Secospace USG5000 Series Unified Security Gateway

Transcription

1 Product Overview With the deterioration of network security, users are suffering from more and more deep-rooted application- and service-based problems, such as malicious intrusion, phishing Web sites, Trojan horses, and P2P traffic flooding, which impairs network efficiency and brings serious threats. Under this background, Huawei Symantec has been dedicated to providing integrated security solutions for users. With in-depth understanding and analysis of various protocols, Huawei Symantec's industry-leading protocol analysis team together with the comprehensive protocol knowledge base provides strong technical support for users to deal with various security threats. The USG5000 series (the USG5000 for short), a new-generation unified security gateway launched by Huawei Symantec, delivers various advantageous security functions, such as firewall, VPN, Intrusion Prevention System (IPS), Anti-Virus (AV), and URL filtering functions, providing all-round network protection and ensuring network efficiency. USG5100 USG5300 Product Description With the advantageous embedded multi-core architecture and accumulated R&D and design experience in communications and network fields, the USG5000 meets various stringent international authentication standards and provides high reliability. Employing Symantec advanced IPS and AV technologies and rich signature database, the USG5000 achieves the detection rate of over 99% and accomplishes remarkable security defense capability with zero configuration. The USG5100 series, namely, the USG5120 and USG5150, are both modular devices. With the standard configuration, the 2U USG5120 provides 2GE+2GE combo and 2 USB interfaces as well as 4 MIC, 2 FIC, and 2 DFIC expansion slots. With the standard configuration, the 3U USG5150 offers 4GE combo and 2 USG interfaces as well as 4 MIC, 2 FIC, and 4 DFIC expansion slots. The USG5300 series consists of the USG5310, USG5320, USG5330, USG5350, and USG5360, all of which are 1U standard modular devices with high interface density. The USG5300 provides four pairs of optical/ electrical (mutually exclusive) GE interfaces (10M/100M/1000M adaptive for electrical interfaces), and two USB2.0 interfaces. Its chassis has two expansion slots for 4 x FE (RJ45), 2 x GE (combo), and 4 x GE (RJ45) interface modules. The integrated device offers up to 12 GE interfaces. The USG5300 supports AC and DC power supply modules, realizing dual power supply and redundancy backup through 1+1 backup. The USG5000 delivers perfect firewall, attack defense, VPN, infinitely extended NAT, IM control, and P2P traffic limiting functions based on the hardware excellent in performance, reliability, and interface density, and software featuring maturity, stability, and modularization. Certain advanced functions (such as IPS, AV, and URL filtering) are also available only if related licenses are purchased. Superior Product Features Advanced technology enabling robust security The USG5000 achieves the detection rate of over 99% based on Symantec's outstanding IPS and AV technologies and multiple antiescaping technologies, as well as integrating 21 decompression

