AI illustration
Firewall: protection at the boundary
The problem
Your firewall is a black box with mandatory licenses. The office and production share the same network.
The solution
AIMSTRONG carries AIMdefense, the Next Generation Firewall from Germany. It inspects traffic with IDS/IPS and deep packet inspection and splits your network into zones. You tighten the boundary between office and production step by step: observe first, then log, then block. Prefer open source? OPNsense is available pre-installed.
Suitable classes
Every class from XS to XXL. For high availability there is XSR-HA with two systems in 1U.
Guide value, estimated *
XS: up to 1 Gbit/s per port with large packets (measured on the XSR with the same processor and network card), up to about 200 Mbit/s with mixed traffic (IMIX)
L: up to about 10 Gbit/s in total with large packets, up to about 2.5 Gbit/s with mixed traffic (IMIX)
XXL: up to about 25 Gbit/s in total with large packets, up to about 5 Gbit/s with mixed traffic (IMIX), no commitment for 100 Gbit/s
AI illustration
Proxy: in front of your services and inside encrypted traffic
The problem
Your web application sits directly on the internet. You cannot see into encrypted traffic.
The solution
AIMdefense on AIMSTRONG includes web, mail and reverse proxy with a web application firewall. The reverse proxy accepts requests from outside and passes on only clean requests. With the NGFW Package, encrypted traffic becomes inspectable through TLS inspection. For load balancing in front of several servers, RELIANOID has been tested on AIMSTRONG.
Note
Measured values for proxy and TLS inspection will follow.
Suitable classes
Mostly M to XL. TLS inspection needs computing power, we size the device for your traffic.
Guide value, estimated *
M: inspection up to about 70 Mbit/s, reverse proxy up to about 1,500 new TLS connections/s
L: inspection up to about 600 Mbit/s, reverse proxy up to about 8,000 new TLS connections/s
XL: inspection up to about 1 Gbit/s, reverse proxy up to about 15,000 new TLS connections/s
AI illustration
Jump host: one entrance instead of many back doors
The problem
Your machine supplier has permanent access to the network. Nobody knows who was in when.
The solution
A dedicated AIMSTRONG becomes the only access point into isolated network segments. Access opens on request and closes again afterwards. Every session is logged. Every supplier gets its own limited path. Through it, the central platform also reaches systems that cannot be reached directly.
Suitable classes
XS or S per site, XSR in the rack. The jump host runs on a device of its own, separate from other roles.
Request a consultation
AI illustration
Monitoring node: see outages before users call
The problem
When a switch fails at the branch, you hear about it from the users.
The solution
The AIMSTRONG collects measurements on site with Zabbix and passes them on to the central server. In small environments the server runs on the device as well. In large environments it runs with high availability on AIMcompute, and the AIMSTRONG stays on site. Proven in production for years.
Suitable classes
XS or S as a node on site, S or M as the server for small environments.
Guide value, estimated *
XS: as a proxy up to about 100 hosts, not recommended as a server on the device
S: as a proxy up to about 250 hosts, as a server on the device up to about 25 hosts
M: as a proxy up to about 200 hosts, as a server on the device up to about 100 hosts
AI illustration
Gateway: headquarters, branch and home office securely connected
The problem
The connection from the home office keeps dropping. Transfers break off in the middle of saving.
The solution
At headquarters, the AIMSTRONG keeps the encrypted connections to all sites permanently open. VPN with IPsec, OpenVPN or WireGuard, several internet lines with load balancing and failover. In the branch, the S class brings LTE or 5G as a second path. Guests reach the network through a portal of their own, not the company network.
From the field
A home care service connects ten home office workplaces to one appliance at headquarters. Redundant over DSL and LTE, changeover in six weeks.
Suitable classes
S in the branch. At headquarters M or L, depending on the number of sites.
Guide value, estimated *
S: IPsec (AES-GCM) up to about 900 Mbit/s, WireGuard up to about 800 Mbit/s, up to about 80 concurrent remote users
M: IPsec (AES-GCM) up to about 500 Mbit/s, WireGuard up to about 450 Mbit/s, up to about 50 concurrent remote users
L: IPsec (AES-GCM) up to about 2 Gbit/s, WireGuard up to about 2.5 Gbit/s, up to about 200 concurrent remote users
AI illustration
Network access control: only known devices get in
The problem
Anyone who plugs a cable into a network port is on the company network.
