Network Topology

SUMMARY In JSA Risk Manager, you can use the topology model graph to view, filter, and investigate the physical connectivity of your network.

The network topology graph is generated from configuration information that is obtained from devices such as firewalls, routers, switches, and Intrusion Prevention System (IPS) systems. You can hover over connection lines to display network connection information. You can filter the topology by searching for potential attack paths on allowed protocols, ports, or vulnerabilities. You can view the traffic flow between devices or subnets, and you can view device rules.

You can use the topology graph to complete the following tasks:

• Visualize specific network paths and traffic direction for advanced threat analysis.
• Incorporate passive IPS security maps into the topology graph.
• Group devices to organize and simplify the view.
• Add devices to groups, and remove devices from groups.
• Reposition icons in the graph by using your mouse.
• Save topology graph layouts.
• Rename devices and groups.
• Create and save search filters for your network topology that is based on protocols, ports, or vulnerabilities.
• View detailed connection information between devices and subnets.
• View device rules on topology node connections with the allowed ports and protocols.
• View Network Address Translation (NAT) devices, NAT indicators, and information about NAT mappings.
• View virtual Network security devices that have multiple-contexts.
• Configure subnet color coding to indicate vulnerability status of assets in the subnets on your topology graph.

When you search and view the allowed ports and protocols between devices, you can see only connections that use TCP, UDP, and ICMP protocols in the topology graph.