2 algorithms1, 50 major container file types2, persistently updated signature database, and particular engine technologies, such as the virtual engine, script parse engine, and PDF scanning engine, thereby guaranteeing security. Simple deployment achieving outstanding ease-to-use The user-friendly GUI enables device management and configuration by mouse clicks and few keyboard inputs, releasing users from command learning. Meanwhile, the IPS function also supports zero policy configuration, realizing fast development and ease-to-use as well as zero false negative by eliminating commissioning operations. Accurate identification and real-time control ensuring high efficiency The URL filtering function effectively filters malicious and irrelevant Web sites based on the massive URL category database with persistently updated URLs, 7 language support, 40,000,000 domain names monitoring, and over 90% identification accuracy. The P2P traffic limiting function also delivers best-in-class identification rate by accurately identifying over 50 major P2P protocols and timely updating new ones. Based on accurate identification and real-time control, the USG5000 ensures effective bandwidth usage for users' networks through flexible policy configuration. Powerful anti-ddos safeguarding network borders and businesses Owing to the outstanding new connections per second, the anti- DDoS function processes millions of packets per second. Moreover, the powerful protocol analysis capability realizes accurate identification over worm traffic and various attacks, and effective defense against them, including SN flood, UDP flood, ICMP flood, DNS flood, ARP flood, and HTTP flood. Based on these features as well as Huawei Symantec-proprietary Intelligent Connection Algorithm (ICA), the USG5000 effectively safeguards network borders and service systems even on complicated networks, without affecting normal services. Dedicated security capability center keeping sustaining investment appreciation Huawei Symantec attack defense labs, honeynets, and honeypots deployed worldwide inspect over 13,000G network traffic, monitor 40,000,000 domain names, obtain latest security threat and attack information, and extract related signatures, to facilitate product updates, maintain high reliability, and achieve lasting value increase for customers' investments. Business-related Sites emule edonkey P2P Hacking Unauthorized use Hacker Main function features Firewall IPS Anti-Virus URL Filtering P2P Management IM Management Anti-DDos Office Network Botnet USG5000 SN Flood/UDP Flood ICMP Flood/DNS Flood SMURF/CC/Land/ Fraggle/WinNuke Unsafe website News, Game, Stock, Porn, Trojan, Fishing IM QQ MSN Office Network Service System 1

3 Product Specifications Expansion and Interface Interface for standard configuration Expansion slot Interface module Basic Firewall Feature Working mode Virtual firewall Security zone division Packet filtering Blacklist and whitelist ASPF Application protocol identification IM control P2P traffic limiting GTP Anti-DDoS SN flood UDP flood ICMP flood HTTP flood TCP full connection ARP flood ARP spoofing IP spoofing Land Smurf Fraggle WinNuke Ping of Death Tear Drop Address scanning Port scanning IP option IP fragmented packet TCP label validity check Large ICMP packet ICMP redirect packet ICMP unreachable packet Tracert packet NAT No-PAT PAT Address pool-based NAT Policy-based destination IP address translation 4 GE combo 10 (maximum) FE, GE, ADSL, G.G.SHDSL, 3G, WiFi Transparent, routing, composite (such as the traffic of BT, PPStream, KuGoo, UUSee, PPLive, QQDownload, Thunder, and emule) 2

4 Secospace USG5000 USG2000 Series Bidirectional NAT Intrazone NAT NAT ALG NAT Server Extended NAT (infinite addresses) IPSec VPN Number of concurrent tunnels 4,000 15,000 Hardware encryption IKE v1, v2 Perfect Forward Secrecy (DH group) 1, 2, 5 Security protocol AH, ESP, ESP_NULL, AH+ESP Encryption algorithm DES, 3DES, AES Authentication algorithm MD5, SHA1 SA establishment mode Manual mode, IKE negotiation SA update Scheduled update, traffic-based update Dynamic IPSec policy Fragment reassembly Data flow classification Anti-replay IPSec NAT traversal SSL VPN 3 Hardware encryption SSL version TLS1.0, TLS1.0+SSL3.0, TLS1.0+SSL3.0+SSL2.0 Security protocol AH, ESP, ESP_NULL, AH+ESP Encryption algorithm DES, 3DES, AES Authentication algorithm MD5, SHA1 Authentication protocol VPNDB, RADIUS, LDAP MPSL VPN 4 Forwarding table Layer-3 VPN GRE tunnel LDP MPLS Ping MPLS Traceroute LSP LSR Cross-zone VPN IPv6 5 OSPFv3 BGP4+ IPv6 ISIS IPv6 policy-based routing GRE for BPG/OSPFv3/ISIS IPv6 ACL standard IPv6 ACL extended IPv6 interface statistics NAT-PT (4 to 6, 6 to 4) 3

