Best Choice for Your Network Protection

Transcription

1 Network Security Product Solution Guide Proven Network Security Solutions Best Choice for Your Network Protection Corporate Headquarters ZyXEL Communications Corp. Tel: Fax: Asia ZyXEL China (Beijing) Tel: Fax: ZyXEL China (Shanghai) Tel: Fax: ZyXEL China (Wuxi) Tel: Fax: ZyXEL India Tel: Fax: ZyXEL Japan Tel: Fax: ZyXEL Kazakhstan Tel: Fax: ZyXEL Malaysia Tel: Fax: ZyXEL Pakistan Tel: Fax: ZyXEL Singapore Tel: Fax: ZyXEL Taiwan (Taipei) Tel: Fax: ZyXEL Thailand Tel: +66-(0) Fax: +66-(0) Europe ZyXEL BeNeLux Tel: Fax: ZyXEL Czech s.r.o Tel: Fax: ZyXEL Denmark A/S Tel: Fax: ZyXEL Finland Oy Tel: Fax: ZyXEL France SARL Tel: +33 (0) Fax: +33 (0) ZyXEL Germany GmbH. Tel: +49 (0) Fax: +49 (0) sales@zyxel.de ZyXEL Hungary Tel: Fax: info@zyxel.hu ZyXEL Norway A/S Tel: Fax: sales@zyxel.no ZyXEL Poland Tel: +48 (22) Fax: +48 (22) info@pl.zyxel.com ZyXEL Russia Tel: +7 (495) Fax: +7 (495) info@zyxel.ru ZyXEL Spain Tel: Fax: sales@zyxel.es ZyXEL Sweden A/S (Göteborg) Tel: +46 (0) Fax: +46 (0) sales@zyxel.se ZyXEL Sweden A/S (Stockholm) Tel: Fax: sales@zyxel.se ZyXEL Turkey A.S. Tel: Fax: bilgi@zyxel.com.tr ZyXEL UK Ltd. Tel: +44 (0) Fax: +44 (0) sales@zyxel.co.uk ZyXEL Ukraine Tel: Fax: sales@ua.zyxel.com The Americas ZyXEL Costa Rica Tel: Fax: sales@zyxel.co.cr ZyXEL North America Tel: Fax: sales@zyxel.com - Flexible Hybrid-VPN - Bandwidth Management - IM/P2P Management - Scalable UTM/VPN Performance - High Availability - Network Reporting For more product information, visit us on the web at Copyright 2008 ZyXEL Communications Corp. All rights reserved. ZyXEL, ZyXEL logo are registered trademarks of ZyXEL Communications Corp. All other brands, product names, or trademarks mentioned are the property of their respective owners. All specifications are subject to change without notice B 08/08

2 Network Security Product Solution Guide Table of Contents Challenges that may Drain Your IT Resource Which ZyXEL Product is Right for You? Solurion Scenario Product at a Glance ZyXEL Products ZyXEL Network Management Solution at a Glance USG Series Feature Matrix Feature Matrix

3 T he challenge faced by today s information security and IT professionals, no matter what the size of the business, is how to keep the company protected in the face of multiple simultaneous security hazards, while also under pressure to reduce costs, increase employee productivity and avoid buying single point products so the security environment is under control and manageable. 3. Managing IM/P2P Abuse For increasing network efficiency and business productivity, the IM/P2P application needs to be well managed. The USG series supports Application Patrol which controls who can use IM and P2P applications like MSN TM and BitTorrent TM and even who can use specific features within an application. Challenges that may Drain Your IT Resource 1. Secure Connectivity Given the prevalence and importance of information technology (IT) systems today and the nature and scale of both the opportunities and risks associated with significant deployments of new networking technologies, organizations are forced to evaluate solutions to build up a safer infrastructure to secure online transactions, in which involve exchange of valuable information. The infrastructure should be tailored to meet operation requirements for expanding remote sites as well as mobile teleworkers. 2. Proactive Protection Malicious virus, worm, exploits could cripple corporate networks and halt business transactions. In addition to severe financial loss, you also risk leakage of confidential information. As mass-mailing software companies mushroom on the Internet, your network is bombarded with massive amounts of junk mails (spam). Without intelligent detection and proactive blocking, users have to go through the tedious and time-consuming task of sieving through the overflowing mailbox, and such scenario leads to serious productivity loss. 3. Policy Compliance With numerous file-sharing (P2P) and Instant Messaging (IM) applications, it is easier for company employees to share files and chat online during work hours. Rapid file sharing not only compromises network safety with the sharing of questionable files containing malicious viruses, but may also violate copyright issues and create legal hassles. 4. Network Resilience ISP links broken, hardware and software failure on the gateway, dead VPN tunnels these are severe challenges IT staff face when designing the network infrastructure. In short, we need to take fault tolerance on the network path into consideration when build up a highly available network infrastructure for non-stop operations. USG Series Advantages The USG series is a high performance, deep packet inspection security solution for small business to enterprise. It embodies a Stateful Packet Inspection (SPI) firewall, Anti-Virus Intrusion Detection and Prevention (IDP), Content Filtering, Anti-Spam, and VPN (IPSec/SSL/L2TP) in one box. This multi-layered security safeguards your organization's customer and company records, intellectual property, and critical resources from external and internal threats. 