Symantec Network Security 7100 Series

Transcription

1 Symantec Network Security 7100 Series Proactive intrusion prevention device protects against known and unknown attacks to secure critical networks transition can be accomplished transparent to any network topology and can be tuned to the Ethernet network the appliance is protecting. *Available only with Symantec Network Security 7160 and 7161 models The need for defense in depth Security personnel are tasked with ensuring the availability of critical data in an organization. Organizations may have skilled professionals on staff, but these employees are often overwhelmed by the daily tasks of incident analysis, incident response, applying or testing patches, and attempting to prevent the next intrusion. At the same time, they are also facing increasing threats and regulatory pressure to establish solid security practices and controls. Organizations need to not only maintain and leverage existing investments, but must also proactively employ constant monitoring, intelligence, and analysis. The Symantec Network Security 7100 Series provides a network security solution with simplified deployment, centralized management, and comprehensive support. Proactive intrusion prevention Symantec Network Security 7100 Series appliances provide real-time, proactive network intrusion prevention to protect enterprise networks and mitigate business disruption caused by known and unknown (or zero-day) attacks and worms. One-Click to Prevention - Transitions from a detection device to a prevention tool with a single mouse click. The Inline deployment option - Ensures threats are accurately blocked or alerted on based upon the organization s security policies and business needs. An inline fail-open network redundancy option guarantees uninterrupted network operation. High-availability/fail-over (passive mode) Enables uninterrupted network monitoring through high-availability deployments, in which a backup Symantec Network Security appliance protects in the case of a primary appliance outage. Support for asymmetric routing environments - Interface Grouping enables detection of attacks for networks with asymmetric routing. Ease of appliance maintenance - Allows a choice of configuration options depending upon organization need and deployment scenario. The Compact Flash reader/writer allows for flexible and easy configuration, and restore/backup of the configuration. Key Points Augments existing gateway and server security deployments to stop threats from propagating throughout networks Combines multiple detection technologies, including protocol anomaly detection and vulnerability attack Page 1 of 7

2 interception, in the IMUNE architecture to accurately identify and block both known and unknown attacks and worms Helps organizations establish, measure, and report on organizational best practice and compliance initiatives Integrated expertise from Symantec Security Response and Services provides early knowledge of threats to enable proactive security Requires no network reconfiguration for ease of deployment Appliances can support up to eight interfaces*, allowing organizations to monitor more network segments Three models support aggregate network bandwidth from 50Mbps to 2Gbps to meet deployment needs at branch offices, distribution sites, and the network core AutoProtect automatically by updating protection policies using LiveUpdate technology to help organizations stay ahead of continuously evolving threats One-Click to Prevention transitions the appliance from a detection device to a prevention tool with a single mouse click Network threat mitigation architecture The Symantec Network Security 7100 Series appliance employs an innovative Intrusion Mitigation Unified Network Engine (IMUNE). IMUNE system - Includes a range of detection technologies to detect both known and unknown threats, including worms, scans, probes, DoS attacks, backdoors, buffer overflow attacks, and fragmentation attacks. Protocol anomaly detection - detects attacks without knowledge of a known or disclosed vulnerability. Vulnerability attack interception - protection for known and unknown (or zero-day) worms and exploits against announced vulnerabilities. Traffic flow detection (Flow rules) - network behavioral and use policy violation detection used to determine violations of corporate network use policy. Instant messaging and peer-2-peer traffic - detects the presence of Instant Messaging and P2P traffic. IPV6 tunneled traffic identification - detects Ipv6 traffic that is being tunneled through networks, indicating possible policy violations or intrusions. Enhanced signature language detects attacks and threats more accurately and efficiently. Flexible enterprise deployment The 7100 Series offers three models for flexible intrusion prevention deployment options to best suit organizations deployment needs, whether network security is required at branch offices, distributed sites, or on the network. Highly scalable - Supports aggregate network bandwidth from 50Mbps to 2Gbps across as many as eight network segments. Interface choices - Organizations have a choice of copper or fiber interfaces for core network deployments. Deployment options Include support for multiple inline pairs or monitoring both passive and inline segments on the same appliance. Page 2 of 7

