The Cisco 4000 Family Integrated Services Router (ISR) revolutionizes WAN communications in the enterprise branch. With new levels of built-in intelligent network capabilities and convergence, it specifically addresses the growing need for application-aware networking in distributed enterprise sites. These locations tend to have lean IT resources. But they often also have a growing need for direct communication with both private data centers and public clouds across diverse links, including Multiprotocol Label Switching (MPLS) VPNs and the Internet.

The Cisco 4000 Family contains the following platforms: the 4461, 4451, 4431, 4351, 4331, 4321 and 4221 ISRs.

Features and Benefits

Cisco 4000 Family ISRs provide you with Cisco® Software Defined WAN (SDWAN) software features and a converged branch infrastructure. Along with superior throughput, these capabilities form the building blocks of next-generation branch-office WAN solutions.

Cisco Software Defined WAN

Cisco SDWAN is a set of intelligent software services that allow you to reliably and securely connect users, devices, and branch office locations across a diverse set of WAN transport links. SDWAN-enabled routers like the ISR 4000 dynamically route traffic across the “best” link based on up-to-the-minute application and network conditions for great application experiences. You get tight control over application performance, bandwidth usage, data privacy, and availability of your WAN links - control that you need as your branches conduct greater volumes of mission-critical business.

Cisco Converged Branch Infrastructure

The Cisco 4000 Series ISRs consolidate many must-have IT functions, including network, compute, and storage resources. The high-performance, integrated routers run multiple concurrent services, including encryption, traffic management, and WAN optimization, without slowing your data throughput. And you can activate new services on demand through a simple licensing change.

Cisco Intent Based Networking and Digital Network Architecture (Cisco DNA)

The last few years has seen a rapid transformation and adoption of digital technologies. This puts pressure on the on the Network teams supporting this changing infrastructure - especially when provisioning, managing, monitoring and troubleshooting these diverse devices. Additionally innovations such as Software Defined WAN (SDWAN), Network Function Virtualization (NFV), Open APIs and Cloud Management show great promise in transforming Organizations IT networks. This transformation raises further questions and challenges for the IT teams.

The Cisco Digital Network Architecture (Cisco DNA) is an open, extensible, software-driven architecture that provides for faster innovation, helping to generate deeper insights, and deliver exceptional experiences across many different applications. Cisco DNA relies on intent-based networking, a revolutionary approach in networking that helps organizations automate, simplify, and secure the network.

The intent-based Cisco DNA network is:

• Informed by Context: Interprets every byte of data that flows across it, resulting in better security, more customized experiences, and faster operations.
• Powered by Intent: Translates your intent into the right network configuration, making it possible to manage and provision multiple devices and things in minutes.
• Driven by Intuition: Continually learns from the massive amounts of data flowing through it and turns that data into actionable insight. Helps you solve issues before they become problems and learn from every incident.

Cisco DNA Center provides a centralized management dashboard across your entire network — the branch, campus, data center, and cloud. Rather than relying on box-by-box management, you can design, provision, and set policy end-to-end from the single Cisco DNA Center interface. This allows you to respond to organizational needs faster and to simplify day-to-day operations. Cisco DNA Analytics and Assurance and Cisco Network Data Platform (NDP) help you get the most from your network by continuously collecting and putting insights into action. Cisco DNA is open, extensible, and programmable at every layer. It integrates Cisco and third-party technology, open APIs, and a developer platform, to support a rich ecosystem of network-enabled applications.

System Features

• The CorreLog SIEM Server is specifically designed to leverage the capabilities of your existing infrastructure without requiring extensive installation of agents or other software. The program is designed for high capacity, enterprise scale message aggregation, ease of navigation, small footprint, extensibility, and high internal security, available in a single web-based console.

• High Speed Message Reception. CorreLog SIEM is suitable to operate as the single SNMP Trap and Syslog receiver for all devices on the network of large enterprises. CorreLog SIEM can process more than 2000 messages per second and can handle burst traffic of more than 10,000 messages in one second (depending upon the supporting hardware.) CorreLog SIEM tracks and catalogs devices on the network without hard upper limit. You can receive messages from virtually unlimited numbers of sources.

• High Speed Message Correlation. CorreLog SIEM uses an advanced correlation engine, which performs semantic analysis of your messages in real-time. The system employs correlation threads, correlation counters, correlation alerts, and correlation triggers, which refine and reduce your incoming messages into something you can easily understand.