4. Non-Stop Internet Access with Multiple WAN and as backup The USG not only supports multiple WAN ports but also supports USB or PCMCIA card. This enables it to provide activeactive load sharing or active-passive failover configuration to deliver highly reliable network connectivity. To minimize the impact of single-point failures, the USG series support device HA (High Availability) to ensure network availability. 5. ICSA Firewall, IPSec, Antivirus Certification With ICSA certified SPI Firewall, Anti-Virus and IPSec VPN, the USG series enables organizations to take complete control of their network infrastructure and provide the most up-to-date protection against the network threats. 6. Comprehensive Report System USG series build-in report system which offers a comprehensive set of real-time and historical reports, including firewall, virus and intrusion attacks, bandwidth usage, web site usage, and user activity. Furthermore, with the web-based reporting system, Vantage Report (VRPT), administrators can easily collect traffic data and analyze a distributed network, so organizations are aware of suspicious activity and to ensure increase business productivity. A Better UTM Solution With advantages inherited from the previous UTM family, which include Anti-Virus, IDP, Anti-Spam, Firewall, VPN, Load Balancing, Bandwidth Management and Content Filtering, the new USG Series provides even more benefits: Wide-ranging product portfolio: Multi-layered threat protection from small businesses to enterprises Robust hardware platform: All models are built-in with SecuASIC hardware engine, VPN crypto and Gigabit Ethernet interfaces Comprehensive virus/malware protection: Dual AV engines; either ICSA-certified ZyXEL AV or Kaspersky AV may be chosen to protect against viruses, Trojan horses and spyware. Hybrid VPN solution: Secured remote access with IPSec/SSL/L2TP VPN solutions in a box. Flexible access control: Built-in intelligent user-aware policy engine enables access granularity and manages various types of IM/P2P applications. Increased network connectivity: Multi-ISP links,, wireless support, Load Balancing and High Availability features guarantee non-stop network connectivity. 1. Leading, High Performance UTM solution USG series deploys hardware-acceleration technology in one box. Powered by high-performance SecuASIC technology and a hardware-based encryption accelerator, the USG series delivers leading high performance and multi-layer threat protection for small business to enterprises. All USG series support Gigabit Ethernet interfaces. 2. Robust Hybrid VPN (IPSec and SSL) The USG series can provide secure access from remote locations to corporate resources through the Internet for organizations of any size. Using IPSec VPN companies can secure connections to branch offices, partners, and headquarters. Road warriors and telecommuters can use SSL or L2TP VPN to securely access the company network without having to install VPN software. 4 5

4 Which ZyXEL Product is Right for You? Product Family Your Requirement Typical Application Product Family Your Requirement Typical Application USG 2000 Need Gigabit firewall throughput to protect enterprise networks (200~ 500 computer users) Increase network efficiency and productivity Provide Hybrid VPN (IPSec + SSL) capacity Maintain continuous business operations with around-the-clock protection Protecting enterprise networks (Firewall, Anti-virus, IDP) Increasing network efficiency (Bandwidth Management, Load Balancing) Increasing business productivity (IM/P2P Management, Content Filtering) Hybrid VPN for intensive IPSec and SSL VPN applications for both site-tosite and remote access Guaranteeing non-stop operation of mission-critical applications (Device High Availability (HA) function, redundant power module, multiple ISP links) 2 Plus Need an ICSA-certified and costeffective network protection solution for telecommuters/home networks (1 ~ 5 computer users) Increase efficiency, business productivity Securely access remote offices SOHO network protection (Firewall) Increase network efficiency (Bandwidth Management) Increase employee productivity (Content Filtering) Secure connections to remote offices (IPSec VPN) USG 1000 USG 300 USG 200/100 Need high-performance, all-in-one Firewall to protect mid- to large-sized business networks (75~200 computer users) Increase network efficiency and productivity Provide Hybrid VPN (IPSec + SSL) capacity Maintain continuous business operations with around-the-clock protection Need high-performance, all-in-one Firewall to