3 Extend intrusion prevention To reach the perimeter gateway by sending gating policies to Symantec Enterprise Firewall and the Symantec Gateway Security 5400 Appliance. Intelligent security content and updates Integrated expertise from Symantec Security Response and Symantec DeepSight Early Warning services and easy-to-understand security guidelines enable even faster response to security incidents. LiveUpdate of security content - LiveUpdate automatically updates protection policies to help organizations stay ahead of continuously evolving threats. Security updates from Symantec Security Response - As the threat landscape changes, organizations can be assured they are protected by the 24x7x365 coverage of Symantec Security Response. Comprehensive management Comprehensive management helps organizations establish, measure, and report on organizational best practices. Powerful and granular policy management - Allows security personnel to tailor protection based on their security policies and business need and set common or individualized detection and prevention policies per appliance. Control logging, blocking and auto-response behavior - To either ignore, alert and auto-respond to a network security event in passive monitoring mode, or block a network security event in inline prevention mode. Out-of-the-box protection - Policies based on threat category, severity, intent, reliability and profile of protected resources can be tuned to suit the profile of the network or pre-defined policies that coordinate with the organization s network security profile. Auto-update security policies during a new threat outbreak - Automatically blocks new and emerging threats without human intervention. Symantec Network Security Management Console - Provides centralized management via secure communications between the appliance and the management console which scales to support large, distributed enterprise deployments. Granular role-based access - Scalable administration to define administrative users and grant them varying levels of access. Enterprise reporting - Allows multi-level reports from executive summaries to detailed event drill-down, enabling security personnel to measure and report the overall effectiveness of their network infrastructure security. Real-time threat analysis The Symantec Network Security 7100 Series appliance gathers threat intelligence from multiple sensors across the enterprise to quickly and automatically spot trends and identify related events as they occur. Customizable event correlation views - Helps administrators work more efficiently by dramatically reducing the effort required by security personnel to Page 3 of 7

4 identify threats, giving them time for more sophisticated intrusion investigation and remediation. Packet and Session capture and playback feature - To analyze correlated events in-depth. Multi-product intrusion management The Symantec Network Security Smart Agents provide enterprise-wide, multi-source intrusion management by collecting, aggregating and responding to events from multiple Symantec and third-party host and network security products. Rapid identification of threats from multiple event sources across the enterprise allows organizations to mitigate potential damage to mission-critical assets. System requirements Symantec Network Security 7100 Series Symantec Network Security 7100 Series appliances are integrated, self-contained security devices, and as such do not have software and hardware system requirements. Symantec Network Security Management Console 4.0 Processor Intel Pentium or compatible 1.6GHz or higher Operating System Microsoft Windows 2000 or XP, Red Hat Enterprise Linux 3.0 ES Memory Minimum 256 MB (512 MB recommended) Disk Space 50 MB for installation, 100 MB post installation Screen Resolution 1024 x 768 or higher Java Sun Java 2 Runtime Environment (J2RE) version Page 4 of 7

