Predictika · Network security

An AI sales agent's Arbor Edge Defense deployment, checked before it goes out

An AI sales agent prepares an Arbor Edge Defense (AED) deployment for a customer's network edge: an AED 2600 or 2800 appliance with an inspected-throughput license and protection interfaces, or virtual AED instances, with the traffic to inspect, SSL decryption, DDoS rate, protection groups and the console that manages them. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of the figures NETSCOUT publishes in its data sheet and returns a verdict, every reason and the figures it computed.

Scope: AED 2600 and 2800 appliances with throughput licenses, virtual AED, and the AED Console or Edge Defense Manager: published licenses, interface options, SSL, DDoS rate, protection groups and management limits. See everything this validator covers

This validator models one AED deployment at a time, based on the figures in the public NETSCOUT AED data sheet, not just the scenarios shown below.

  • Appliance licenses and interfaces — the AED 2600 has inspected-throughput licenses of 100, 250 and 500 Mbps and 1, 2, 5, 10, 15 and 20 Gbps, and the AED 2800 has 10, 20, 30 and 40 Gbps. Each model has its own protection interface options (for example 4, 8 or 12 1 GigE ports, or 4 10 GigE ports plus 0, 4 or 8 1 GigE ports, on the 2600; 4 or 8 10 GigE ports, or 8 10 GigE plus 4 1 GigE, on the 2800).
  • SSL, DDoS rate and protection groups — SSL decryption options (750 Mbps and 5 Gbps on the 2600, up to 5 Gbps on the 2800), the maximum DDoS flood rate each model prevents (15 and 28.8 million packets a second), and 100 protection groups on an appliance. Attacks above the 40 Gbps AED stops on premises go to a person, because they rely on Cloud Signaling.
  • Virtual AED — 1 Gbps of inspection per instance, a virtual machine of at least 2 vCPUs, 6 GB of memory and 100 GB of storage, 1 to 10 network interfaces, VMware vSphere 5.5 or later, and 10 protection groups (50 with 4 vCPUs and 12 GB).
  • Management — the AED Console manages up to 50 AED and needs managed AED on version 5.11 or later; the Edge Defense Manager virtual appliance manages up to 12 AED. The inspected throughput the quote states must equal the one computed.

Any AED deployment that touches these rules is in scope — not only the scenarios pictured here. Not covered: prices (the data sheet lists none, so this page shows no price build-up), other NETSCOUT products such as nGeniusONE and probes, the AED Console 7000 appliance hardware, support terms, and real-traffic performance, which depends on configuration. The data sheet read is dated November 2018, so a newer release may differ.

The AI sales agentBuilds the AED deployment from the conversation and says it is ready.
Predictika validatorChecks every rule at once and returns the verdict, each finding, and the computed figures.

7 scenarios in 3 groups · each group runs from the agent’s first attempt to the outcome · click one to switch

What the agent proposes

The AI sales agent says

Illustrative agent statement. The validator receives the structured request below.

Proposing agent: AI sales agent (scripted)

Before sending, the agent must call Recorded run

Predictika validator


      

        
        
        
      

      
Waiting for the call.

      
    

  

  
  

    
Where rules-based CPQ gets it wrong
Click to expand
    
Our assessment of what a typical rules-based CPQ (product rules, price rules and validation rules, as in Salesforce CPQ) does with the same cases. It is a judgment about effort and reliability, not a claim that nothing can be built.

    
What the validator caughtTypical rules-based CPQPredictika
Only the license sizes the data sheet lists for each modelOnly with care
The 2600 and the 2800 have different license lists that overlap in no value but share a field, so a rules-based CPQ needs a table per model and a rule to compare the choice with it.		The model and license arrive in one request and the license is matched to the published list on every call.
Interface options that belong to one modelOnly with care
Each option is a combination of 1 GigE and 10 GigE ports that is valid on one model only, so it needs a compatibility table and a second check against the ports the customer needs.		The option, the model and the ports needed are compared together, in any order.
Limits that change with the virtual machine sizeOnly with workarounds
Protection groups per virtual AED are 10, or 50 once the virtual machine has 4 vCPUs and 12 GB, so one answer depends on two other fields on a different line.		The machine size, the groups needed and the limit are in one request and are checked with the rest.
Console limits that depend on the console and the software versionOnly with care
The count of managed AED has a different ceiling for each console, and the version rule applies to only one of them.		The console, the count and the version are compared together on every call.
Every problem returned in one answerOnly with workarounds
Rules tend to fire as the quote is saved or a step is completed, so a person often fixes one error and meets the next.		All findings come back together, whatever order the choices arrived in.