protect mid-sized business networks (50~75 computer users) Increase network efficiency and productivity Provide Hybrid VPN (IPSec + SSL) capacity Achieve continuous business operation with around-the-clock protection Unified Security Gateway (Stateful Packet Inspection (SPI) firewall, anti-virus, IDP/ADP, IM/P2P and content filtering) to protect small business networks (10~50 computer users) Provide Hybrid VPN (IPSec + SSL) capacity Multi-ISP Links /Wireless support for mobility Protecting mid- to large-sized office networks (Firewall, Anti-virus and IDP) Increasing network efficiency (Bandwidth Management, Load Balancing) Increasing business productivity (IM/P2P Management, Content Filtering) VPN concentrator for intensive IPSec and SSL VPN appliance Around-the-clock protection with High Availability for device, VPN and Internet connection Protecting mid- to large-sized office networks (Firewall, Anti-virus and IDP) Increasing network efficiency (Bandwidth Management, Load Balancing) Increasing business productivity (IM/P2P Management, Content Filtering) Hybrid VPN for intensive IPSec and SSL VPN application for both site-to-site or remote access Around-the-clock protection with High Availability for device, VPN and Internet connection Protecting small business networks (SPI Firewall, Anti-virus and IDP) Increasing network efficiency (Bandwidth Management, Multi-ISP Links) Increasing business productivity (IM/P2P Management, Content Filtering) Hybrid VPN for intensive IPSec and SSL VPN applications for remote access Internet access for mobility (USB/PCMCIA Card) 2WG P1 SSL10 OTP IPSec VPN Client To provide cost-effective versatile access security appliance for SOHO/SB networks To deliver WiFi access on a LAN Provide connections as a WAN alternative Need an easy VPN setup and deployment solution for nontechnical business travelers without software installation Client-less VPN appliance for teleworkers to have remote access without any technical interaction Need a two-factor authentication security technology to strengthen user authentication Need to establish secure connections to corporate environments over the Internet SOHO network protection (Firewall) as a WAN alternative for primary WAN, backup WAN or WAN LB ( WAN connection) Wi-Fi a/b/g for LAN access flexibility (Wi-Fi) Increase network efficiency (Bandwidth Management) and employee productivity (Content Filtering) Secure connections to remote offices (IPSec VPN) Hardware VPN/Firewall client that arms employees with network security wherever they go Plug-and-play secure network connection setup without addition software installation/configuration Platform independent connection setup Secure client-less remote access Seamless integration with UTM Support AD/LDAP/RADIUS and two-factor authentication Endpoint security support Dual-mode (DMZ and NAT) installation with setup wizard Two-factor authentication solution to strengthen password security in SSL VPN and IPS SEC VPN applications Secure connections for mobile users to access corporate applications and servers via Internet /35 UTM Series Need a high-performance, all-in-one Firewall to protect enterprise networks (75 ~ 200 computer users) Increase network efficiency and productivity Provide hybrid VPN (IPSec+SSL) capacity Achieve continuous business operation with around-the-clock security protection Need high-performance, all-in-one Firewall to protect SMB network (5 ~ 50 computer users) Increase network efficiency, business productivity Securely access remote offices Medium to large-sized office network protection (Firewall, Anti-virus, IDP) Increase network efficiency (Bandwidth Management, Load Balancing) Increase business productivity (IM/P2P Management, Anti-spam, Content Filtering) VPN concentrator for intensive IPSec VPN and SSL VPN application Around-the-clock security protection with high availability for device, VPN and Internet connection Small to medium-sized office network protection (Firewall, Anti-virus, IDP) Increase network efficiency (Bandwidth Management, Load Balancing) Increase business productivity (IM/P2P Management, Anti-Spam, Content Filtering) High performance secure connection to remote offices (IPSec VPN) Vantage CNM Vantage Report AWARD Need centralized management solution that allows an administrator to remotely manage, configure, monitor and troubleshoot ZyXEL devices easily Need comprehensive reporting for s to monitor suspicious network activity and to get scheduled report by Remotely manage multiple devices to reduce network management efforts Centralized log collection, multi-device firmware upgrade and reusable VPN configuration template For deploying consistent security policies and receiving real-time device monitoring report Enterprises who want to monitor all network traffic activies to ensure employee productivity Comprehensive network statistics such as user behavior, bandwidth usage, etc. Report achieves for future analysis and to be sent to the network management stuff Empfehlung d. R edaktion BEST OF 2005 Ausgabe 3/04 Zywall 2 6 7

