SonicWALL Team Nordic Recommendations for safe Unified Threat Management (UTM) Deployments*

Transcription

1 SonicWALL Team Nordic Recommendations for safe Unified Threat Management () Deployments* tel: TZ100/100W 01-SSC SSC SSC-8723 $470/$536W 128Mb RAM 5FE Home and Enhance OS PortShield configurable IPSec and SSL-VPN b/g/n wireless model TZ200/200W 01-SSC SSC SSC-8715 $784/$952W 5FE+1USB Retail and USB for 3G/ Modem HA Active/ Passive (no statesync) Dynamic Routing TZ210/210W 01-SSC SSC SSC-8773 $1076/$1293W 2GbE+5FE+ Retail and USB for 3G/ Modem HA Active/ Passive (no statesync) Dynamic Routing Application Firewall NSA SSC-8760 $1,914 3GbE+6FE+ Provides 3 GbE, 6 FE, WWAN (3G/ Modem) PortShield NSA SSC-7035 $3,991 6GbE+ Provides 6 10/100/1000 WAN/WAN failover, LAN and DMZ NSA 2400MX 01-SSC-8854 $4,748 10GbE+16FE +2Module Slots+ Provides 6 10/100/1000 WAN/WAN failover, LAN and DMZ NSA SSC-7033 $5,721 4-Core CPU 6GbE+ 4-Core design provides a 60% increase in Gigabit level firewall Increase in Application Firewall policies NSA SSC-7032 $8,317 8-Core CPU 6GbE+ 8-Core design provides a 150% increase in Includes Availability for increased network reliability Increase in VPN NSA E SSC-7029 $15, SSC Core CPU 1Gb RAM 8GbE+1HA+ 8 10/100/1000 high speed connectivity to WAN, LAN and DMZ Dedicated interface for Availability LCD information center Dedicated 3 rd level Active/Active NSA E SSC-7028 $26, SSC Gb RAM 8GbE+1HA+ 16-Core design provides 75% increase in Dedicated interface for Availability LCD information center Dedicated 3 rd level Active/Active NSA E SSC-7027 $46, SSC Gb RAM 4GbE + 4SFP+ 1HA+ NSA appliance providing Gigabit level 4GbE + 4SFP interfaces provide fiber and copper interface options Hot swappable power supplies/ fans Dedicated 3 rd level Active/Active 5 Mbps 15 Mbps 40 Mbps 75 Mbps 100 Mbps 500 Mbps 1 Gbps + 5 Users 10 Users 25 Users 50 Users 125 Users 250 Users 700 Users 1000 Users 2000 Users NSA E SSC-8866 (HW+GAV/IPS Services) $54, SSC- 2Gb RAM 4GbE + 4SFP+ 1HA+ NSA appliance providing 2 Gigabit level 4GbE + 4SFP interfaces provide fiber and copper interface options Hot swappable power supplies/ fans Dedicated 3 rd level Active/Active *Above numbers are recommended by SonicWALL Team Nordic for safe Full s, with security services enabled, such as GAV/IPS/CFS and App Int. Higher throughput is possible and will vary depending on network conditions, concurrent connections, optimization, Active/Active on in HA. For Maximum throughput please have a look at the datasheets at All above SonicWALL Firewalls are unlimited node. To contact SonicWALL Nordic use [email protected]

