梁永健. W K Leung. 华为企业业务 BG 解决方案销售部 CTO Chief Technology Officer, Solution Sales, Huawei

Transcription

1 梁永健 W K Leung 华为企业业务 BG 解决方案销售部 CTO Chief Technology Officer, Solution Sales, Huawei

2

3 Network Threats ICT 移动化云计算社交化大数据 Mobile Cloud Social Big Data 网络威胁 APT Mobile threats Web threats Worms Trojans Botnet 6X WEB + 威胁激增 + 手段多样 & 隐蔽 Increasing Number Improved Techniques 难以管控 Out of control

4 分支机构 Remote/Branch Office 企业网络 Enterprise Network Office Data Center FW Endpoint Security IPS Endpoint Security FW DMZ FW IPS Internet SSL VPN WAF SOC 云数据中心 Cloud DC Endpoint Security FW Anti-DDoS IPS FW VFW

5 包过滤防火墙基于状态检测基于 ASIC UTM Packet filtering Stateful Firewall ASIC-based IDC 分布式架构 Multi-core NGFW Gartner? PC Intranet Internet Web Mobile Internet NOW 基本访问控制引入会话机制专用芯片提升性能多功能叠加性能提升基于应用 + 用户 + 内容做管控 Access control Session based Hardware-based Multiple features Higher performance App.+User+Content

6 升级 Upgrade 管控能力 Traffic Control 管理优化 Management Optimization 防护范围 Security Scope 处理性能 Performance 定义 Definition APP 基本 FW 功能 Basic FW/VPN 应用感知 Application-aware IPS 一体化 Integrated IPS 大企业环境 For Large Enterprise

7 管控能力 Traffic Control 管理优化 Management Optimization 防护范围 Security Scope 处理性能 Performance

8 应用识别 Applications Identification 业界 No.1 No.1 in Industry

9 Games Huawei ALL P2P 450 GAME Half-life Freenet Games WeChat Voice/ Text LINE Voice/ Text RapidShare Upload/ Download Great Wisdom Browsing/ Exchange CheckPoint ALL P2P GAME App Only App Only App Only App Only Cisco ALL P2P GAME App Only App Only App Only App Only PAN ALL P2P GAME App Only App Only App Only App Only

10 Signatur e Protocol Behavior 分片分段重组 Fragment Reassembly 协议去干扰 Anti-Obfuscation 统计识别 Statistics-based 启发式行为识别 Heuristic Scan PCREX Integrated rules 特征行为 标准协议 Standard APP 特征库升级 加密协议 Encryption APP Signature Update

11

12 管控能力 Traffic Control 管理优化 Management Optimization 防护范围 Security scope 处理性能 Performance

13 基于应用访问策略是否正确实施 39% Verifying that application-based policies are enforced correctly 安全威胁策略如何实施 How to maintain threat prevention policies 如何优化防火墙规则集 How to optimize firewall policies 37% 36% Source: Survey of Osterman Research on 209 enterprises about next generation firewall management

14 IT 管理员 Administrator 网管 NMS? 新环境下难于快速部署 New deployment is difficult. 命令行 CLI Web UI? 不能有效根据真实流量优化 Applied policies never change regardless of traffic changes. 策略 Policy 转发及安全功能 Security Features? 策略臃肿 难以精简 Polices become more redundant and difficult to streamline.

15 Intelligent Knowledge Engine Policy Optimize r Application Database Policy Templates 基于策略模板的快速部署 Fast deployment based on policy templates. Traffic-Apps Database Utilization Analysis Policy Analyzer Quick Deploy 主动流量学习, 智能策略优化 Smart policy optimization. Policy Forwarding and Security Features 策略精简 Policy Simplification 定期策略分析, 给出精简建议 Configuration simplification.

16 管控能力 Control Power 管理优化 Management Optimization 防护范围 Security Scope 处理性能 Performance

17

18 V I S A 业界最多的 DDoS 防护数量 Number of DDoS that could defense 业界最细的 DDoS 检测粒度 逐包检测 采样检测 V-ISA V-ISA DDoS detection mechanism 面向未来的 DDoS 防护技术 AntiDDoS Evolution DPI Detection 支持 IPv4/IPv6 DDoS 防护 Support IPv6 Flow Detection 仅支持 IPv4 DDoS 防护 Only IPv4 V: 支持 Virtual 化定制, 支持虚机保护 I : 基于 IP 信誉机制的僵尸网络防御 S: 基于会话 (Session) 信誉的慢速攻击防御 A: 基于行为信誉的应用 (App.) 攻击防御

19 Sandbox Huawei CheckPoint CISCO Palo Alto FireEye Windows WEB Mobile

20 管控能力 Control Power 管理优化 Management Optimization 防护范围 Security Scope 处理性能 Performance

21 MTDL Hardware Software UNIFIED App/Threat Description Language UNIFIED Security Scan UNIFIED Pattern Match VPN 12G 4G 2.5G 3G UNIFIED DL UNIFIED Scan UNIFIED PM Intrusion Trojan horse Exploit Identification Parsing IPS AV URL Response Handling Non-regular Data Software Regular Hardware Result Full Protection IPS 10G 10G 6G / 15G 未提供 8G 5G Separate Definitions One By One Detection Software Only Approach App 20G 20G 12G / Intrusion IPS Data Trojan horse Exploit Identification Parsing AV URL Response Handling Data Result Result FW 20G 20G 15G 20G UNIFIED

22 2003 业界第一款 NP 架构防火墙 Industry's First NP FW 2010 业界第一款双主控防火墙 Industry's First Dual-MPU Firewall 2008 业界第一款超百 G 防火墙 Industry's First 100G Firewall 2012 业界第一款 T 级防火墙 Industry's First Terabit Firewall

23 2014 性能提升 Higher Performance Tera-Grade NGFW 500G Full Protection Performance Now 大规模商用 GA 13 款设备 (13 Models) 1G-40G FW+APP Performance 20G Full Protection Performance 2014 全面融合 Full Integration NGFW Security Blade S7700/9700/12700 CE12800 USG9500 USG6000

24 Huawei NGFW 最精准管控能力 Most Accurate 最简单管理配置 Easier Management 最全面威胁防护 Best Threat Coverage 最高速性能体验 Highest Performance