  

  

    
What this validator catches: findings from its test cases
Click to expand
    
Every rule is checked on every call, in any order the choices arrive; one problem never hides another. Blocking findings stop the quote; approval findings need a person to sign off; everything else is computed.

    
1An inspected-throughput license of 25,000 Mbps is not offered for this model; the AED 2600 has 100, 250 and 500 Mbps and 1, 2, 5, 10, 15 and 20 Gbps, and the AED 2800 has 10, 20, 30 and 40 Gbps.
2An inspected-throughput license of 5000 Mbps is not offered for this model; the AED 2600 has 100, 250 and 500 Mbps and 1, 2, 5, 10, 15 and 20 Gbps, and the AED 2800 has 10, 20, 30 and 40 Gbps.
3An inspected-throughput license of 3000 Mbps is not offered for this model; the AED 2600 has 100, 250 and 500 Mbps and 1, 2, 5, 10, 15 and 20 Gbps, and the AED 2800 has 10, 20, 30 and 40 Gbps.
4An inspected-throughput license of 30,000 Mbps is not offered for this model; the AED 2600 has 100, 250 and 500 Mbps and 1, 2, 5, 10, 15 and 20 Gbps, and the AED 2800 has 10, 20, 30 and 40 Gbps.
5The quote needs 20,001 Mbps of inspected throughput; the selection gives 20,000 Mbps.
6The quote has 0 units; at least 1 is needed.
7The selected protection interface option is not offered on this appliance model.
8The quote needs 5 10-GigE protection ports; the selected option has 4.
9The quote needs 1 1-GigE protection ports; the selected option has 0.
10The quote needs 13 1-GigE protection ports; the selected option has 12.
11SSL decryption of 6000 Mbps is not offered on this model; the AED 2600 has 750 Mbps and 5 Gbps options and the AED 2800 goes up to 5 Gbps.
12SSL decryption of 2000 Mbps is not offered on this model; the AED 2600 has 750 Mbps and 5 Gbps options and the AED 2800 goes up to 5 Gbps.
13The quote expects a DDoS flood of 15,001 thousand packets a second; the model prevents up to 15,000 thousand.
14The quote expects a DDoS flood of 28,801 thousand packets a second; the model prevents up to 28,800 thousand.
15The quote needs 101 protection groups; the selection supports 100.
16The quote needs 11 protection groups; the selection supports 10.
17The quote needs 51 protection groups; the selection supports 50.
18A virtual AED needs at least 2 vCPUs, 6 GB of memory and 100 GB of storage.
19A virtual AED supports 1 to 10 network interfaces; the quote has 11.
20A virtual AED on VMware needs vSphere 5.5 or later; the quote has version 5.0.

  

  

    
Scenarios and results
Click to expand
    
The recorded result of the validator for each scenario on this page: the request the AI agent sent, the verdict, and every finding, in the order they appear above.

