What is AMF Security mini
Where does AMF Security mini Fit In
AMF-SECurity (AMF-SEC) is our solution to streamline network operations and enhance security in office environments.AMF Security mini is the SDN controller that is the core of the solution, and it realizes the cooperation between our products supporting the AMF (Allied Telesis Management Framework) and various business security related applications.
What is AMF Application Proxy
The AMF Application Proxy controls traffic from edge devices, which are connected to AMF Members (Edge Nodes) where AMF Master (Proxy Node) authenticates the devices by querying AMF Security mini(AMF Application Proxy Whitelist).It is also possible for AMF Security mini to notify the AMF Proxy Node of suspected node and make Edge Nodes to block the devices (AMF Application Proxy Blacklist).
Note◼ AMF Application Proxy Whitelist and AMF Application Proxy Blacklist
・ A Proxy Node also can be an Edge Node (Only supported models).
・ Cannot be linked with AMF controller.
To use the AMF Application Proxy, you have to configure all of AMF Security mini, Proxy Node and Edge Nodes.
What does AMF Security mini Manage (AMF Application Proxy Whitelist)
AMF Security mini can centrally control the network access from various devices by utilizing the port authentication feature on the AMF Members it manages.The AMF Application Proxy Whitelist is an AMF Security mini's integration feature where AMF devices ask the AMF Security mini's whitelist server if a specific device can be allowed access to the network.
If a device meets those conditions, it is allowed to join the logical network defined by a VLAN ID.
- Location
Where a device can access the network.
By associating AMF Members with a location, you can define a physical network space.
- Schedule
When a device can access the network.
You can specify a period of time with a Start Date / Time and End Date / Time.
- Switch Port
A port on an AMF Member from which a device can access the network.
You can allow a device to access the network only when it connects to a specific port on a particular Switch.
- Network
A VLAN subnet to which a device can belong (a logical network space defined by a VLAN ID).
The MAC address interface of the device is managed by connecting, blocking, and isolating based on the security policy assigned to the device.
A device can have more than one MAC address interface.
Assuming that a device has two MAC addresses - one for a wireless interface and the other for a wired interface, both of them can access the same network if they meet the conditions for Location and Schedule.
| Device Information | |||||
|---|---|---|---|---|---|
| Device | network-capable equipment which connects to an AMF Member | ||||
| └ | MAC Address | a MAC address of the device interface | |||
| (multiple items can be defined) | |||||
| └ | Security Policies | Network | a VLAN segment (VLAN ID) to which a device is assigned. | ||
| Location | a physical location where a device can access the network. | ||||
| └ | AMF Member | a switch in the location. | |||
| └ | Switch Port | a port on the switch from which a device can access the network. | |||
| (multiple items can be defined) | |||||
| Schedule | a range of time during a device can access the network (Start Date / Time, and End Date / Time). | ||||
| (multiple items can be defined) | |||||
NoteTo use this feature, your Proxy Node and Edge Nodes must have AlliedWare Plus firmware version 5.5.1-0.x or later installed.
NoteAuthenticate with the AMF application proxy function displayed on the Device > Active Device List page with the following settings or operations. To display the displayed terminal information, enable the service http command on both the proxy node and the edge node of your AlliedWare Plus device.
・The check box of "Reload authorized device list when AMF Member connects to network." on the AMF > AMF Application Proxy Settings page is checked.
・Click the "Sync" button on the Switches > Active AMF Member List page.
Blocking with AMF Application Proxy
Notifying Proxy Node of Suspected Node Information
AMF Security mini notifies the Proxy Node of suspected node when receiving information from security software or devices that detect suspected node, or adding an action on the Policy Settings > Add Action page. The suspected node's information is stored on AMF Security mini and can be viewed on the Policy Settings > Action List page.AMF Security does not notify the proxy node of the information again.
NoteIf the proxy node holding the suspected node information reboots, the information is removed from the proxy node.
Because the proxy node cannot receive the information from AMF Security mini again, the proxy node cannot relearn the suspected node automatically.
To manually tell the proxy node about the suspected node, follow the steps:
1. Open the Policy Settings > Action List page.
2. Click the "Export to CSV" button to save a CSV file.
3. Open the System Settings > System Information page.
5. Click the "Import" button for the Authentication Data item to open the "Upload Authentication Data" dialog.
5. Click the "Choose File" button, select the saved CSV file, and click the "Submit" button.
AMF Actions
When AMF Security mini notifies the Proxy Node of suspected nodes, it can also specify a blocking action (AMF action).AMF Security mini can specify the following AMF actions:
- AMF Dependency
- Quarantine
- Drop Packets
- Link-Down
- IP-Filter
- Log-Only
When "AMF Dependency" is selected, AMF Security mini does not send the AMF action, but the AMF action set on the edge node side is executed.
