Barracuda NextGen Firewall F

Transcription

1 Barracuda NextGen Firewall F Protecting your Digital Assets in Microsoft Azure Growth in cloud computing capabilities and services has driven more data into places where traditional IT security measures cannot reach; specifically, data centers not owned by your corporate IT group. The Barracuda NextGen Firewall F-Series provides centralized management and highly secure, encrypted traffic to, from, and within Microsoft Azure deployments. Security Storage Application Delivery The Barracuda Advantage Secure and reliable connectivity between on-premises and Azure deployments as well as between Azure deployments Central management of all functionality for both, on-premises and Azure deployments Unrivaled Quality of Service capabilities Available as Bring-Your-Own-License and Pay-As-You-Go Product Spotlight Powerful next-generation network firewall Advanced Threat Detection Built-in web security and IDS/IPS Client-to-Site VPN via browser (SSL VPN), mobile apps and desktop VPN clients Full application visibility and granular control Intelligent traffic regulation including application-based provider selection Tightly integrated Quality of Service (QoS) and link balancing Centralized management of all functionality Template-based and role-based configuration Secure Connectivity For an optimum Azure deployment, it is crucial to initiate the deployment in a highly secure and reliable way. Deploying a Barracuda NextGen Firewall F-Series in Microsoft Azure provides comprehensive, secure connectivity capabilities, starting with high-performance TINA VPN tunnels for site-to-site and client-to-site connections. includes robust WAN optimization features to maintain the highest quality of service possible. Central Management The Barracuda NextGen Firewall F-Series benefits from the same industry-leading central management as onpremises deployments. Easily manage the secure VPN connections to, from, and within Microsoft Azure and the Barracuda NextGen Firewall F deployment itself. Integrated Next-Generation Security The Barracuda NextGen Firewall F-Series is designed and built from the ground up to provide comprehensive, next-generation firewall capabilities. Based on application visibility, user-identity awareness, intrusion prevention, and centralized management, the F-Series is the ideal solution for today s dynamic enterprises that are adding Microsoft Azure into their company network. Status overview of a centrally managed Barracuda NextGen Firewall F-Series deployment

2 Barracuda Networks Barracuda NextGen Firewall F: Protecting your Digital Assets in Microsoft Azure Technical Specs Firewall Stateful packet inspection and forwarding Full user-identity awareness Intrusion Detection and Prevention System (IDS/IPS) Application control and granular application enforcement Interception and decryption of SSL/ TLS encrypted applications Antivirus and web filtering in single pass mode SafeSearch enforcement Google Accounts Enforcement Denial of Service protection (DoS /DDoS) Spoofing and flooding protection ARP spoofing and trashing protection DNS reputation filtering TCP stream reassembly Transparent proxying (TCP) NAT (SNAT, DNAT), PAT Dynamic rules / timer triggers Single object-oriented rule set for routing, bridging, and routed bridging Virtual rule test environment User Identity Awareness Terminal Server Agent Domain Controller Agent Authentication supports x.509, NTLM, RADIUS, RSA SecurID, LDAP/LDAPS, Active Directory, TACACS+, SMS Passcode (VPN), local authentication database Intrusion Detection & Prevention Protection against exploits, threats and vulnerabilities Packet anomaly and fragmentation protection Advanced anti-evasion and obfuscation techniques Automatic signature updates Traffic Optimization Fully Azure ExpressRoute compatible traffic shaping and QoS On-the-fly flow reprioritization Stream and packet compression Byte-level data deduplication Protocol optimization (SMBv2) VPN Drag & drop VPN tunnel configuration Secure site-to-site, client-to-site VPN Dynamic mesh site-to-site VPN Supports AES-128/256, 3DES, DES, Blowfish, CAST, null ciphers Private CA or external PKI VPNC certified (basic interoperability) Application-aware traffic routing IPsec VPN / SSL VPN / TINA VPN / L2TP / PPTP Dedicated VPN clients for Windows, MacOS, and Linux ios and Android mobile device VPN support Advanced Threat Detection Dynamic, on-demand analysis of malware programs (sandboxing) Dynamic analysis of documents with embedded exploits (PDF, Office, etc.) Detailed forensics for both, malware binaries and web threats (exploits) Support for multiple operating systems (Windows, Android, etc.) Botnet and Spyware Protection Flexible malware analysis in the cloud Central Management Options Barracuda NextGen Control Center Centrally administer unlimited Barracuda NextGen F-Series Firewalls Support for multi-tenancy Multi-administrator support & RCS Infrastructure Services SIP, HTTP, SSH, FTP proxies SNMP and IPFIX support DNS Cache SMTP gateway and SPAM filter Protocol Support IPv4, IPv6 BGP/OSPF/RIP VoIP (H.323, SIP, SCCP [skinny]) RPC protocols (ONC-RPC, DCE-RPC) BARRACUDA NEXTGEN FIREWALL F-SERIES BRING-YOUR-OWN-LICENSE PAY-AS-YOU-GO LICENSE CAPABILITIES Level 2 Level 4 Level 6 Level 8 Not restricted Virtual Cores FEATURES Firewall Application Control IPS VPN (site-to-site and client-to-site) SSL Interception WAN Optimization Network Access Control for VPN client-to-site connections Malware Protection 1 Optional Optional Optional Optional - Advanced Threat Detection 1, 2 Optional Optional Optional Optional - Premium Remote Access Optional Optional Optional Optional Premium Support Including FTP, mail and Web protocols Requires Malware Protection subscription. 3 Premium Support ensures that an organization's network is running at its peak performance by providing the highest level of 24x7 technical support for missioncritical environments. For more information please visit Support Options Barracuda Energize Updates Standard technical support Firmware updates IPS signature updates Application control definition updates Web filter updates Security Options Advanced Threat Detection Malware Protection Premium Remote Access subscription provides remote access via the CudaLaunch App for Windows, Mac OS X, ios and Android devices Specifications subject to change without notice. Datasheet US 3.4 Copyright Barracuda Networks, Inc S. Winchester Blvd., Campbell, CA / (US & Canada) barracuda.com Barracuda Networks and the Barracuda Networks logo are registered trademarks of Barracuda Networks, Inc. in the United States. All other names are the property of their respective owners.

