-
Cisco PCI Solution for Retail Design and Implementation Guide
-
Preface
-
Solution Overview
-
Solution Architecture
-
Solution Components—Best Practices and PCI
-
Implementing and Configuring the Solution
-
Bill Of Materials of Devices for Branch Stores
-
Data Center/Internet Edge Components and Versions
-
Application Protocols
-
Detailed Implementation and Configuration Steps
-
Device Configurations
-
Report on Compliance (ROC)
-
Verizon Business Assessment for: Cisco PCI Solution for Retail
-
Glossary
-
Table Of Contents
Applications and Partner Services
Application Networking Services
Solution Architecture
The architecture for the Cisco PCI Solution for Retail is based on Cisco 's Connected Retail, which is a Service-Oriented Network Architecture (SONA). For more information on SONA and Cisco Connected Retail, refer to the following URL:
http://www.cisco.com/go/retail
The Cisco Connected Retail reference designs serve as the foundation of the network systems layer. These network designs exhibit best practices for small, medium, and large retail store networks as well as data center and Internet networks. (See Figure 2-1.)
Figure 2-1 Cisco PCI Solution for Retail SONA Framework
Applications and Partner Services
The top layer of the SONA framework includes the retail applications and services that are part of the Cisco PCI Solution for Retail. These include point-of-sale, payment, and encryption applications. Some of these applications use popular middleware services based on J2EE, .NET, or other systems. The Cisco Connected Retail and the shared network services approach allow these various Service-Oriented Architecture (SOA) environments to share the same infrastructure services across multiple retail network topologies. Finally, the right side of the Application Layer includes the professional services that retailers must employ as part of the PCI process. Annual audits, network scans, and remediation services are necessary services that complete the Cisco PCI Solution for Retail framework.
Application Networking Services
Application services are the connection from the business applications to the shared services of the infrastructure services layer. This is where filtering, caching, load balancing and protocol optimization interact with applications or application middleware services to optimize the performance from the source of data to the end user.
Application delivery services in this solution include server load-balancing and content filtering features that Cisco IOS routers or Cisco Application Control Engines (ACEs) perform.
Infrastructure Services
Process control is simplified by using common infrastructure services for security, mobility, identity, and management. These are key advantages that aid in operational reporting and the policy requirements of achieving PCI compliance. Fewer services that are shared across more intelligent devices increases the operational efficiency of the whole system.
•
Security services are used extensively in the PCI Solution for Retail architectures. These services are a combination of security features shared across multiple physical devices, central management in the data center, and virtual access to the security control plane from anywhere in the retail network.
•
•
•
•
•
•
Wireless systems are managed with the Cisco Wireless Control System (WCS). These systems include configurations, administrative elements, and security services.
RSA data security applications use specific management tools in this architecture. RSA file security manager manages file encryption services on hosts and servers with payment data. RSA enVision is used to monitor and log events associated with RSA SecurID-based two-factor authentication in this solution.
Network Systems Layer
Network virtualization services are built into the architecture. For example, the Cisco ISR in each store network design virtualizes the security, routing, and identity services that many separate network appliances perform in legacy retail network architectures. Virtualization is also a key feature of the Cisco Unified Wireless systems in each store topology that manage the wireless infrastructure holistically rather than at each access point. The wireless system dynamically tunes and heals itself based on inputs from the central management system. The combined group of network systems in each store reference design is also feeding data to the central network and security monitoring system. This virtualization of the entire enterprise allows the central correlation of events to drive proactive and adaptive techniques to make the overall retail environment more secure.
•
http://www.cisco.com/en/US/netsol/ns656/networking_solutions_design_guidances_list.html#anchor7
•
Retail Store Network Designs
Small Store
The small store network scenario, shown in Figure 2-2, meets the following design requirements.
Primary Design Requirements
•
•
•
•
•
Figure 2-2 Cisco PCI Solution for Retail—Small Store Network Design
Overview and Description
The small store reference architecture is a powerful platform for running an enterprise retail business that requires simplicity and a compact form factor. This combination appeals to many different retail formats that can include the following:
•
•
•
•
•
•
This network architecture is widely used and consolidates many services into fewer infrastructure components. The small store also supports a variety of retail business application models because an integrated Ethernet switch supports high-speed LAN services. In addition, an integrated Content Engine supports centralized application optimization requirements such as Web Cache Communications Protocol (WCCP)-based caching, pre-positioning of data, local media streaming, and other application velocity services.
Advantages
•
•
•
•
Limitations
•
•
Medium Store
The medium store network scenario, shown in Figure 2-3, meets the following design requirements.