5 COMPARISON MODEL OF THE APPLIANCES Specifications Performance Aggregate IDS throughput Up to 200 Mbps Up to 2 Gbps Up to 2 Gbps Aggregate Inline throughput Up to 100 Mbps Up to 1 Gbps Up to 1 Gbps Maximum concurrent sessions 100,000 1,000,000 1,000,000 Connections per second 1,500 12,500 12,500 Scalability Network interfaces 4 10/100 Copper 8 10/100/1000 Copper 4 10/100/1000 Copper Base-SX Fiber Inline segments Management interface 1 10/100 Copper 1 10/100/1000 Copper 1 10/100/1000 Copper TCP reset interfaces 1 10/100 Copper 3 10/100/1000 Copper 3 10/100/1000 Copper (for passive monitoring only) Interface grouping Yes Yes Yes (for passive monitoring only) (up to 4 interfaces) (up to 4 interfaces) (up to 4 interfaces) High Availability Power supply Single Dual-redundant Dual-redundant Device failure detection Yes Yes Yes Link loss detection Yes Yes Yes Disk drive Fixed Removable Removable Passive mode failover Yes Yes Yes Inline bypass (fail-open) Yes 1 Yes 1 2 MANAGEMENT Compact flash configuration Yes Yes Yes Centralized management (console) Yes Yes Yes Live Update enabled Yes Yes Yes One click to prevention Yes Yes Yes PHYSICAL AND OPERATIONAL Form factor 1u rack-mountable 2u rack-mountable 2u rack-mountable (fits 19-inch rack) (fits 19-inch rack) (fits 19-inch rack) Height 5.08 cm (2 in) 8.89 cm (3.5 in) 8.89 cm (3.5 in) Width cm (17 in) cm (17 in) cm (17 in) Depth cm (17 in) 61 cm (24.0 in) 61 cm (24.0 in) Weight 8.62 kg (19 lb) kg (36 lb) kg (36 lb) Power Volts, 50/60Hz Volts, 50/60Hz Volts, 50/60Hz 430 W Max, 190 W Draw 800 W Max, 240 W Draw 800 W Max, 240 W Draw Operating environment 5º C to 35º C (41º F to 95º F) 5º C to 40º C (41º F to 104º F) 5º C to 40º C (41º F to 104º F) 5% to 95% relative 5% to 95% relative 5% to 95% relative humidity, non-condensing humidity, non-condensing humidity, non-condensing Non-operating environment -10ºC to 70ºC (14ºF to 158ºF) -20ºC to 60ºC (-4ºF to 140ºF) -20ºC to 60ºC (-4ºF to 140ºF) 5% to 95% relative 5% to 95% relative 5% to 95% relative humidity, non-condensing humidity, non-condensing humidity, non-condensing Page 5 of 7

6 Specifications Operating altitude Up to 3000M (10,000 ft) Up to 3000M (10,000 ft) Up to 3000M (10,000 ft) Safety UL and CSA - UL UL and CSA - UL UL and CSA - UL VCCI, CE / FCC part 15B, Class A VCCI, CE / FCC part 15B, Class A VCCI, CE / FCC part 15B, Class A EN60950 (2000) EN60950 (2000) EN60950 (2000) EN (1994+A11) EN (1994+A11) EN (1994+A11) Emissions EMC Directive 89/336/EEC EMC Directive 89/336/EEC EMC Directive 89/336/EEC Low Voltage Directive Low Voltage Directive Low Voltage Directive 73/23/EEC, both as 73/23/EEC, both as 73/23/EEC, both as amended by 93/68/EEC amended by 93/68/EEC amended by 93/68/EEC 1 Separate external bypass unit available 2 External Fiber bypass unit available in calendar year 2005 Page 6 of 7

7 More information Visit our Web site To speak with a Product Specialist in the US Call toll-free To speak with a Product Specialist outside the US Symantec has operations in 35 countries. For specific country offices and contact numbers, visit our Web site. About Symantec Symantec is the global leader in information security providing a broad range of software, appliances and services designed to help individuals, small and mid-sized businesses, and large enterprises secure and manage their IT infrastructure. Symantec s Norton brand of products is the worldwide leader in consumer security and problemsolving solutions. Headquartered in Cupertino, Calif., Symantec has operations in more than 35 countries. More information is available at Symantec World Headquarters Stevens Creek Blvd. Cupertino, CA USA Symantec and the Symantec logo are U.S. registered trademarks of Symantec Corporation. Other brands and products are trademarks of their respective holder/s. Copyright 2005 Symantec Corporation. All rights reserved. Printed in the U.S.A. All product information is subject to change without notice. 01/ Page 7 of 7