Section 1, System Description
NetVanta 2000 Series System Manual
12
© 2002 ADTRAN, Inc.
61200361L1-1E
1.
SYSTEM OVERVIEW
The NetVanta 2000 series of VPN products include small to mid-range IPSec compliant gateways
providing all the necessary components required to secure an integrated VPN solution. Used primarily for
remote access and site-to-multisite connectivity, the NetVanta 2050 and NetVanta 2100 targets the
corporate branch office, the small office/home office (SOHO), as well as business-to-business
applications. As a branch office or mid-size host security gateway, the NetVanta 2300 provides the same
features as the NetVanta 2100 with an added DMZ port for public server access. For networks supporting a
large VPN network, the NetVanta 2400 is available to provide all necessary host site gateway functionality.
The NetVanta 2000 series provides several key security and data management features such as IPSec VPN
tunneling, stateful inspection firewall (providing cyber assault protection), authenticated remote user
access, and Network Address Translation. Adhering to IPSec standards (established and maintained by the
IETF) enables the NetVanta 2000 series to be interoperable with many other IPSec compliant gateways,
allowing for a multi-vendor VPN solution.
On a public infrastructure like the Internet, security is of the utmost importance. The NetVanta 2000 series
protect the corporate network against attacks with a built in firewall and provides data security through
encryption, authentication and key exchange. The NetVanta 2000 series employ a stateful inspection
firewall that protects an organization's network from common cyber attacks including TCP syn-flooding,
IP spoofing, ICMP redirect, land attacks, ping-of-death, and IP reassembly problems.
For encryption, the NetVanta 2000 series encrypt the data being sent out onto the network, using either the
Data Encryption Standard (DES) or 3DES encryption algorithms. Data integrity is ensured using MD5 or
SHA1 as it is transported across the public infrastructure. In addition, Internet Key Exchange (IKE) can be
used for user authentication supporting public and private keys or digital certificates, assuring that the
proper VPN tunnel is established and that the tunnel has not been redirected or compromised.
NetVanta 2000 series are Internet Protocol Security (IPSec) compliant devices that supports both ESP and
AH protocols and provides secure communication over potentially unsecure network components. Acting
as a security gateway, the NetVanta 2050 and 2100 can provide up to 10 private encryption communication
tunnels through the Internet with remote locations while the larger scale NetVanta 2300 offers support for
up to 100 private encryption tunnels. For networks requiring more than 100 tunnels, the NetVanta 2400
provides 1000 private encryption tunnels. The NetVanta 2000 series can also hide IP addresses from the
external world by performing Network Address Translation (NAT). The internal router allows multiple
users to share a VPN connection and can also direct incoming IP traffic.
A remote NetVanta 2000 series can easily be configured and managed using a standard web browser.
NetVanta 2000 series also have built-in alert and logging mechanisms for messaging and mail services.
This enables the unit to warn administrators about activities that are going on in the network by logging
them into a Syslog server or sending an email to the administrator.
Unlike a software implemented VPN solution, which depends on local CPU and memory performance to
implement encryption, the NetVanta 2000 series are standalone, hardware platforms that off-load the CPU
intensive encryption process. 3DES encryption significantly impacts CPU performance, possibly slowing
all the local processes on the computer. Since the NetVanta 2000 series offers dedicated processing
platforms to drive the encryption process, local computer performance is unaffected.