5 Solution Scenario Less than 10 PC Users 50 to 200 PC Users To secure an office with a single broadband Internet connection, provide secure remote access, and protect endpoint devices. Measures mitigating application-level attacks should be taken. Main Office USG 100/200 Internet VPN Tunnel VPN Tunnel VPN Gateway Partner Site A comprehensive protection mechanism should be deployed to protect the entire cooperate network from viruses, worms, trojans and remote attacks. Requires siteto-site and remote VPN access capabilities with firewall protection in a distributed network. Also, each endpoint device needs to be secured. There is a need for high availability of Internet access and quality of service management at the main office. Wireless AP Vantage CNM USG 100/200 DMZ SMTP, Web, DNS, FTP Server VPN Tunnel USG 1000 Main Office Internet USG 100/200 USG 300 Branch Office SSL VPN Remote Access VPN 2WG Teleworker OTP Teleworker Clientless Secure Access 10 to 50 PC Users Requires site-to-site and remote VPN access capabilities with firewall protection at the main and branch offices. In addition, each endpoint device needs to be secured. Measures to mitigate application-level attacks should be taken so that valuable information assets will be well protected. Vantage CNM USG 200 Main Office DMZ SMTP, Web, DNS, TP Server Remote Access VPN Internet Site-to-Site VPN USG 100 Branch Office 200 to 500 PC Users Requires site-to-site and remote access VPN capabilities with firewall protection in a distributed network. Threats from the Internet should be stopped at the network perimeter. For a network of this size, centralized management is desired. Also, each endpoint device needs to be secured. There is a need to ensure reliable performance and uninterrupted access to resources. The quality of service management is also required at the main office. Wireless AP Vantage CNM USG 300 USG 2000 Main Office DMZ SMTP, Web, DNS, FTP Server SSL VPN VPN Tun Internet Remote Access VPN USG 1000 Branch Office OTP 2WG Teleworker Teleworker Clientless Secure Access 8 9

6 Product at a Glance ZyXEL Product USG 2000 USG 300 Unified Security Gateway for enterprise organizations that provides Hybrid VPN and robust UTM functionalities (Recommended: 200~500 PC users) Unified Security Gateway The USG 2000 is an ultra high-performance, deep packet inspection security platform for enterprises. It incorporates firewall, IDP, content filtering, anti-virus, anti-spam, and VPN functionalities in one box. This multi-layered security safeguards your customer and company records, intellectual property and critical resources against external and internal threats. With streamlined integration of both IPSec VPN and SSL VPN technologies, plus support for up to 2000 IPSec VPN tunnels, the USG 2000 is an ideal solution for organizations requiring intensive site-to-site and remote access VPN applications across distributed networks. By integrating anti-virus, IDP, application patrol, content filtering and bandwidth management features, USG 2000 is capable of providing robust, real-time protection to mitigate security breaches, manage IM/P2P applications and ensure security policy compliance in enterprise organizations. Unified Security Gateway for enterprises ICSA-certified ZyXEL or Kaspersky Labs-powered anti-virus for protection against viruses and spyware Scalable VPN/UTM performance with the added Security Extension Module Application Patrol controls IM and P2P application usage and will even control which individual within an organization can use this application High Availability features with redundant power modules guaranteeing non-stop operations Unified Security Gateway for Small and Medium-Sized businesses to provide Hybrid VPN and robust UTM (Recommended: 50~75 PC users) Unified Security Gateway USG 300 is a Unified Security Gateway that integrates comprehensive enterprise-class security features tailored for the SMB (Small and Medium-sized Business). With streamlined integration of both IPSec VPN and SSL VPN technologies, the USG 300 is an ideal solution for organizations requiring intensive VPN applications across distributed networks. No matter whether you are in a remote branch office or at an unreliable hotel hotspot, the USG 300 can establish secure communication tunnels with IPSec and/or SSL protection. Additional benefits include the user-aware access control, scheduling, bandwidth usage and anti-threat security features that can be enforced against inbound and outbound traffic of the protected network resources. Unified Security Gateway to provide Hybrid VPN (IPSec/SSL VPN) and robust UTM security services High-performance multi-layer