The solution
The AIMSTRONG checks every login on site via 802.1X, on switches and in the Wi-Fi. For this it runs the RADIUS service. The AIM Platform controls it with the NAC & PKI module and supplies it from its own certificate authority. For high availability, several devices work in sync. PacketFence has been tested as an open-source alternative.
Suitable classes
XS or S per site, depending on the number of devices on the network.
Guide value, estimated *
XS: up to about 500 devices
S: up to about 1,500 devices
Config backup: every configuration saved and comparable
The problem
The configurations of your switches and firewalls are scattered across servers and laptops. Nobody checks them.
The solution
An AIMSTRONG with the backup module of the AIM Platform collects the configurations on schedule. From network devices, firewalls and Linux systems. It shows what has changed between two versions, down to the individual file. It reaches devices in isolated networks through a jump host.
Suitable classes
XS or S.
Guide value, estimated *
XS: up to about 100 devices
S: up to about 250 devices
Switch control: all switches from one dashboard
The problem
A port needs to be blocked, a phone restarted. For that, someone logs in to every switch separately, each vendor with its own interface.
The solution
The network module of the AIM Platform controls switches from different vendors from one dashboard. Switch ports, control PoE, test cables. On an AIMSTRONG, the module runs with the AIM Platform in your own building, even without internet.
Suitable classes
From class L for the AIM Platform in-house. Large environments run the platform on AIMcompute.
Go to the AIM PlatformRequest a consultationFirewall management: all firewalls in one dashboard
The problem
Your sites run firewalls from different vendors. Each has its own interface, and nobody has the overview.
The solution
The firewall module of the AIM Platform manages AIMdefense, OPNsense, pfSense and DynFi in one dashboard, including the VPN connections. New AIMdefense firewalls register with the platform by themselves. On an AIMSTRONG, the module runs in your own building, even without internet.
Suitable classes
From class L for the AIM Platform in-house. Large environments run the platform on AIMcompute.
Go to the AIM PlatformRequest a consultationPassword vault: credentials kept in-house
The problem
The admin passwords are kept in a shared spreadsheet.
The solution
Passkeepr manages passwords and credentials on an AIMSTRONG in your own building. Two-factor login and one-time passwords (OTP) are built in. Open source, without a third-party cloud.
Suitable classes
XS or S.
Guide value, estimated *
XS: up to about 25 users
S: up to about 100 users
AI illustration
All-in-one: one device instead of many boxes
The problem
Five boxes stand in the cabinet for firewall, access control, backup and monitoring. Each needs maintenance, and nobody has time for it.
The solution
In small environments, one AIMSTRONG takes on several tasks at once. AIMdefense protects the boundary. On the same device, the AIM Platform controls access control, config backup and monitoring. Everything appears in one dashboard.
Suitable classes
From class L. It has enough cores and memory so that the tasks do not slow each other down.
Guide value, estimated *
L: Firewall with IPS, platform, NAC, monitoring, config backup and Passkeepr together on one device: up to about 150 workplaces with up to 1 Gbit/s internet, up to about 500 NAC devices, monitoring server up to about 100 hosts, up to about 200 devices in config backup, up to about 100 Passkeepr users, TLS inspection only for selected groups up to about 200 Mbit/s. Around a quarter of the memory and a third of the computing power remain free as a reserve. From about 250 workplaces or more than 500 NAC devices, spread the roles across separate devices.
Good to know
- One device is a single point of failure. For important sites we recommend a second device in a cluster.
- We run the jump host on a device of its own.
- As the environment grows, the AIM Platform moves to AIMcompute. The AIMSTRONG stays on site.
SOC appliance: AIMsec ready to use
The problem
An attack is running at 03:14. Who responds?
The solution
AIMsec detects attacks and responds automatically. The platform comes as a ready-to-use AIMSTRONG appliance. Large environments run on AIMcompute. On request, AIMsoc takes over operation around the clock.
Suitable classes
Depending on the size of your environment.
Go to AIMsocMore tasks
AIMSTRONG also runs virtualization with Proxmox VE, SD-WAN with flexiWAN and other tested open-source solutions.
Open source on AIMSTRONG* Guide values estimated from the hardware specification and comparable systems, not measured. Measured values are listed under “How we test”. How we test
Which roles can share a device?
Small sites often combine roles, such as monitoring and NAC. We always keep the jump host on a device of its own. What fits together is something we clarify in the consultation.