Hillstone SG6K-VM02-IN-012: Virtuální Firewall Cloud Edge, podpora 2 jádra, pamět 4G

Specifikace:

• AV Throughput: 1.6Gbps
• IPS Throughput: 2Gbps
• IPSEC Througput: 400Mbps
• IPSEC VPN Tunnels: 500
• SSL VPN Users (Default/max): 5/250
• Core (Min/max): 2/2
• Memory: 2G
• Network Interfaces: 10
• Firewall Throughput (1518 Bytes): 4Gbps
• Maximum Concurrent Sessions: 500K
• New Sessions Per Second: 20K

Popis:

Virtuální firewall Cloud Edge se používá k ochraně perimetru v datových centrech (z WAN do LAN). Virtuální firewall Cloud Edge lze také použít jako bezpečnostní bránu pro Virtual Private Cloud (VPC) ve veřejném cloudu.

Cloud Edge poskytuje špičkovou ochranu v reálném čase pro aplikace a proti síťovým útokům. Poskytují ochranu proti virům, spywaru, červům, botnetům, ARP spoofingu, DoS / DDoS útokům, trojským koním atp.

CloudEdge podporuje různé hypervisor řešení (KVM, Xen a VMware ESXi) a může být integrován do nejrůznějších cloudových platforem (AWS, OpenStack a VMware vCenter)

Vlastnosti:

Network Services and Support

• Static and policy routing
• Route controlled by application
• Built-in DHCP, NTP, DNS Server and DNS proxy
• Interface modes: sniffer, port aggregated, loopback

Firewall

• Operating modes: NAT/route, transparent (bridge), and mixed mode
• Schedules: one-time and recurring
• Application Level Gateways and session support: MSRCP, PPTP, RAS, RSH, SIP, FTP, TFTP, HTTP, dcerpc, dns-tcp, dns-udp, H.245 0, H.245 1, H.323
• NAT support: SNAT, DNAT, PAT, Full Cone NAT, STUN
• Global policy management view
• Policy objects: predefined, custom, and object grouping

QoS Traffic Shaping

• Tunnel allocation based on security domain, interface, address, user/user group, service/service group, application/application group, TOS, VLAN
• Supports embedded two layers and eight tunnels
• Supports maximum bandwidth cap and minimum bandwidth guarantee on multi-level tunnels or on a per IP/user basis
• Supports differentiated services according to priority and bandwidth average allocation policy
• Flexible allocation of remaining bandwidth according to priority
• Actively restrain inbound traffic from server side

Link Load Balancing

• Outbound functions：Policy based routing (PBR) supports ECMP, time and weighted, supports embedded ISP routing and dynamic detection
• Inbound functions: SmartDNS (supports A-record resolution of DNS) and dynamic detection
• Automatically switches the link according to bandwidth occupancy and network latency
• Link health inspection by ARP, PING and DNS

Server Load Balancing

• Supports server health diagnostic, server session protection and session persistence
• Supports multiple SLB algorithm, including weighted hashing, weighted least-connection and weighted round-robin
• Supports server session status monitoring

VPN

• Supports various standard IPSec VPN protocols and deployment modes
• Supports SSL VPN (USB-key option)
• Supports IKEv2 protocol
• Supports Xauth protocol
• Supports OCSP and SCEP
• Supports clients that run iOS, Android, and Windows XP/Vista including 64-bit Windows OS

User and Device Identity Control

• Local user database
• Remote user authentication: LDAP, Radius, Active Directory
• Single-sign-on: Windows Active Directory
• User-based policies

IPS

• 7,000+ signatures, protocol anomaly detection, custom signatures, manual, automatic signature updates, integrated threat encyclopedia
• IPS Actions: default, monitor, block, reset (attackers IP or victim IP, incoming interface) with expiry time
• Packet logging option
• Filter Based Selection: severity, target, OS, application or protocol
• IP exemption from specific IPS signatures
• IDS sniffer mode
• IPv4 rate-based DOS protection with threshold settings against TCP Syn flood, TCP/UDP/SCTP port scan, ICMP sweep, TCP/UDP/SCIP/ICMP session flooding (source/destination)
• Predefined prevention configuration

Anti-Virus

• Flow-based virus filter with low latency
• Support the scanning of big virus files
• Real-time blocking of virus connection,record virus event
• Support HTTP,FTP and SMTP scanning
• Over 1.3 million AV signatures , supports update signatures from local or internet

URL Filter

• Flow-based web filtering inspection
• Manually defined web filtering based on URL, web content and MIME header
• Dynamic web filtering with cloud-based real-time categorization database: over 140 million URLs with 64 categories (8 of which are security related)
• Additional web filtering features:
  • Filter Java Applet, ActiveX or cookie
  • Block HTTP Post - Log search keywords
  • Exempt scanning encrypted connections on certain categories for privacy
• Web filtering profile override: allows administrator to temporarily assign different profiles to user/group/IP
• Web filter local categories and category rating override

Application Control

• Over 3,000 applications that can be filtered by name, category, subcategory, technology and risk
• Each application contains a description, risk factors, dependencies, typical ports used, and URLs for additional reference
• Actions: block, reset session, monitor, traffic shaping

High Availability

• Redundant heartbeat interfaces
• High availability mode: Active/Passive
• Standalone session synchronization
• Failover:
  • Port, local & remote link monitoring
  • Stateful failover
  • Sub-second failover
  • Failure detection notification
• Deployment Options:
  • HA with link aggregation
  • Full mesh HA

Administration

• Management access: HTTP/HTTPS, SSH, telnet
• Central Management: Hillstone Security Manager (HSM), web service APIs
• System Integration: SNMP, syslog, alliance partnerships
• Rapid deployment: local and remote script execution
• Dynamic real-time dashboard status and drill-in monitoring, widgets
• Language support: English

Logs and Reporting

• Logging facilities: local storage, and third-party multiple syslog servers
• Detailed traffic logs: forwarded, violated sessions, local traffic, invalid packets
• Comprehensive event logs: system and administrative activity audits, routing and networking, VPN, user authentications

Hypervisors Supported

• KVM, VMware ESXi, Xen, AMI (AWS)