threat protection powered by cutting-edge SecuASIC hardware accelerator Application Patrol controls IM and P2P application usage, even who can use which features within an application User-aware policy engine enables access granularity Excellent manageability with object and text-based configuration files as well as centralized network management Moreover, the USG 2000 provides High Availability (HA) for devices, VPN and Internet connections to achieve around-theclock security protection. USG 200 Unified Security Gateway for SMB/Mid-Large organizations to provide Hybrid VPN and robust UTM (Recommended: 75~200 PC users) USG 1000 Unified Security Gateway USG 1000 is a high-performance UTM appliance with Gigabit Ethernet ports and unbeatable firewall/vpn performance (350 Mbps/150 Mbps) equipped with complete security features tailored for Small and Medium Businesses (SMBs) and mid- to large-sized organizations. With streamlined integration of both IPSec VPN and SSL VPN technologies, as well as support for up to 1000 IPSec VPN tunnels, the USG 1000 is an ideal solution for organizations requiring intensive site-to-site and remote access VPN applications across distributed networks. By integrating anti-virus, IDP, application patrol, content filtering and bandwidth management features, the USG 1000 is capable of providing robust, real-time protection to mitigate security breaches, manage IM/P2P applications and ensure security policy compliance in mid- to large-sized organizations. Moreover, USG 1000 provides High Availability for devices, VPN and Internet connections to achieve around-theclock security protection. Unified Security Gateway to provide Hybrid VPN (IPSec/SSL VPN) and robust UTM security services High-performance multi-layer threat protection, powered by the cuttingedge SecuASIC hardware accelerator Application Patrol to manage the use of IM/P2P applications without hassle High Availability features guarantee non-stop operations of missioncritical applications Excellent manageability with object and text-based configuration files as well as centralized network management Unified Security Gateway for Small businesses that provides Hybrid VPN and robust UTM functionalities (Recommended: 20~50 PC users) Unified Security Gateway The USG 200 is a high-performance, deep packet inspection security platform for small to medium-sized offices. It embodies a firewall, Intrusion Detection and Prevention (IDP), content filtering, anti-virus, anti-spam and VPN in one box. The multi-layered security safeguards your organization's customer and company records, intellectual property and critical resources against external and internal threats. Its fanless design allows quiet heat dissipation, making it a perfect choice for desktop deployments. With streamlined integration of both IPSec VPN and SSL VPN technologies, the USG 200 is an ideal solution for organizations requiring intensive VPN applications across distributed networks. No matter whether you are in a remote branch office or at an unreliable hotel hotspot, the USG 200 can establish secure communication tunnels with IPSec and/or SSL protection. Other major benefits of the USG 200 include user-aware access control, scheduling, bandwidth usage and anti-threat security features can be enforced against inbound and outbound traffic of the protected network resources, whilst multi-isp links, wireless cards and support can provide more network connectivity. High-performance multi-layer threat protection powered by cutting-edge SecuASIC hardware accelerator Hybrid VPN (IPSec, SSL and L2TP) secures connections to branch offices, partners and headquarters ICSA-certified ZyXEL or Kaspersky Labspowered anti-virus for protection against viruses and spyware Application Patrol controls IM and P2P application usage, even who can use which features within an application Flexible OPT (option) port that can be used as another WAN, LAN1, LAN2 or DMZ port 10 11

7 USG UTM Unified Security Gateway for Small businesses that provides Hybrid VPN and robust UTM functionalities (Recommended: 10~25 PC users) Unified Security Gateway The USG 100 is a high-performance, deep packet inspection security platform for small to medium-sized offices. It embodies a firewall, Intrusion Detection and Prevention (IDP), content filtering, anti-virus, anti-spam and VPN in one box. This multi-layered security safeguards your organization s customer and company records, intellectual property and critical resources against external and internal threats. Its fanless design allows quiet heat dissipation, making it the perfect choice for desktop deployments. With streamlined integration of both IPSec VPN and SSL VPN technologies, the USG 100 is an ideal solution for organizations requiring intensive VPN applications across distributed networks. No matter whether you are in a remote branch