Hillstone SGSV-X7180-IN-12U: Data Center Firewall, modulární chassis, propustnost až 360 Gbps, AC napájení

Specifikace:

• FW Throughput: 360Gbps
• IPS Througput: 90Gbps
• Management Ports: 1x Console Port, 1x AUS Port, 2x USB 2.0 Port
• Fixed I/O Ports: 4x GE Combo slot (1x MGT + 3x HA)
• Maximum concurrent Sessions: 120 million
• New Session/s: 2.4 million per second
• Available Slots for Extensible Modules: 10x Generic Slots, 2x System Control Module Slot, 1x SD Card Slot
• Modules: SCM-100, SSM-100, QSM-100, IOM-16SFP-100, IOM-4XFP-100, IOM-2MM-BE, IOM-2SM-BE, IOM-2Q8SFP+, IOM-8SFP+
• Maximum Power Consumption: 2+2 redundant power supply, max. 1300W
• Power Supply: AC 100-240V 50/60Hz
• Dimension: 440x590x225mm
• Weight: 53kg
• Temperature: 0-40°C
• Relative Himidity: 10-95%

Popis:

Data Center Firewally Hillstone řady X poskytují špičkovou ochranu datových center v reálném čase pro aplikace a proti síťovým útokům. Poskytují ochranu proti virům, spywarům, červům, botnetům, ARP spoofingu, DoS / DDoS útokům, trojským koním atp. Nabízí vynikající výkon, spolehlivost a škálovatelnost (modulární řešení).

Modelová řada X poskytuje následující klíčové vlastnosti:

-           Hillstone Elastic Firewall Architecture – možnost vytvořit až 1000 virtuálních firewallů v jednom HW firewallu

-          High Availability – zajištění vysoké dostupnosti služeb v řežimu Active/Pasive a Active/Active

-          Podpora funkcí NAT, IPv6, routing a FlexQoS

-          Nízká spotřeba elektrické energie

-          Vysoká propustnost až 360 Gb/s

-          Vysoká úroveň zabezpečení

U řady X lze volitelně přikoupit:

-          Balíček IPS, Antivir, QoS a URL filtering

-          VSYS licence (Virtual System License) – možnost rozdělení HW firewallu do více virtuálních firewallů

-          SSL VPN licence

-          Rozšiřující HW moduly

-          Rozšíření HW záruky a SLA služby

-          Centrální management HSM

-          Centrální dohled HSA (ukládání syslogů)

VIDEO:

Vlastnosti:

Network Services

• Dynamic routing (OSPF, BGP, RIPv2)
• Static and Policy routing
• Route controlled by application
• Built-in DHCP, NTP, DNS Server and DNS proxy
• Tap mode – connect to SPAN port
• IPv6 Support: Mgt. over IPv6, IPv6 routing protocols, IPv6 tunneling, IPv6 logging and HA
• Interface modes: sniffer, port aggregated, loopback, VLANS (802.1Q and Trunking)
• L2/L3 switching & routing
• Virtual wire (Layer 1) transparent inline deployment

Firewall

• Operating modes: NAT/route, transparent (bridge), and mixed ode
• Policy objects: predefined, custom, and object grouping
• Application Level Gateways and session support: MSRCP, PPTP, RAS, RSH, SIP, FTP, TFTP, HTTP, dcerpc, dns-tcp, dns-udp, H.245 0, H.245 1, H.323
• NAT support: NAT46, NAT64, NAT444, SNAT, DNAT, PAT, Full Cone NAT, STUN
• NAT configuration: per policy and central NAT table
• VoIP: SIP/H.323/SCCP NAT traversal, RTP pin holing
• Global policy management view • Schedules: one-time and recurring
• QoS Traffic Shaping:
  • Max/guaranteed bandwidth tunnels or IP/user basis
  • Tunnel allocation based on security domain, interface, address, user/user group, server/server group, application/app group, TOS, VLAN
  • Bandwidth allocated by time, priority, or equal bandwidth sharing
  • Type of Service (TOS) and Differentiated Services (DiffServ) support
  • Prioritized allocation of remaining bandwidth
  • Maximum concurrent connections per IP
• Virtual Firewall: Up to 1000 vSYS load balanced firewalls
• Load balancing:
  • Weighted hashing, weighted least-connection, and weighted round-robin
  • Session protection, session persistence and session status monitoring
  • Bidirectional link load balancing
  • Outbound link load balancing includes policy based routing, ECMP and weighted, embedded ISP routing and dynamic detection
  • Inbound link load balancing supports SmartDNS and dynamic detection
  • Automatic link switching based on bandwidth and latency
  • Link health inspection with ARP, PING, and DNS
• Access control based on IP address geolocation
• Repetitive and redundant firewall rule inspection