3 Protect Your Digital Assets in Microsoft Azure with the Barracuda NextGen Firewall F The growth in cloud computing capabilities and services has driven more data into places where traditional IT security measures cannot reach - into data centers not owned by your corporate IT group. The Barracuda NextGen Firewall F-Series ensures highly secure, encrypted traffic within Microsoft Azure, provides secure remote and site-tosite access, and centralized management. The Barracuda NextGen Firewall F-Series fills the functional gaps between cloud infrastructure security and a defense-in-depth strategy by providing protection where the application and data reside, rather than solely where the connection terminates. Because of the isolation between VMs, tenants, and virtual networks, the Barracuda NextGen Firewall F-Series operates just as if it were a physical device bridging connections between application servers in a network DMZ and your ISP s router. Since no traffic is allowed from the Microsoft Azure Fabric, host OS, or hypervisor to a tenant s virtual network or VMs, the F-Series can intercept all Layer 2 through 7 traffic and apply policy-based controls, authentication, filtering, and other capabilities. And as with its physical counterpart, the same traffic management and bandwidth optimizations can be used to make the environment more efficient, thereby using fewer billable cloud resources. Beyond its powerful network firewall, high availability, and VPN technologies, the F-Series integrates a comprehensive set of nextgeneration firewall technologies, including Application Control, IPS, anti-malware, network access control enforcement, and comprehensive user awareness. The F-Series is fully compatible with Microsoft Azure for establishing site-to-site and/or client-tosite connections to its cloud services, and creating a virtual DMZ in Azure to implement an additional high-security layer. The Barracuda NextGen Firewall F-Series merges the worlds of onpremises data center network protection with cloud IT security needs, helping you close the gaps between native Microsoft Azure capabilities and traditional hardware-based application firewalls. Deploying the Barracuda NextGen Firewall F-Series in the cloud is very similar to running local network firewalls, and provides the advantages of common policy enforcement and distributed security management in a hybrid-it environment. Status overview of a centrally managed Barracuda NextGen Firewall F-Series deployment