office or at an unreliable hotel hotspot, the USG 100 can establish secure communication tunnels with IPSec and/or SSL protection. Another major benefit of the USG 100 is that user-aware access control, scheduling, bandwidth usage and anti-threat security features can be enforced against inbound and outbound traffic of the protected network resources, whilst multi-isp links, wireless cards and support can provide more network connectivity. High-performance multi-layer threat protection powered by cutting-edge SecuASIC hardware accelerator Hybrid VPN (IPSec, SSL and L2TP) secures connections to branch offices, partners and headquarters ICSA-certified ZyXEL or Kaspersky Labs-powered anti-virus for protection against viruses and spyware Application Patrol controls IM and P2P application usage, even who can use which features within an application Extension card slot and USB ports for multiple wireless WAN connections Leading best-of-breed technology UTM Security appliance for SB Integrated Internet Security Appliance with Unified Threat Management 5 UTM is an Internet Security Gateway integrated with comprehensive security solutions designed for Teleworker and Small Office, Home Office (SOHO) networks with up to 10 users. Improved with ZyXEL s advanced SecuASIC solution, 5 UTM provides the ultimate performance for your network. With 5 UTM, you get effective anti-virus protection service from the world renown Kaspersky Antivirus. In addition, the proprietary ZyNOS is an all-in-one security module (Firewall, IPSec VPN, Anti-Virus, IDP, Anti-Spam, Content Filtering and Bandwidth Management) offering both excellent protection and easy network management. 35 UTM ICSA-certified IPSec 1.1D VPN (10 VPN tunnels) and SPI firewall (50 Mbps) Integrated high-performance gateway with built-in anti-virus, antispam, intrusion detection/prevention, and content filtering Flexible and configurable interfaces for creating dynamic security policies Bandwidth management and Centralized Network Management (CNM) support Best performance UTM/VPN concentrator Security Appliance for Mid-Large SMB (Recommended: 75~200 PC users) 1050 Highly Integrated Internet Security Appliance 1050, a high performance Unified Threat Management (UTM) appliance with Gigabit Ethernet port and unbeatable firewall/vpn performance (300 Mbps/150 Mbps), is equipped with complete security features tailored for Small and Medium Business (SMB) and large-mid-sized organizations. With state-ofthe-art hardware acceleration technology and support for up to 1000 VPN tunnels, 1050 is an ideal VPN concentrator in the network infrastructure. By integrating comprehensive application inspection technologies and user-aware security policy management into a single device, 1050 is capable of providing robust, realtime protection to mitigate security breaches and ensure security policy compliance in a large to mid organization. High performance appliance with Gigabit Ethernet port and high Firewall/VPN performance (300 Mbps/150 Mbps) Powerful UTM with anti-virus, antispam, intrusion detection/prevention, and content filtering High availability with built-in device and VPN redundancy Robust networking features: user-aware policy management, definable zones, and VLAN-aware support Excellent device management and maintenance featuring object-based configuration, text-based configuration file, and central management Dual-WAN high performance 8-in-1 UTM for Small business/ Remote Office Branch Office (Recommended: 20~50 PC users) Integrated Internet Security Appliance with Unified Threat Management 35 UTM is an Internet Security Gateway integrated with complete security solutions designed for small business, remote office and brach office networks with up to 30 users. By adopting ZyXEL s advanced SecuASIC solution, 35 UTM provides the superb performance. Improved with ZyXEL s advanced SecuASIC solution, 35 UTM provides the ultimate performance for your network. With 35 UTM, you get an effective anti-virus protection service from the world renown Kaspersky Antivirus. In addition, the proprietary ZyNOS is an allin-one security module (Firewall, IPSec VPN, Anti-Virus, IDP, Anti- Spam, Content Filtering and Bandwidth Management) offering both excellent protection and easy network management. ICSA-certified IPSec 1.1D VPN (35 VPN tunnels) and SPI firewall (60 Mbps) Integrated high-performance gateway with built-in anti-virus, antispam, intrusion detection/prevention, and content filtering Dual-WAN ports for auto-failover/ fallback and load balancing Flexible and configurable interfaces for creating dynamic security policies Bandwidth management and Centralized Network Management (CNM) support 12 13

