Customer Introduction:

Jiansu Telecom is a wholly-owned subsidiary of China Telecom. It manages 13 prefecture-level Telecom subsidiaries and 56 telecom offices, in which Nanjing, Suzhou, Wuxi, and Nantong subsidiaries are strategy units of China Telecom. The main business is traditional IP voice business and VAS. In recent years, with the rapid development of Internet, Internet access service has becoming the key business of Jiangsu Telecom.

Solution provided by Hillstone Networks:

DCN is the special data communications network for all the network management systems of China Telecom, working as the general information exchange platform for the systems. It supporting the operation of China Telecom management networks. With the growth of business, the former DCN network could not meet the current transport requirements. At the end of 2008, China Telecom decided to expand the DCN network. And the main concern of the expansion task is the security defense of the DCN network’s Internet access point.
Reason of DCN network expansion is to support growth of the business. Currently, Internal DCN network is a 10 gigabit exchange network, with huge amount of data transferred and business transactions. The security protection of the entry point of DCN network is vital to the security of the whole DCN Intranet. A high-performance device with rich security functions and strong attack defense ability is required.
After a comprehensive selection process, Jiansu Telecom chose Hillstone SA series multi-core security appliance. Hillstone SA series multi-core security appliance, with innovative 64-bit multi-core processor and high-speed switch fabric, offers a new generation network security solution with high performance, high-reliability, and strong attack defense capability.
Network topology of Jiansu Telecom is as below:

As shown in the network diagram, in order to protect the DCN Intranet effectively, Jiangsu Telecom uses a dual layer defense architecture. In the first layer, firewall function on the Cisco 6509 was turned on to filter inbound and outbound traffic. In the second layer, two Hillstone SA-5040 devices are deployed, forming a security filtering area to protect DCN Intranet.

Hillstone Networks’ multi-core based solution has the following characteristics:

• High-performance firewall
  Hillstone SA series security appliance has high firewall throughput. The session rampup of Hillstone SA-5040 can be up to 100,000 per second and support up to 2 million concurrent sessions, providing fastest and most reliable network access service.
• Strong attack defense capability
  To the raged network DDoS attacks, such as SYN flood, UDP flood, and ICMP flood, Hillstone SA-5040’s strong attack defense capability provides effective protection in all aspects. The attack sources will be recorded accurately by the device while attack is happening, offering an effective tool for tracking and forensics.
• Strong QoS control and fine-grained session control
  Internet connection of DCN network faces great bandwidth pressure because of a large amount of resource misuse. The QoS function of Hillstone Networks’ multi-core security appliance could help users manage bandwidth effectively. The special fine-grained session control technology could control the session total number and the session rampup rate on the IP level, and protect network resources and increase the resource utilization rate.
• High-reliable HA
  Hillstone SA-5040 provides high-reliable HA. As the backup for each other, 2 SA-5040 devices provide support for the non-stop running of network applications. The robust monitoring function can detect failure based on port, IP address or ARP reply, and cooperate with other members of the HA groups to provide protection. Using HA deployment of Hillstone devices, the robustness of the DCN network is greatly imporved.

Customer Comments:

With the deployment of Hillstone Networks’security appliance, the security of Jiangsu Telecom DCN intranet and the services they provide are protected effectively. Hillstone SA-5040’s patented multi-core plus architecture deals with the weakness faced by ASIC/NP based system in session control and traffic control. It creates a strong processing foundation for VPN processing and content security, making the whole DCN network more secure.