4 Barracuda Networks Protect Your Digital Assets in Microsoft Azure with the Barracuda NextGen Firewall F Secure Remote Access for Mobile Users Dedicated VPN clients available for Windows, Mac, Linux Clientless SSL VPN CudaLaunch app available for ios and Android devices Supported protocols: TINA, IPsec, L2TP, PPTP Gateway probing Unlimited connections Client-to-Site: Dedicated VPN Clients for Clientless SSL VPN CudaLaunch App for Site-to-Site: Barracuda NextGen Firewall F-Series 1 n Multi-Tier Architecture Security Enforcement Internal and cross-region network segmentation Access control based on user and instance identity Instance OS health check Full traffic visibility and monitoring Support for Azure custom routing Location A Zone 1 Zone 4 Location B Zone 2 Zone 3 Multiple Site-to-Site Connectivity Vnet-to-Vnet connectivity Automatic user ID synchronization across sites Support for multiple ISPs Built-in WAN Optimization Full ExpressRoute support Unlimited sites High performance (>1Gbps) 3rd party XY Private Cloud Due to the limitations that come with standard IPsec connections, Barracuda Networks created several powerful extensions to standard IPsec tunnel management. This core of the NextGen VPN engine is called TINA (Transport Independent Network Architecture). The TINA protocol allows use of TCP, UDP, and ESP for high speed VPN connections which improves the VPN connectivity substantially by adding: About TINA (Transport Independent Network Architecture) Endpoint-to-Endpoint (not network-to-network) connectivity NAT friendliness Multiple physical transport paths for a logical tunnel Multiple tunnels between two locations HTTPS and SOCKS4/5 proxy compatibility Dynamic Address Support Tunnel heartbeat monitoring Solution Guide US 3.0 Copyright Barracuda Networks, Inc S. Winchester Blvd., Campbell, CA / (US & Canada) Barracuda Networks and the Barracuda Networks logo are registered trademarks of Barracuda Networks, Inc. in the United States. All other names are the property of their respective owners.

5 Barracuda Web Application Firewall Securing Applications and Data in Microsoft Azure The Barracuda Web Application Firewall blocks application layer DDoS and other attack vectors, directed at online applications hosted in Microsoft Azure. Simultaneously, it provides superior protection against data loss. It also has strong authentication and access control capabilities for restricting access to sensitive applications and data. Security Storage Application Delivery The Barracuda Advantage Barracuda Central Operations Center keeps track of emerging threats State-of-the-art security utilizing full reverse-proxy architecture Malware protection for collaborative web applications Employs IP Reputation intelligence to defeat DDoS attacks Designed to make it easier for organizations to comply with regulations such as PCI DSS and HIPAA Cloud-based scan with Barracuda Vulnerability Manager Automatic vulnerability remediation Product Spotlight Comprehensive inbound attack protection including the OWASP Top 10 Built-in caching, compression, and TCP pooling ensure security without performance impacts Identity-based user access control for web applications Built-in data loss prevention ICSA certified Constant Protection from Evolving Threats The Barracuda Web Application Firewall provides superior protection against data loss, DDoS, and all known applicationlayer attack modalities. Automatic updates provide defense against new threats as they appear. As new types of threats emerge, it will acquire new capabilities to block them. Identity and Access Management The Barracuda Web Application Firewall has strong authentication and access control capabilities that ensure security and privacy by restricting access to sensitive applications or data to authorized users. Affordable and Easy to Use Pre-built security templates and an intuitive web interface provide immediate security without the need for timeconsuming tuning or training. Integration with security vulnerability scanners and SIEM tools automates the assessment, monitoring, and mitigation process. Comprehensive Application Security Proactive Defenses Data Loss Prevention Internet Inbound Inspection Barracuda Web Application Firewall Outbound Inspection Server

6 Barracuda Networks Barracuda Web Application Firewall: Securing Applications and Data in Microsoft Azure Technical Specs Web Application Security OWASP top 10 protection Protection against common attacks SQL injection Cross-site scripting Cookie or forms tampering Form field meta-data validation Adaptive security Website cloaking URL encryption Response control JSON payload inspection Web scraping protection Outbound data theft protection Credit card numbers Custom pattern matching (regex) Granular policies to HTML elements Protocol limit checks File upload control DDoS Protection Barracuda IP Reputation Database Heuristic Fingerprinting CAPTCHA challenges Slow Client protection Geo IP Anonymous Proxy ToR exit nodes Barracuda Blacklist Supported Web Protocols HTTP/S 0.9/1.0/1.1/2.0 WebSocket FTP/S XML IPv4/IPv6 Authentication & Authorization LDAP/RADIUS/Kerberos/ local user database SAML 2.0 Azure AD Client certificates Single Sign-On RSA SecurID CA SiteMinder SMS PASSCODE SIEM Integrations ArcSight RSA envision Splunk Symantec Microsoft Azure Event Hub Custom XML Firewall XML DOS protection Schema/WSDL enforcement WS-I conformance checks Networking VLAN, NAT Network ACLs Advanced routing Support Options Barracuda Energize Updates Standard technical support Firmware and capability updates as required Automatic application definitions updates Management Features Customizable role-based administration Vulnerability scanner integration Trusted host exception Adaptive profiling for learning Exception profiling for tuning REST API Custom Templates Logging, Monitoring & Reporting System log Web firewall log Access log Audit log Network firewall log On-demand and scheduled comprehensive reports Centralized Management Monitor and configure multiple Barracuda products from a single interface Check health and run reports Assign roles with varied permissions Available from anywhere BARRACUDA WEB APPLICATION FIREWALL MICROSOFT AZURE - COMPUTE INSTANCE NAME SMALL (A1) MEDIUM (A2) LARGE (A3) EXTRA LARGE (A4) Capabilities Level 1 Level 5 Level 10 Level 15 Virtual Cores Throughput 100 Mbps 200 Mbps 400 Mbps 750 Mbps HTTP Connections per Second 5,000 7,000 10,000 14,000 HTTPS Requests per Second 5,000 7,000 10,000 14,000 FEATURES Response Control Outbound Data Theft Protection File Upload Control SSL Offloading Authentication and Authorization Vulnerability Scanner Integration Protection Against DDoS Attacks Network Firewall Web Scraping Protection Clustering Config Sync Config Sync Config Sync Config Sync Caching and Compression LDAP/RADIUS/Kerberos/Local User DB Integration Load Balancing Content Routing Advanced Routing Adaptive Profiling URL Encryption Antivirus for File Uploads XML Firewall JSON Security Premium Support 2 Optional Optional Optional Optional 1 Clustering enables synchronization of configuration between multiple instances. Azure Load Balancer may be used to distribute the traffic to multiple nodes. 2 Premium Support ensures that an organization's network is running at its peak performance by providing the highest level of 24x7 technical support for mission-critical environments. For more information please visit Specifications subject to change without notice. Datasheet US 2.6 Copyright 2017 Barracuda Networks, Inc S. Winchester Blvd., Campbell, CA / (US & Canada) Barracuda Networks and the Barracuda Networks logo are registered trademarks of Barracuda Networks, Inc. in the United States. All other names are the property of their respective owners.

