Strengthen Security Tools In 30 Minutes

Food Manufacturer Accelerates MTTR For Network Problems

The customer is a $4B food product manufacturer that distributes packaged coffee, health/natural foods, and a variety of other packaged edibles all across North America, including Mexico. The customer runs a complex network with approximately 7,500 networking devices deployed at their headquarters and  33 remote locations, 75% of which are manufacturing facilities. They use a variety of tools, including application performance management (APM),  intrusion detection systems (IDS), URL filtering, packet capture, and data loss prevention (DLP). 

The customer’s networking team found that the data center lacked available access points, specifically Switched Port Analyzer (SPAN) ports. On most switches, the company wanted to connect four or more tools, but their two Cisco 6509 switches only provide up to two SPANs. Because of this lack of SPANs, the company had to manually add and remove tool connections to SPAN ports, which required 1–2 hours of work by a network engineer each time the connectivity changed. 

In order to address all of these problems, the customer purchased an Keysight Vision ONE™ network packet broker (NPB) to be deployed in the primary data center located at the company’s headquarters. With this configuration, the Customer is able to share data from only two SPAN ports in each switch to all of their deployed tools.

Previously, the DLP tool had not been seeing all of the required data. Now, each port on the DLP is being sent traffic off the primary virtual local area networks (VLANs) on each switch. Using the Keysight NPB solution, the customer was able to remove intranet subnets from the traffic flows, so the tool could focus exclusively on internet-bound traffic. With these subnets removed, the URL filtering device can focus its total resources on the right data. 

The company also sees significant utilization improvement in their APM tool. By removing data so that only a specific virtual IP address is sent to the APM tool, it is able to focus on the relevant traffic and save processing cycles in a similar way to the DLP solution.

Company:

Large Food Manufacturer Industry: Retail services

Key Issues:

•SPAN port shortages 

•Unnecessary and duplicate monitoring data 

•Time-consuming and difficult troubleshooting 

Solutions:

•1 Vision ONE NPB 

Results:

•SPAN port contention eliminated 

•Network admin had the NPB installed and running in 30 minutes 

•Troubleshooting issues eliminated by using NPB our-of band monitoring data filtering and aggregation 

•MTTR reduced 70%

Keysight Ease Of Use Reduces MTTR 70% And Creates A Time To Benefit Of 30 Minutes

The Vision ONE allows us to share traffic from our limited number of SPANs with eight tools, without dropping packets or overloading the tools with data. We reduced our MTTR almost 70%. We were also able to filter the traffic to our web filtering server, decreasing the utilization of the gigabit link from almost 90% to 10%,” according to the network admin. 

In addition, the customer was able to configure and deploy the NPB very quickly. “When the Vision ONE device initially arrived, I feared it would take a long time to learn and configure,” explained the Lead Network Administrator. “However, the device was running within 30 minutes, and it took no longer to configure than it did to rack mount.”

When problems arise in remote locations or during off-hours, the network engineers can log in remotely, route and deliver the appropriate network traffic to the sniffer, and address the problem rapidly. This process eliminates headaches and delays associated with performing change control activities, making and breaking SPANs, and physically traveling to the site for troubleshooting.