    
1. Appliance license, ports and management: AED 2800 for a data center edge with an unavailable license, too few ports and too many groups

    
The agent's request. Please quote one AED 2800 with a 25 Gbps inspected-throughput license and the 4 x 10 GigE protection interface option, for an edge that needs 35 Gbps of inspected traffic, 6 10 GigE and 0 1 GigE protection ports, SSL decryption of none, DDoS floods up to 20,000 thousand packets a second, attacks up to 20 Gbps and 120 protection groups, managed from the AED Console with 60 AED on software version 5.20. The quote states 25 Gbps of inspected throughput in total. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Throughput license not offered for this model. An inspected-throughput license of 25,000 Mbps is not offered for this model; the AED 2600 has 100, 250 and 500 Mbps and 1, 2, 5, 10, 15 and 20 Gbps, and the AED 2800 has 10, 20, 30 and 40 Gbps.
    • 
      
  • Inspected throughput below the requirement. The quote needs 35,000 Mbps of inspected throughput; the selection gives 25,000 Mbps.
    • 
      
  • Not enough 10 GigE protection ports. The quote needs 6 10-GigE protection ports; the selected option has 4.
    • 
      
  • Too many protection groups. The quote needs 120 protection groups; the selection supports 100.
    • 
      
  • Too many AED for the console. The quote has 60 AED to manage; the AED Console manages up to 50 and the Edge Defense Manager up to 12.
    • 
    

    
2. Appliance license, ports and management: The agent resubmits after fixing the errors

    
The agent's request. Please quote one AED 2800 with a 40 Gbps inspected-throughput license and the 8 x 10 GigE protection interface option, for an edge that needs 35 Gbps of inspected traffic, 6 10 GigE and 0 1 GigE protection ports, SSL decryption of none, DDoS floods up to 20,000 thousand packets a second, attacks up to 20 Gbps and 100 protection groups, managed from the AED Console with 40 AED on software version 5.20. The quote states 40 Gbps of inspected throughput in total. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Deployment summary. The selection gives 40,000 Mbps of inspected throughput against 35,000 Mbps required, with 100 protection groups supported.
    • 
    

    
3. Virtual AED sizing: Two virtual AED on a small virtual machine and an old vSphere

    
The agent's request. Please quote 2 virtual AED instances on VMware vSphere 5.0, each on a virtual machine of 2 vCPUs, 6 GB of memory, 100 GB of storage and 4 network interfaces, for a network that needs 4 Gbps of inspected traffic and 30 protection groups, managed from the Edge Defense Manager with 8 AED. The quote states 2 Gbps of inspected throughput in total. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Inspected throughput below the requirement. The quote needs 4000 Mbps of inspected throughput; the selection gives 2000 Mbps.
    • 
      
  • Too many protection groups. The quote needs 30 protection groups; the selection supports 10.
    • 
      
  • VMware vSphere version too old. A virtual AED on VMware needs vSphere 5.5 or later; the quote has version 5.0.
    • 
    

    
4. Virtual AED sizing: The agent resubmits after fixing the errors

    
The agent's request. Please quote 2 virtual AED instances on VMware vSphere 6.7, each on a virtual machine of 4 vCPUs, 12 GB of memory, 100 GB of storage and 4 network interfaces, for a network that needs 2 Gbps of inspected traffic and 30 protection groups, managed from the Edge Defense Manager with 8 AED. The quote states 2 Gbps of inspected throughput in total. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Deployment summary. The selection gives 2000 Mbps of inspected throughput against 2000 Mbps required, with 50 protection groups supported.
    • 
    

    
5. SSL options and large attacks: AED 2600 with an SSL option that does not exist and a large attack

    
The agent's request. Please quote one AED 2600 with a 20 Gbps inspected-throughput license and the 4 x 10 GigE protection interface option, for an edge that needs 18 Gbps of inspected traffic, 4 10 GigE and 2 1 GigE protection ports, SSL decryption of 2,000 Mbps, DDoS floods up to 12,000 thousand packets a second, attacks up to 60 Gbps and 40 protection groups. The quote states 20 Gbps of inspected throughput in total. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Not enough 1 GigE protection ports. The quote needs 2 1-GigE protection ports; the selected option has 0.
    • 
      
  • SSL decryption option not offered. SSL decryption of 2000 Mbps is not offered on this model; the AED 2600 has 750 Mbps and 5 Gbps options and the AED 2800 goes up to 5 Gbps.
    • 
      
  • Attack larger than the on-premises limit. AED stops DDoS attacks as large as 40 Gbps; larger attacks rely on Cloud Signaling to Arbor Cloud or a managed provider, which a person should confirm.
    • 
    