NoteIf AMF Security and AMF Master receive suspected node information from multiple sources (e.g. external applications), specify the same AMF action for all the sources.
The AMF Action for each application can be specified in the "Rules" section on the System Settings > Trap Monitor Settings page.
To change the AMF action for a suspected node which has already been registered on the Policy Settings > Action List page, delete the existing action and recreate it.
NoteEven if the device is permitted by the whitelist, if it is the target of AMF Action, the communication from the corresponding device is processed according to the action.
Unblocking Suspected Nodes
To unblock a suspected node (delete the suspected node information), delete the corresponding action on the Policy Settings > Action List page. When the action is deleted, AMF Security mini tells the proxy node to delete the suspected node information.NoteYou can also unblock the suspected node by running commands on the proxy node. But in this case, the proxy node does not request AMF Security mini to delete the node information. So AMF Security mini keeps the suspected node information. If you want to delete it, manually delete the action on the Policy Settings > Action List page.
Refer to the AlliedWare Plus Product's command reference manual for the commands.
Displaying and Emailing Blocking Status of the Suspected Node
Status of the suspected node which has been applied an AMF action by an edge node can be view on the Device > Active Device List page.AMF Security mini regularly gets this information from the proxy node every 30 seconds.
NoteTo use this feature, your Proxy Node and Edge Nodes must have AlliedWare Plus firmware version 5.5.1-0.x or later installed.
By using AMF Security mini's Email Notification Settings, you can also get email notifications of blocking.
- "Send Email Notification on Block Event" : An email is sent when a node is blocked by one of "Drop Packets", "Link-Down", "IP-Filter" or "Log-Only" actions.
- "Send Email Notification on Quarantine Event" : An email is sent when a node is quarantined by "Quarantine" action.
NoteWhen AMF Security mini queries the proxy node and finds that suspected node information is changed (e.g. a node moved to other switch and got blocked there again), AMF Security mini updates the information on the Device > Active Device List page and sends an email notification.
Configuring AMF Master (Proxy Node) and AMF Members (Edge Nodes)
Refer to the AlliedWare Plus Product's command reference manual for how to configure Proxy Node and Edge Nodes.Depending on the AlliedWare Plus product model you use for a Proxy Node, you may have to install the proper license on the products.
NoteTo view the blocking status of suspected nodes and use email notification, please run "atmf topology-gui enable" command on AMF Master (Proxy Node) in addition to the AMF Application Proxy's basic configurations.
Configuring AMF Security mini
To use AMF Application Proxy on AMF Security mini, you have to configure an IP Address, level 15 (privileged) username and password of the AMF Master (Proxy Node) on AMF Security mini.- Open the AMF > AMF Application Proxy Settings page.
- Click "Add".
- Enter an IP Address of the AMF Master (Proxy Node) in "IPv4 Address".
- Enter a username and a password for a level 15 (privileged) user account on the AMF Master (Proxy Node).
- Click "Submit".
NoteWhen you finish this configuration, AMF Security starts regular queries to the AMF Master (Proxy Node) at 30 second interval.
Refer to System Settings > Trap Monitor Settings for how to configure integration options with external applications.
TQ's AMF Application Proxy
TQ's AMF Application Proxy controls communication by authenticating the wireless terminal connected to TQ by AMF Security mini. In addition, it is possible to send the information of the suspected node notified to AMF Security mini from an external application to TQ and control the communication of the corresponding terminal with TQ.Supported actions are Drop Packets, Quarantine, and Log (only Log Output without controlling communication of the corresponding device).
AT-TQ5403 / AT-TQ5403e and AT-Vista Manager EX (AWC Plug-in) are required to use this function.
NoteThe following items are not supported by TQ's AMF Application Proxy.
・ Location policy
・Schedule policy
・session-timeout
・Obtaining authentication information on TQ
・IP Address display of node
・Search Devices
・Account Group
NoteOnce the connection between the connected AMF Master is set to be disconnected, if the device already managed by TQ's AMF Application Proxy (devices displayed on the Device > Active Device List page) exists, the authentication and action of that device remain applied. However, it is deleted from the Devices > Active Device List page.
Supported OpenFlow Switches
The latest information on AlliedWare Plus Devices and wireless LAN access points managed by the AMF Security mini is available in the AMF Security mini and its device documentation.Please find those documents on our website.
https://www.alliedtelesis.com
Application Integration Solutions
AMF Security mini can be used with other applications such as threat detection, device management and HR management in order to further enhance network administration efficiency and security.The latest information on the services or applications which can be integrated into AMF Security system is published under the AMF-SEC Technology Partner Program. Contact our sales engineer for the Technology Partner Program.
09 Jul 2021 12:05