VPN

• IPSec VPN:
  •  IPSEC Phase 1 mode: aggressive and main ID protection mode
  • Peer acceptance options: any ID, specific ID, ID in dialup user group
  • Supports IKEv1 and IKEv2 (RFC 4306)
  • Authentication method: certificate and pre-shared key
  • IKE mode configuration support (as server or client)
  • DHCP over IPSEC
  • Configurable IKE encryption key expiry, NAT traversal keep alive frequency
  • Phase 1/Phase 2 Proposal encryption: DES, 3DES, AES128, AES192, AES256
  • Phase 1/Phase 2 Proposal authentication: MD5, SHA1, SHA256, SHA384, SHA512
  • Phase 1/Phase 2 Diffie-Hellman support: 1,2,5
  • XAuth as server mode and for dialup users
  • Dead peer detection
  • Replay detection
  • Autokey keep-alive for Phase 2 SA
• IPSEC VPN realm support: allows multiple custom SSL VPN logins associated with user groups (URL paths, design)
• IPSEC VPN configuration options: route-based or policy based
• IPSEC VPN deployment modes: gateway-to-gateway, full mesh, hub-and-spoke, redundant tunnel, VPN termination in transparent mode
• One time login prevents concurrent logins with the same username
• SSL portal concurrent users limiting
• SSL VPN port forwarding module encrypts client data and sends the data to the application server
• Supports clients that run iOS, Android, and Windows XP/Vista including 64-bit Windows OS
• Host integrity checking and OS checking prior to SSL tunnel connections
• MAC host check per portal
• Cache cleaning option prior to ending SSL VPN session
• View and manage IPSEC and SSL VPN connections

User and Device Identity

• Local user database
• Remote user authentication: TACACS+, LDAP, Radius, Active Directory
• Single-sign-on: Windows AD
• 2-factor authentication: 3rd party support, integrated token server with physical and SMS
• User and device-based policies

IPS

• 7,000+ signatures, protocol anomaly detection, rate-based detection, custom signatures, manual, automatic push or pull signature updates, integrated threat encyclopedia
• IPS Actions: default, monitor, block, reset (attackers IP or victim IP, incoming interface) with expiry time
• Packet logging option
• Filter Based Selection: severity, target, OS, application or protocol
• IP exemption from specific IPS signatures
• IDS sniffer mode
• IPv4 and IPv6 rate based DoS protection with threshold settings against TCP Syn flood, TCP/UDP/SCTP port scan, ICMP sweep, TCP/UDP/SCIP/ICMP session flooding (source/destination)
• Active bypass with bypass interfaces
• Predefined prevention configuration

Threat Protection

• Botnet server IP blocking with global IP reputation database
• Flow-based web filtering inspection
• Manually defined web filtering based on URL, web content and MIME header
• Dynamic web filtering with cloud-based realtime categorization database: over 140 million URLs with 64 categories (8 of which are security related)
• Additional web filtering features:
  • Filter Java Applet, ActiveX or cookie
  • Block HTTP Post
  • Log search keywords
  • Exempt scanning encrypted connections on certain categories for privacy
• Web filtering profile override: allows administrator to temporarily assign different profiles to user/group/IP
• Web filter local categories and category rating override

Application Control

• Over 3,000 applications that can be filtered by name, category, subcategory, technology and risk
• Each application contains a description, risk factors, dependencies, typical ports used, and URLs for additional reference
• Actions: block, reset session, monitor, traffic shaping
• Identify and control applications in the cloud
• Provide multi-dimensional monitoring and statistics for applications running in the cloud, including risk category and characteristics

High Availability

• Redundant heartbeat interfaces
• Active/Active and Active/Passive
• Standalone session synchronization
• HA reserved management interface
• Failover:
  • Port, local & remote link monitoring
  • Stateful failover
  • Sub-second failover
  • Failure notification
• Deployment Options:
  • HA with link aggregation
  • Full mesh HA
  • Geographically dispersed HA

Administration

• Management access: HTTP/HTTPS, SSH, telnet, console
• Central Management: Hillstone Security Manager (HSM), web service APIs
• System Integration: SNMP, syslog, alliance partnerships
• Rapid deployment: USB auto-install, local and remote script execution
• Dynamic real-time dashboard status and drill-in monitoring widgets
• Language support: English

Logs & Reporting

• Logging facilities: local memory and storage (if available), multiple syslog servers and multiple Hillstone Security Audit (HSA) platforms
• Encrypted logging and log integrity with HSA scheduled batch log uploading
• Reliable logging using TCP option (RFC 3195)
• Detailed traffic logs: forwarded, violated sessions, local traffic, invalid packets
• Comprehensive event logs: system and administrative activity audits, routing & networking, VPN, user authentications
• IP and service port name resolution option
• Brief traffic log format option