    
6. SSL options and large attacks: The agent resubmits after fixing the errors

    
The agent's request. Please quote one AED 2600 with a 20 Gbps inspected-throughput license and the 4 x 10 GigE plus 4 x 1 GigE protection interface option, for an edge that needs 18 Gbps of inspected traffic, 4 10 GigE and 2 1 GigE protection ports, SSL decryption of 750 Mbps, DDoS floods up to 12,000 thousand packets a second, attacks up to 60 Gbps and 40 protection groups. The quote states 20 Gbps of inspected throughput in total. It is ready to send.

    
Verdict: Needs approval.

    
    
      
  • Attack larger than the on-premises limit. AED stops DDoS attacks as large as 40 Gbps; larger attacks rely on Cloud Signaling to Arbor Cloud or a managed provider, which a person should confirm.
    • 
      
  • Deployment summary. The selection gives 20,000 Mbps of inspected throughput against 18,000 Mbps required, with 100 protection groups supported.
    • 
    

    
7. SSL options and large attacks: The agent resubmits after fixing the errors

    
The agent's request. Please quote one AED 2600 with a 20 Gbps inspected-throughput license and the 4 x 10 GigE plus 4 x 1 GigE protection interface option, for an edge that needs 18 Gbps of inspected traffic, 4 10 GigE and 2 1 GigE protection ports, SSL decryption of 750 Mbps, DDoS floods up to 12,000 thousand packets a second, attacks up to 35 Gbps and 40 protection groups. The quote states 20 Gbps of inspected throughput in total. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Deployment summary. The selection gives 20,000 Mbps of inspected throughput against 18,000 Mbps required, with 100 protection groups supported.
    • 
    

  

  

    
Narration transcript
Click to expand
    
The text of the narrated walkthrough, step by step.

    
    
      
  1. Welcome to a demo of Predictika's Validator. An AI sales agent prepares an Arbor Edge Defense (AED) deployment for a customer's network edge: an AED 2600 or 2800 appliance with an inspected-throughput license and protection interfaces, virtual AED instances. Before it goes out, the agent sends it to Predictika, which checks it against a declarative model of the figures NETSCOUT publishes in its data sheet and returns a verdict, every reason and the figures it computed.
    2. 
      
  2. I will start with the first request by the agent.
    3. 
      
  3. The agent says. Please quote one AED 2800. The quote states 25 Gbps of inspected throughput in total. The rest of the request is on screen.
    4. 
      
  4. Before it goes out, the agent calls the validator.
    5. 
      
  5. Blocked, with five findings, all in one answer. An inspected-throughput license of 25,000 Mbps is not offered for this model; the AED 2600 has 100, 250 and 500 Mbps and 1, 2, 5, 10, 15 and 20 Gbps, and the AED 2800 has 10, 20, 30 and 40 Gbps. The quote needs 35,000 Mbps of inspected throughput; the selection gives 25,000 Mbps. The quote needs 6 10-GigE protection ports; the selected option has 4. The other two are on screen.
    6. 
      
  6. The validator returned five blocking findings in one answer. A check that reads one field at a time would pass most of this; it shows only when the choices in the quote are checked against each other.
    7. 
      
  7. What this shows: for only the license sizes the data sheet lists for each model, a rules-based CPQ is error-prone for this.
    8. 
      
  8. Now the agent resubmits.
    9. 
      
  9. The corrected request. It changes the inspected-throughput license to 40 Gbps, the protection interface option to 8 x 10 GigE, the protection groups needed to 100, the AED to manage to 40 and the stated inspected throughput as to 40 Gbps.
    10. 
      
  10. It calls the validator again.
    11. 
      
  11. This time the validator clears it.
    12. 
      
  12. All five earlier findings are cleared, and the validator's figure matches the quote.
    13. 
      
  13. Five problems caught in one call, fixed in one pass, and a clean quote. That is the value of Predictika's validator: catching mistakes before they reach the customer. Now you can try the other scenarios yourself.
    14.