5 IPv6 ND/SEND AV Identifiable virus types 7,000,000 (persistently updated) File-based AV Unpacking Script parse AV for resumable download PDF scanning engine Virtual execution technology All-protocol resolution Heuristic AV Complicated-string scanning engine Scanned-file type setting AV for compressed files (21 decompression algorithms) AV for Web pages AV for mails VPN scanning Anti-Trojan horse and worm Anti-spyware Anti-greyware Anti-malware Overload protection Update frequency of virus database Daily update, emergency update IPS Detectable attack types 8,000+ (persistently updated) Vulnerability-based signature database User-defined signature Zero configuration Zero-day attack defense PDF attack defense Behavior correlation and analysis Traffic anomaly detection Protocol anomaly detection Protocol status signature Across-packet attack detection Unauthorized download blocking Web 2.0-based attack defense Anti-escaping technology IP fragment reassembly, TCP flow reassembly, URL decoding Overload protection Update frequency Weekly update, emergency update URL Filtering Multi-language 7 languages (Chinese, English, French, Russian, Spanish, Portuguese, and Arabic) URL categories 120+ Number of monitorable domain names 40,000,000+ User-defined URL categories URL blacklist and whitelist Remission IP list 4

6 Routing Static routing Policy-based routing Route iteration Static multicast RIP v2 200,000 RIP v1/v2 instance 100 OSPF 300,000 OSPF instance 100 BGP 16,000 BGP instance 1,000 BGP peer 100 Logging/Monitoring Log server elog Log format Syslog, binary log Device status log Session log Blacklist log Traffic statistics and monitoring log User operation log Login/Logout, CLI configuration NAT log ASPF log Attack defense log P2P traffic monitoring log IPS detection log AV scanning log URL filtering log Management Web UI HTTP/HTTPS CLI Local, Telnet, SSH Management protocol SNMP, TR069 NMS U2000, VSM High Availability HA Master/Slave, master/master Dual power supply 1+1 backup Key-component hot swap Power supply Configuration synchronization Session status synchronization Operating Environment Ambient temperature 0 to 40 Ambient humidity 5% to 95%, non condensing Authentication Security authentication EMC authentication CB authentication RoHS FCC 5

7 MET C-Tick VCCI Subscription Information Part Number Part Description USG5100 Host USG5120-AC USG5120 Host, with HS General Security Platform Software (AC, DC) USG5150 USG5150 Host, with HS General Security Platform Software (AC, DC) Interface Expansion Module of the USG5100 MIC MIC-1E1 1-PORT E1 Interface Board(DB15), 3*1, with HS General Security Platform Software MIC-1CE1 1-PORT CE1 Interface Board(DB15), 3*1, with HS General Security Platform Software MIC-3G 3G Service Board, 3*1, with HS General Security Platform Software (WCDMA) MIC-G.shdsl G.shdsl Interface Board, 3*1, with HS General Security Platform Software (1/2/4 Channel) MIC-1FE 1-Port Fast Ethernet Electrical Interface Board(RJ45), 3*1, with HS General Security Platform Software MIC-5FE 5-Port Fast Ethernet Switch Electrical Interface Board(RJ45), 3*1, with HS General Security Platform Software MIC-1SA 1-Channel Sync/Async Serial Port Interface Card, 3*1, with HS General Security Platform Software MIC-ADSL2+ ADSL2+, 3*1, with HS General Security Platform Software ADSL2 (single-pvc, Multi-PVCs) MIC-WiFi WLAN Service Board, with HS General Security Platform Software DMIC-8FE2GE 8FE(RJ45)+2GE(RJ45) Mixed Interface Card, with HS General Security Platform Software FIC FIC-E1 CE1 Interface Card, with HS General Security Platform Software (2-port/4-port/8-port) FIC-CE1 E1 Interface Card, with HS General Security Platform Software (2-port/4-port/8-port) FIC-2FE2FEC 2FE(RJ45&SFP) MIXED INTERFACE CARD, 1*1, with HS General Security Platform Software FIC-1GE-RJ45 GE Electrical Interface Card(RJ45), with HS General Security Platform Software (1-port, 4-port) FIC-FXS FXS (32-port and 16-port) FIC-GPON DFIC DFIC-16GE4SFP 16GE(RJ45)+4GE(SFP) Mixed Interface Card, with HS General Security Platform Software DFIC-18FE2SFP 18FE(RJ45)+2GE(SFP) Mixed Interface Card, with HS General Security Platform Software DFIC-ESP Enhanced Services Platform Enterprise Version, X86 Board, (Common Version, Enterprise Version) USB Expansion Card USB-3G USB 3G (WCDMA) Firewall License of the USG5100 LIC-VFW Quantity of Virtual Firwall (5/10/25/50/100 Vsys) LIC-SSL SSL VPN 10/20/50/100/150/200 Concurrent Users, with HS General Security Platform Software UTM License of the USG5100 LIC-IPS USG5100, IPS Update Service Subscribe 12/36 Months LIC-AV USG5100, Anti-Virus Update Service Subscribe 12/36 Months LIC-AS USG5100, Anti-spam Update Service Subscribe 12/36 Months LIC-URL USG5100, URL Filter Update Service Subscribe 12/36 Months 6

