon­strations from other leading network security providers,
but found that they were not providing on-appliance reports with the core
product. They also found Cyberoam cost-effective compared to other products.
Hence Cyberoam was the apparent choice.

The project was implemented by You Telecom. Speaking about You Telecom's
implementation of the project, Tushar Sighat, VP-Operations, Cyberoam (India)
said, “You Telecom has a deep understanding of the customer's risk profile and
the kind of security solution needed by the customer.”

He added that in the face of complex threat landscape partners should adopt
the role of consultants rather than commodity supplier.

Source: Cyberoam