Primary Design Requirements
•
•
•
•
•
Figure 2-3 Cisco PCI Solution for Retail—Medium Store Network Design
Overview and Description
The medium retail store reference architecture is designed for enterprise retailersbusinesses that require network resilience and increased levels of application availability over the small store architecture and its single-threaded, simple approach. As more mission-critical applications and services converge onto the IP infrastructure, network uptime and application availability are more important. The dual-router and dual-LAN switch design of the medium store supports these requirements. Each of the ISR routers can run IOS security services and other store communication services simultaneously. Each of the ISR routers is connected to a dedicated WAN connection. Hot-Standby Routing Protocol (HSRP) is used to ensure network resilience in the event that the network connection fails.
The access layer of the network offers enhanced levels of flexibility and more access ports compared to the small store. Up to 12 wireless access points can be installed in the store (supported by the WCS controller as tested and without adding more controllers). The distributed Cisco Catalyst switches can support a combination of larger physical buildings or a larger number of endpoints than the small store.
Advantages
•
•
•
Limitations
•
•
Large Store
The store large branch network scenario, shown in Figure 2-4, meets the following design requirements.
Primary Design Requirements
•
•
•
•
•
Figure 2-4 Cisco PCI Solution for Retail—Large Store Network Design
Overview and Description
The large retail store reference architecture takes some of the elements of Cisco campus network architecture recommendations and adapts them to a large retail store environment. Network traffic can be better segmented (logically and physically) to meet business requirements. The distribution layer of the large store architecture can greatly improve LAN performance while offering enhanced physical media connections (that is, fiber and copper for connection to remote access layer switches and wireless access points). A larger number of endpoints can be added to the network to meet business requirements. This type of architecture is widely used by large format retailers globally. Dual routers and distribution layer media flexibility greatly improve network serviceability because the network is highly available and scales to support the large retail store requirements. Routine maintenance and upgrades can be scheduled and performed more frequently or during normal business hours because of parallel path design.
Advantages
•
•
•
•
Limitations
•
These retail store network designs are capable of helping a retailer achieve PCI compliance, and also serve as the scalable platform for new services and applications that embody the Cisco Connected Retail.
Data Center
Figure 2-5 shows the data center solution design.
Figure 2-5 Typical Retail Enterprise Data Center Design
Primary Design Requirements
•
•
•
•
•
•
•
Overview and Description
For the purpose of this document, the data center is split into five areas: WAN aggregation, core, services aggregation, server access, and storage. The core, services aggregation, and server access tiers of the multi-tier data center architecture was based on the design documented in the Cisco Data Center Infrastructure Design Guide 2.5, which can be found at the following URL:
http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/DC_Infra2_5/DCI_SRND_2_5_book.html
The WAN aggregation architecture is based on the Infrastructure Protection and Security Service Integration Design for the Next Generation WAN Edge v 2.0, which can be found at the following URL:
http://www.cisco.com/en/US/docs/solutions/Enterprise/WAN_and_MAN/IPSNGWAN.html
WAN Aggregation
The WAN aggregation layer is a transit network that aggregates the connections from the retail stores, and enterprise branch office LANs via a private or public service provider network. The WAN aggregation layer does not directly connect end users in the HQ, campus or regional branches; rather, it provides connectivity for the store LANs to connect to the data center core network and its resources.
The WAN edge devices are Cisco routers which should not also be used as the Internet gateways for the data center network. This recommendation is based on segmentation and typical throughput requirements for the store WAN. If VoIP is transported between the stores and enterprise network, voice quality issues related to the ability to guarantee bandwidth to store connectivity is another concern. Additionally, redundancy, store-backup networks, and overall network security-related concerns would limit the scope of the WAN aggregation to the function of connecting the store networks to the data center.
At the WAN aggregation layer, interior to the WAN edge routers, a dedicated firewall appliance is used to secure incoming WAN traffic and to terminate store VPN connections. This design provides the highest scalability. Many Cisco routers also support the IOS security software option which includes a firewall feature. Cisco recommends the use of the Cisco IOS Security feature set in stores, branches and teleworker deployments, because of a much lower number of users and connection rates than at the store WAN aggregation headend location.