8 Part Number Part Description USG5300 Host USG5310 USG5310 UTM Host (AC, DC) USG5320 USG5320 UTM Host (AC, DC) USG5330 USG5330 UTM Host (AC, DC) USG5350 USG5350 UTM Host (AC, DC) USG5360 USG5360 UTM Host (AC, DC) Interface Expansion Module of the USG5300 4FE 4 port Fast Ethernet Electrical Interface Module(RJ45) 2GE 2 port Gigabit Ethernet Interface Module(RJ45&SFP) 4GE 4 port Gigabit Ethernet Interface Module(RJ45) License of the USG5300 LIC-GTP GTP LIC-VFW Quantity of Virtual Firwall(5/10/25/50/100 Vsys) LIC-IPSEC IPSEC VPN Tunnels (10/100/500/1000/5000/10000), with HS General Security Platform Software UTM License of the USG5300 LIC-IPS USG5100, IPS Update Service Subscribe 12/24/36 Months LIC-AV USG5100, Anti-Virus Update Service Subscribe 12/24/36 Months LIC-URL USG5100, URL Filter Update Service Subscribe 12/24/36 Months Note: decompression algorithms: BZIP2, ZIP, CAB, OLESS, GZIP, LHA, RAR, ARJ, TNEF, LZ, AMG, PDF, TAR, RTF, AS, OLE1, MB3, HQX, MIME, UUE, and MBOX 2. Major 50 types of container files:.doc,.dot,.ppt,.pps,.xla,.xls,.xlt,.wiz,.sdw,.vor,.vss,.vst,.ac_,.adp,.apr,.db,.msc,.msi,.mtw,.opt,.pub,.sou,.spo,.vsd,.wps,.msg, ZIP,.DOCX,.DOCM,.DOTX,.DOTM,.PPTX,.PPTM,.PPSX,.PPSM,.XLSX,.XLSB,.XLSM,.XLTX,.XLTM,.XLAM,.XPS,.POTX,.POTM,.ODT,.OTT,.STW,.SXW,.eml,.MME,.B64,.MPA, AMG,.ARJ,.CAB,.XSN,.GZ,.LHA,.SHS,.RAR,.RFT,.TAR,.DAT,.ACE..PDF,.TXT,.HQX..MBOZ,.UUE,.MB3,.AS,.BZ2,.ZIP, and.zipx 3. Available on the USG5100 only 4. Available on the USG5100 only 5. Available on the USG5100 only About this publication The information contained in this document is for reference purpose only, do not constitute the warranty of any kind,experss or implied. It is subject to change or withdrawal according to specific customer requirements and conditions. All the trademarks, pictures, and brands mentioned in this document are the property of Huawei Symantec Technologies Co.,Ltd or their respective holders. Copyright 2010 Huawei Symantec Technologies Co., Ltd. All rights reserved. Version No.: M V-1.0