Abstract
This paper proposes a scalable and high available (HA) architecture for implementing cost effective security switches. In this architecture, each ""security switch"" consists of a tradäonal layer-2 switch and a ""security switch engine (SSE)"" which provides packet content inspection service These two components are connected via a Gigabit Ethernet link. A mechanism is proposed to interconnect a group of ""security switches"" to provide the HA feature A system of four security switches is implemented and the experimental results show that the HA function works successfully even only one SSE is active The SSE is implemented with full intrusion prevention function on a standard high performance Industrial PC with the performance of1.2Gbps for UDP packets and 400Mbpsfor TCP flows. Therefore the proposed security switch architecture can be realized in a very cost effective mechanism to provide Intranet protection. Index terms: Defense-in-Depth Intrusion Prevention, High Availability (HA), Security Switch © 2006 IEEE.