• Flexible Reporting. CorreLog SIEM incorporates various reporting facilities, including an Excel-based reporting facility that populates spreadsheets with summary and detailed event information, and an ODBC reporting facility that populates one or more databases with report information to support third-party report writers. Additionally, CorreLog SIEM includes a comprehensive dashboard facility, a "Pivot" log analyzer (for analyzing firewall data, HTTP server logs, and other "regular" data) and comprehensive graphing utilities useful for reporting on correlation results. The CorreLog Server comes preconfigured with compliancy reports and correlation rules to support these reports. Additional report templates can be loaded (or saved) using a built-in "Template" facility.

• Data Aggregation and Archiving Functions. The CorreLog SIEM system can aggregate vast amounts of data. It can collect in excess of 1 Gigabyte of data each day at a single site, and save this data online for up to 500 days (given enough storage.) Additionally, CorreLog SIEM compresses and archives your data, retaining this data for a period of more than 10 years (5000 days). To assist in forensics and long-term analysis, CorreLog SIEM generates archival data such as MD5 checksums and Security Codes.

• Data Searching Ability. One of the most important functions of the CorreLog SIEM system program is its search capability. CorreLog SIEM uses its proprietary GenDex (Generate Data Extraction) program, which employs a high speed, real time index system. This allows quick searches through massive amounts of message data. The performance of this engine rivals the fastest search engines currently available. Users can search a terabyte of data for a particular keyword in less than one second.

• Taxonomy, Ontology, and Catalog Functions. Taxonomy and categorization of data is at the center of our unique correlation system. The CorreLog SIEM Server automatically catalogs information by IP address, username, facility, and severity. Users can further create catalogs of information based upon simple or complex match patterns. Data is cataloged based upon specifications consisting of simple keywords, wildcards and regular expressions, logical expressions of wildcards, macro definitions of regular expressions, and logical combinations of macros. This provides a complete flexibility in managing and grouping message data, while still maintaining high data throughputs, and avoiding the rigors of data normalization.

• Ability To Define New Syslog Facilities. One of the commonly noticed limitations of Syslog protocol has always been that the "Facility" codes (which define the data sources for syslog messages) are limited to 24 predefined codes. The CorreLog program removes this restriction, permitting users to define their own facilities, such as "applications", and "devmsgs", so that data can be better categorized and managed. This important extension to the syslog protocol opens important new vistas in the practical use of Syslog messages and their correlation, not otherwise available using the standard specification.

• Ability To Override Message Content. One of the commonly noticed limitations of SNMP Trap and Syslog protocol has always been that, since messages are unsolicited, the message collector is stuck with whatever message, severity, or facility was originally specified by the message sender. In some cases the severities or facilities within a message may be nonsensical. The CorreLog program recognizes this existing limitation and implements a sophisticated "override" scheme, which allows users to override the facility, severity, or device name in any message. This greatly assists with the control and correlation of data.

• Input Filtering. To reduce data loading, and permit precise control over incoming messages, CorreLog SIEM can filter input data by device, facility, severity, message keyword, time of day, or any combination of these. Filtered data can be discarded, or put into a separate repository (and possibly permanently archived) for further analysis or forensics. When data is filtered, it is automatically tagged with the particular filter expression, assisting in the analysis of filtered data. CorreLog treats filtered data with respect, permitting you to re-import discarded data and undo any particular filtering function.

• Automatic Remediation And Response. The CorreLog SIEM system incorporates a simple and extensible "Actions" capability, which permits you to target specific messages based upon device, keyword, facility, severity and/ or time of day, and run programs on that data. CorreLog SIEM includes utility programs to update relational ODBC databases, relay syslog messages, send SNMP traps, send e-mail, and perform other actions. The facility is designed for easy extensibility by administrators and developers to extend correlation and ticketing services of the program.

• Web Based Configuration. CorreLog SIEM is entirely web-based. All activities, including the establishment of logins and permissions, are completely achieved without a native console. This means that an administrator does not ordinarily need access to the CorreLog Server platform, except in rare instances to startup or shutdown the process. The location of the CorreLog Server can be strategically placed in a Network Operations Center (NOC) or secure cabinet, which has important implications for security.

• Suite of Utilities. The CorreLog Server system incorporates a suite of Win32 utilities, in one small package that is easily installed on Windows Vista, XP, or Windows 2000 servers. These utilities are redistributable, and greatly extend the ability to manage these platforms using Syslog protocol.