There are two typical WAN speeds categories for a WAN aggregation network: less than and up to OC3 (155 Mbps) and OC12 (622 Mbps) and above. The choice of these two network speeds determines the platform set to select from Cisco. In addition, this design creates two profiles for each WAN speed. These profiles are designed to provide guidance when designing a WAN edge network regardless of which enterprise WAN architecture is selected. The profiles for each WAN speed investigate integrated versus dedicated chassis for each functionality component as highlighted in the previous section. Some customers prefer a highly integrated solution where most, if not all, of the WAN edge functions described in this document reside on a single or very few network devices. Other customers prefer the granularity and scalability of these same functions separated across multiple network devices.
Figure 2-6 Data Center —WAN Aggregation Alternatives
Core
The core layer provides the high-speed packet switching backplane for all flows going in and out of the data center. The core layer provides connectivity to multiple aggregation modules and provides a resilient Layer 3 routed fabric with no single point of failure. The core layer runs an interior routing protocol, such as Open Shortest Path First (OSPF) or Enhanced Interior Gateway Routing Protocol (EIGRP), and load balances traffic between the campus core and aggregation layers using the Cisco Express Forwarding (CEF)-based hashing algorithms.
Services (Edge) Aggregation
The services aggregation layer modules provide important functions, such as service module integration, Layer 2 domain definitions, spanning tree processing, and default gateway redundancy. Server-to-server multi-tier traffic flows through the aggregation layer and can use services, such as firewall and server load balancing, to optimize and secure applications. The service modules provide services, such as content switching, firewall, SSL offload, intrusion detection, network analysis, and more. Figure 2-7 illustrates a characterized view of the service aggregation layer.
Figure 2-7 Conceptual Service Aggregation Layer
This is a conceptual example of a single Cisco Catalyst 6500 switch and service modules. Cisco's data center reference architectures recommend pairs of service aggregation switches to meet typical high-availability requirements of the server access or storage layers.
Server Access Layer
The server access layer is where the servers physically attach to the network. In typical data centers, the server components consist of 1RU servers, blade servers with integral switches, blade servers with pass-through cabling, clustered servers, and mainframes with OSA adapters. The access layer network infrastructure consists of modular switches, fixed configuration 1 or 2RU switches, and integral blade server switches. Switches provide both Layer 2 and Layer 3 topologies, fulfilling the various server broadcast domain or administrative requirements.
The solution management servers connect to the network in this layer. This way they are centralized, segmented from other business application servers, and protected by firewall services from the service aggregation layer above. Business servers, consisting of POS transaction log servers, database, and data warehouse servers would also exist at this layer but would be segmented via separate VLANs and firewall policy.
Storage
A combination of the file encryption provided by the RSA File Security Manager product, fiber-channel zoning, and Logical Unit (LUN) masking/zoning as provided by the Cisco family of multi-layer director switches (MDS) were used in the storage implementation of this solution to deliver encryption and restricted access to cardholder data at rest in the datacenter. By deploying zoning within a Fibre Channel fabric, device access is limited to devices within the zone. This allows the user to segregate devices based on access to a particular storage device (disk array). This is generally an absolute requirement when dealing with a datacenter environment in which multiple file servers in the datacenter server farm are connected to the same SAN fabric and access to cardholder data must be restricted to a subset of servers. LUN masking takes zoning beyond the fiber-channel, switch port level by allowing for the restricted access to specific logical units on a given disk array such that only specific devices belonging to the LUN zone will be able to access those sections of the disk.
Figure 2-8 Data Center Storage Area Networking
Advantages
•
•
•
•
•
•
•
Limitations
•
•
•
Internet Edge
The Internet edge solution architecture is listed in Figure 2-9.
Figure 2-9 Typical Internet Edge Architecture
Primary Design Requirements
•
•
•
•
•
•
Overview and Description
The solution uses a collapsed Internet edge and extranet network to support Internet connectivity and business partner connectivity. This design takes into account best practices from the in Data Center Networking: Internet Edge Design Architecture Design Guide (http://www.cisco.com/go/designzone) and customizes these recommendations for Retail a business Internet edge and extranet network. The edges connects Internet services to the complete enterprise environment (i.e., from headquarters to Internet service providers (ISP), branch office connections that use Cisco secure VPN to connect to headquarters. The collapsed design provides highly centralized and integrated edge networks and transports the aggregated traffic through different service modules (Cisco ACE, Cisco FWSM and Cisco IDSM2) within a pair of Cisco Catalyst 6500 switch chassis. The design provides protection and defense against XML threats using the Cisco ACE AXL Gateway. The Internet edge provides the following security functions:
•
•
•
•
•
•
Advantage
•
•
•
Disadvantage
•
Chapter 3, "Solution Components—Best Practices and PCI," provides the mapping between specific Cisco solution components and the required PCI elements to meet QSA audit requirements.