7 Securing Applications & Workloads in Microsoft Azure with the Barracuda Web Application Firewall Today, cloud computing has become a musthave to a majority of the enterprise IT community, for reasons ranging from economic gains to technology benefits. But one of the major concerns carrying over from traditional IT data and application security has not changed, and requires the same diligence in the cloud as with on-premises solutions. Typically, whatever threats you face in your physical data center will be present in a virtualized one. Thus, as you extend your applications to the cloud, you are also extending your notions of identity, network and access control, information protection, and endpoint security. While Microsoft Azure is built on top of the same secure infrastructure as Bing, Microsoft.com, and Office 365, Microsoft Azure cannot block a poorly-designed web application from running on a VM, regardless of the security risks it might pose. With hundreds of lines of code to check - and vulnerabilities often subtle and hard to find - a serious data breach is often the first sign that a web application has problems. Fortunately, the Barracuda Web Application Firewall for Microsoft Azure fills the functional gaps between cloud infrastructure security and a defense-in-depth strategy required to securely migrate applications to Microsoft Azure. It is the first integrated, fully scalable Web Application Firewall on Microsoft Azure. Having secured thousands of production applications against more than 11 billion attacks since 2008, the Barracuda Web Application Firewall is the ideal solution for organizations looking to protect web applications or workloads deployed in Microsoft Azure. With predefined security templates and load balancing built in, companies of all sizes can enjoy total application security with no need to learn, configure, and manage complex technology. Comprehensive Application Security Proactive Defenses Data Loss Prevention Inbound Inspection Outbound Inspection Barracuda Web Application Firewall

8 Barracuda Networks Securing Applications & Workloads in: Complete Application Security for Web Applications Deployed in Microsoft Azure Advantage OWASP Top 10 Protection Advanced DDoS Protection Application Cloaking Geo-IP Control Botnet Detection Data Loss Prevention Integration with Azure AD Comprehensive Application Security Proactive Defenses Inbound Inspection Data Loss Prevention Outbound Inspection Barracuda Web Application Firewall Scalable Security for Elastic Applications Advantage Centralized Management & Administration Automatic Configuration Sync across WAF clusters Dynamically Registers Servers as you Scale Azure LB Auto Scaling Group... Barracuda WAF Cluster Server 1... Server N Dynamic Scaling Publishing SharePoint in Microsoft Azure Advantage Granular Identity Management Client Access Control Pre-built Security Templates for SharePoint Application Security End User Public-facing Website Barracuda WAF SharePoint Admin Site AD/DC/DNS AD/DC/DNS Content Authoring VM on Azure VPN Tunnel Browse Website Load Balancer Public-facing Website SharePoint Admin Site Site Administration On-Premises Solution Guide US 1.4 Copyright Barracuda Networks, Inc S. Winchester Blvd., Campbell, CA / (US & Canada) Barracuda Networks and the Barracuda Networks logo are registered trademarks of Barracuda Networks, Inc. in the United States. All other names are the property of their respective owners.