ENG_[Routing] SAS500Series_112NL.FH11 - SELEX Elsag

The VPN functionality based on the IPSec suite, with a
dedicated encryption coprocessor, completes this product's
range of security features.
MAIN CHARACTERISTICS
Routing
The SAS router operating system (GAIA) supports: advanced
routing protocols including RIP v1/v2, RIP RFC 2091 (RIP
Triggered) OSPF and BGP-4; Multicast routing protocols
including PIM and SM/DM; Multicast user registration
through IGMP v1 and v2 with snooping functionality; 802.1Q
VLAN tagging; Stateful packet filtering functionality; cache
ACL; VRRP redundancy; ACL based user support with Radius;
802.1x supplicant emulation; IPSLA management (SEmon
compliant Cisco RTTMON, PING extended on SNMP); RADIUS
and TACACS+ for the AAA (Authentication, Authorization,
Accounting) operations of users who access the management
interface; RMON; SNMP v1, v2c, v3 and Secure Telnet
support.
Protocols for Legacy application transport are also supported:
SNA through DLSw v1 and v2; 802.2 (LLC2) also in redundant
mode. The use of standard protocols in the GAIA operating
system has always been a guarantee for the interoperability
of SAS devices with other products on the market.
Security
The Firewall incorporated in the SAS devices integrates a
Cyber Defence Engine that protects the networks through
the application of stateful inspection firewalling functionality.
The Cyber Defence Engine provides automatic protection
against Denial of Service (DoS) attacks such as SYN flooding,
IP smurfing, LAND, ping of Death and all the attacks on
packet reassembly. The entire SAS 500 series support the
following security mechanisms:
• Authentication, Authorization and Accounting functionality
through PAP and CHAP protocols , RADIUS, TACACS +,
Preshared keys and X.509 v.3 digital certificates;
• Logging: Local Log in memory (with the option of remote
download), or SysLog Server logging.
The IPsec-VPN supported standards are:
• IPSec: AH and ESP (tunnel and transport modality);
• Encryption algorithms: DES, TripleDES, AES;
• Data Authentication: MD5, SHA-1;
• Key management: IKE ISAKMP/Oakley.
Quality of Service (QoS)
The technology used by the Secure Access Systems (SAS)
offers to the user a series of advanced tools for the
management of segmented traffic and the control of the
Quality of Service (QoS). The GAIA operating system allows
the application of specific control policies and the verification
of the path and priority parameters for every single
application, ensuring that the traffic has the right level of
priority. These characteristics make SAS routers the ideal
system for the management of critical applications that
require simultaneous management of data, voice and video
traffic.
Management
The devices can be managed locally or from remote consoles.
A specific console port is available for local management.
This enables the configuration of device using an
asynchronous terminal emulator. Remote management is
performed through Telnet or, alternatively, via the SAS-
Manager suite which enables the user to carry out all the
"FCAPS" operations (Fault, Configuration, Accounting,
Performance, Security).
VoIP
The 500 series SAS's support the Analogue/Digital VoIP
Gateway (FXS / FXO, BRI) and either external or integrated
Voice Management. The services supported by the
BRI\Analogue gateway are as follows:
• Registration through MD5 authentication;
• Dial Plan;
• Call Balancing Backup Proxy;
• Authentication Proxy;
• Supplementary services;
• SIP Compact Form;
• SDP in Ack;
• RE-INVITE;
• PRACK (provisional acknowledge);
• Session Progress;
• DTMF tone transport management;
• RingTone Generation;
• Free ISDN line Hunting (only point to point connections);
• Voice Quality.
MAIN FUNCTIONS
Network Protocols:
• IPv4
• IPv6
• ICMP
• TCP
• UDP
• Telnet Client/Server
• IEEE 802.2 (LLC 2)
• PPP
• DLSW v. 1,
• DLSW v. 2 with backup peer
• VLAN Tagging (IEEE 802.1q)
• PEP (Performance Enhancing Proxies)
Network Services:
• DNS (resolver)
• Proxy ARP
• DHCP Client, Server and Relay Agent
• DHCP Relay multiaddress
• Helper Address (generic UDP broadcast)
• Dynamic DHCP over IPSec
• GRE
• SNTP (Simple Network Time Protocol)
• ACL
• Dynamic ACL via Radius (over 802.1x)