8 2WG P1 Cutting-edge +Wi-Fi Router with Best Security Functions for SOHO and Remote Offices Unified Security Gateway Equipped with and WiFi features, 2WG is the best mobile broadband security appliance solution for remote and SOHO offices. The connection provides versatile WAN applications such as: as the primary WAN, as a backup WAN and for WAN load balancing. This provides the possibility for any wire-challenged environment to get broadband access easily, for example, shops which need secure, real-time access to provide Point of Sales (POS). Wi-Fi a/b/g provides 2WG users with more flexible connection they demand. Moreover, 2WG also provides excellent security features inherited from the Series; such as Firewall, VPN, Content Filtering and Bandwidth Management. All these make 2WG the best security router for remote and SOHO offices. Internet access through networks (HSDPA, UMTS, GPRS, EDGE) Dual-band, tri-mode access point (802.11a/b/g) Advanced ICSA certified ZyNOS SPI Firewall () and IPSec VPN (5 VPN tunnels) protection Configurable 4-port LAN/DMZ/ WLAN zones Web-based Content Filtering services World's first Palm-sized Hardware VPN Client and Internet Security Appliance for Personal Network Protection Personal Internet Security Appliance P1 is a proven, stand-alone, portable hardware-based security device that can provide VPN connection for telecommuters to easily set up secure connection to the headquarters without software installation and configuration. P1 is designed to allow easy installation, use and management. P1 allows companies to meet the increasing demands in providing secure connections using individual mobile computers or laptops.. ICSA-certified IPSec 1.1D VPN (1 VPN tunnel) and SPI firewall (80 Mbps) Allows for mass, platform independent deployment without software installation efforts Proactive endpoint security provides effective network protection ZyXEL Centralized Network Management (CNM) support USB-powered Integrated gateway with built-in anti-virus and intrusion detection/ prevention 2 Plus SSL 10 Professional Entry-Level Internet Security Appliance for SB/SOHO Internet Security Appliance Featuring robust series firewall functions, 2 Plus is most suited for telecommuters and home workers. With ICSA certified firewall and IPSec VPN, 2 Plus gives you unbeatable security protection in addition to problem-free interoperability with other ICSA-certified devices. Other value-added benefits include Dial Backup, Traffic Redirect and multi-internet connection support. Superior reliability, a user-friendly Internet Wizard interface and unique design make the 2 Plus the best Internet security gateway choice for telecommuters and home workers. ICSA-certified IPSec VPN (5 VPN tunnels) and SPI firewall () Customizable Web Content Filtering DoS/DDoS intrusion prevention ZyXEL Centralized Network Management (CNM) support Professional Integrated SSL- VPN Appliance for Small and Medium-sized businesses Integrated SSL-VPN Appliance SSL 10 is an integrated SSL-VPN appliance designed for small and medium-sized businesses with simple, secure and client-less remote access to company network resources. With dual-mode support, SSL 10 can be deployed in the DMZ of UTM to form a joint-defense solution, or deployed in the gateway to be a firewall/ssl device. Besides, SSL 10 also provides endpoint security check to ensure all client PCs are secure before making connection to SSL 10 and internal resources. Other advanced features like two-factor authentication, object-based configuration and SecuExtender make SSL 10 to be a comprehensive SSL VPN solution right for smaller businesses. Clientless secure remote access Seamless integration with the current UTM Series Supports AD/LDAP/RADIUS and twofactor authentication Endpoint security check Unified policy management with object-based configuration Dual-mode (NAT/DMZ mode) installation with setup wizard 14 15

9 OTP IPSec VPN Client Two-Factor Authentication Token Two-Factor Authentication One Time Password Token The starting point of security is to ensure that only authorized people can remotely access the protected network applications and resources. Given enough time for attempts, it s relatively easy for unauthorized intruders to crack a static password. With a one-time password, the risk can be greatly reduced by constantly altering the combination. The OTP authentication token is a chip-based, 6-digit numeric PIN to be used alongside a password for strong two-factor authentication. The OTP token can be easily integrated with existing security solutions. Strong Two-Factor Authentication solution One Token for many applications Intuitive and easy to install, use and manage Seamless integration with security products IPSec VPN Client Software for Mobile Users Remote Security Client The IPSec VPN Client is designed for mobile users to establish a secure connection to the corporate networks over the Internet. Together with a configuration wizard, IPSec VPN Client helps users to create VPN connections quicker than ever. The user-friendly interface of IPSec VPN Client makes it easy to install, configure and use. With IPSec VPN, setting up a VPN connection is no longer a dreadful task. Windows Vista support Interoperability with and most IPSec VPN gateways IPSec VPN Tunneling with DES/3DES/AES encryption User authentication with X-Auth, PEM or PKCS#12 Certificates, pre-shared keys DPD and redundant gateway 16 17

