Reference Architecture: On-Premises Inline Deployment

Introduction

In typical network configurations without DDoS protection, your internal network has one or more routers upstream, at the edge of the network ("Edge Routers"). These edge routers connect directly to outside networks, usually those of Internet Service Providers (ISPs), which forward you traffic from the Internet. Unfiltered traffic (which can include attacks) flows from this upstream network (through one or more upstream routers) to your network's edge. This unfiltered traffic is then forwarded to your internal network by your edge routers.

When using inline deployment to provide DDoS protection, RioRey adds two different devices to the network (see diagram below). The first, a RIOS filter device, is placed in path between the upstream and edge routers. This RIOS device monitors incoming traffic from upstream and identifies attack traffic. If RIOS sees attack traffic it drops it in place, preventing the attack from continuing to your edge router and thus to internal users of your network. Traffic outbound from your network to the Internet is always allowed through transparently.

Your networking team uses the second RioRey device, the rWeb management platform, to configure and control one or more RIOS devices. rWeb receives reporting about incoming attacks, providing network visibility, and can additionally be configured to alert the network team of attacks using a variety of channels. rWeb unifies RIOS device configuration and allows fine grained adjustments to your mitigation profile.

Basic Design

Components

rWeb

An rWeb appliance is deployed as the main interface for on-premise configuration, reporting, and coordination. rWeb manages one or more RIOS components. Network prefixes are defined centrally in rWeb, and then used for traffic configuration, reporting, and filtering.

RIOS

RIOS can be deployed inline either as a VM or as a Hardware appliance, scaled to the size of the network's transit links.