10 ZyXEL Network Management Solutions at a Glance Vantage Report Vantage CNM Network Reporting Analyzer Centralized Network Management ZyXEL Vantage Report (VRPT), a web-based centralized reporting system for fast and convenient traffic data collecting and analyzing in a distributed network. VRPT provides system administrators a simple method of monitoring multiple Internet security appliances. With ZyXEL VRPT, system administrators can easily monitor network access, attack, intrusion and bandwidth usage of network applications. The collected information can be further used for fine tuning the configuration on ZyXEL s Internet security appliances for enhanced bandwidth control and network security. ZyXEL s VRPT offers a comprehensive set of real-time and historical reports including firewall, virus and intrusion attacks, bandwidth usage, Web site usage, user activity, and more, allowing organizations to be aware of suspicious activity and to ensure high business productivity. ZyXEL VRPT also supports automatic report achieving and ing features. Comprehensive set of graphical reports Web-based user interface (browserbased application) Intuitive design and easy to use Multi- support Automated report scheduling Vantage Centralized Network Management (CNM) is a costeffective, browser-based centralized management solution that allows an administrator from any location to easily configure, manage, monitor and troubleshoot ZyXEL devices located worldwide. With the remote management feature, system integrators, IT consultants or administrators can remotely manage devices, whether the need is to decipher a log, to upload new firmware, or to create new VPN tunnels. These combined features allow for rapid deployment of ZyXEL devices, minimizing management cost and maximizing device efficiency. Its power and scalability make managing multiple ZyXEL devices easier than ever before. Central management of UTM features for UTM One-click VPN creation and graphical VPN management Mass firewall ACL policy deployment and management Bulk firmware upgrade and management Intuitive device and account monitoring 18 19

11 USG Series Feature Matrix Feature Matrix Model Name System Firewall Throughput VPN Throughput (AES) UTM Throughput (AV+IDP+Firewall) Unlimited User Licenses Sessions Max. Concurrent IPSec VPN Tunnels Max. Concurrent SSL VPN Users Physical Port Customizable Zone Networking Routing/NAT/SUA Mode Bridge Mode Mix Mode (Routing+Bridge) VLAN Tagging (802.1q) Wireless Card Support Support Security Firewall IPsec VPN SSL VPN Content Filtering Anti-SPAM Anti-Virus IDS/IDP IM/P2P Management Bandwidth Management User-aware Management High Availability Device HA VPN HA Multiple WANs for Load Balancing Auto Fail-over, Fail-back Dial Backup Redundant Power Module Authentication Method Local Database Radius LDAP Microsoft AD OTP Management WebGUI (HTTP and HTTPS) Command Line Vantage CNM Vantage Report Note: *1: With SEM-DUAL/SEM-VPN module *2: With SEM-DUAL/SEM-UTM module *3: Available In future firmware release USG ,000 Mbps 500 Mbps *1 400 Mbps *2 1,000,000 2, (6) 10/100/1000 GbE (2) Dual-Personality GbE (SFP/RJ45) *3 A/P USG Mbps 150 Mbps 100 Mbps 500,000 1, (250 *3 ) (5) 10/100/1000 GbE *3 A/P USG Mbps 100 Mbps 48 Mbps 60, (25 *3 ) (7) 10/100/1000 GbE *3 A/P USG Mbps 75 Mbps 40, x LAN/DMZ, 2 x WAN, 1 x OPT (All GbE) A/P USG Mbps 50 Mbps 20, x LAN/DMZ, 2 x WAN (All GbE) A/P Model Name System Firewall Throughput VPN Throughput (AES) UTM Throughput (AV+IDP+Firewall) Unlimited User Licenses Sessions Max. Concurrent IPSec VPN Tunnels Max. Concurrent SSL VPN Users Wireless Physical Port Customizable Zone WAN Type Ethernet (Optional) Networking Routing/NAT/SUA Mode Bridge Mode Mix Mode (Routing+Bridge) VLAN Tagging (802.1q) Security Firewall IPsec VPN SSL VPN Content Filtering Anti-SPAM Anti-Virus IDS/IDP IM/P2P Bandwidth Management User-aware Management High Availability Device HA VPN HA Multiple WANs for Load Balancing Auto Fail-over, Fail-back Dial Backup Authentication Method Local Database Radius LDAP Microsoft AD OTP Management WebGUI (HTTP and HTTPS) Command Line Vantage CNM Vantage Report Note: *1: Available In future firmware release P1 80 Mbps 30 Mbps 5 Mbps 1, xLAN 1xWAN 2 Plus 3, xLAN 1xWAN 2WG 3, x LAN/DMZ 1xWAN () 5 UTM 50 Mbps 25 Mbps 12 Mbps 4, x LAN/DMZ 1xWAN 35 UTM 60 Mbps 30 Mbps 14 Mbps 10, x LAN/DMZ 2xWAN Mbps 150 Mbps 100 Mbps 128,000 1, (125 *1 ) (5) 10/100/1000 GbE *1 SSL xLAN 1xWAN 20 21

12 22 23