2 FirewallServicesGuide TheServices GatewayAnti6Virus,Anti6SpywareandIntrusionPreventionService(GAV): TheGAVserviceiscomprisedofthreefeatures Gateway'Anti+Virus'&'Anti+Spyware'Inspection' This will protect your network by scanning all traffic (both inbound and outbound) over multiple protocols including , FTP, Instant Messaging (IM), peerdtodpeer (P2P), file sharing and games for s. This is done by leveraging the patented SonicWALL Reassembly Free Deep Packet Inspection Engine (RFDPI). The RFDPI engine allows the appliancestoscanandanalyseinrealtimedregardlessoffilesizeandcompressiontype.it willprotectagainstdaydzeroattacksusingourdynamicallyupdatedcloudbaseddatabases. Bottom%Line:%%Keeps%Viruses%and%Spyware%out%of%the%network.% Intrusion'Prevention'(IPS/IDS)' Vulnerabilities,exploitswithinapplicationsalongwithblendedscanallowawayfor malicious intruders to access your network and sensitive data. Intrusion Protection is a necessary technology because of this. SonicWALL takes this beyond just scanning all network traffic for known s (such as worms, Trojans, software vulnerabilities, backdoor exploits) by utilising SonicWALL s comprehensive signature databases and next generationipsengine.thisallowstheappliancetobedeployedtoprotectawiderangeof network attacks and vulnerably for both internal and external s. Threats can be loggedautomaticallyandtheadministratoralertedrightaway. Bottom%Line:Protects%against%attacks%and%vulnerabilities. Application'Intelligence,'Control'&'Visualisation'(includes'Application'Firewall)' This feature is a true hallmark of a next generation firewall.application Intelligence & ControlallowsfortruerealDtimevisibilityofapplicationuseonthenetworkandthetoolsto controlandmanageit.onceagainleveragingtherfdienginethesonicwallfirewallisable to use this to identify streams of traffic and applications regardless of what port is being used. As such the administrator is able to enforce policy and control even on port agile applications.theadministratorcaneasilyidentifyanapplicationandwhoisusingit for examplemsnmessenger andblockit.alternatelytheapplicationcanbecontrolledeither by bandwidth management or by disabling features such as stopping video chat but allowingtextchat.thispolicycanbeappliedtoindividualusersortogroups. Bottom%Line:%%See%what%is%happening%in%the%network%in%real%time%and%take%control.%

3 ContentFilteringService(CFS): ContentFiltering: Withthecontentfilteringserviceitissimpletoenforcepolicytostoppeoplefromviewing certain web content. This can be for productivity reasons should employees be web browsingratherthanworking.oralternativelyitcanbeforprotectionaseverycompany andinstitutionhasalegaldutyofcaretopreventtheiremployeesfromseeingobjectionable content. CFS allows for flexible solution which is easily deployed. Policy can be set for individualsorgroupsandcanbescheduledwithdifferentlevelsofaccessatdifferenttimes oftheday.forexample onlyallowingemployeesaccesstosocialnetworkingsitesduring theirlunchbreaks.whenpairedwiththegavserviceitispossibletoseewhoisbrowsing whatsitesandtorespondwithsuitableenforcementrightaway. Bottom%Line:%%Increase%work%place%productivity,%improve%network%%and%protect% employees. DynamicServices(8x5and): Note: If has run out then a multidyear renewal must be purchased as 1 year renewalsarebackdatedtobevalidfromdateofexpiryinsteadofdateofactivationformultiyear. Dynamicismultifacetedandcoversawiderangeoveraspects.Theseaspectsbreakdown intothreedistinctservices: Technical''(8x5'and')' The Technical aspect offers various avenues to contact SonicWALL Engineers.Theycanbereachedbytollfreetelephoneandinternationaltelephone, andthroughwww.mysonicwall.combyraisingacase.thehoursofresponsewill correspondtothetypeofthecustomerhas:8x5dbusinesshoursmonday tofriday, 24hoursaday7daysaweek. Software'&'Firmware'Updates' This segment of allows the customer to keep their SonicWALL appliances and software up to date with the latest firmware and software updates. Updates can be as minorasbugfixesorasmajorasaddingtoandexpandingfunctionalityofthesonicwall product. Advanced'Hardware'Replacement' If the appliance fails and new hardware is required SonicWALL will send out replacement hardwarefornextbusinessday.oncethereplacementapplianceiswiththecustomerthe customercanthenreturntheirfaultyappliancetosonicwall.sonicwallwillnotrequest thatthecustomersendtheirfaultyappliancebeforeissuingthereplacement. Bottom% Line:% Keep% your% appliance% running% smoothly;% add% new% features% and% minimise% downtime%in%case%of%failure.% The above three services (GAV, CFS and ) can be purchased separately. However if the customer is planning on purchasing two or more of these services it is considerably cheaper to purchasethemasbundle.thisbundleiscalledthecomprehensive%gateway%security%suite%(cgss).'

4 PerpetualLicences AswellasrenewableservicesonSonicWALLproductstherearealsoperpetuallicences.Thesearea onetimepurchasethatpermanentlyaddsafeaturetothesonicwallapplianceor,insomecases, includedwiththeapplianceforfree. DPISSL ThisfeatureallowspolicytobeenforcementbyApplicationFirewallandCFSoverSSL.This stopspeopleusingproxysitestoavoidcontentfiltering. Bottom%Line:%Stop%people%circumnavigating%content%filtering%policy.% SSLVPN SSLVPNallowsforremoteuserstoconnectsecurelytolocalresourcesbyusingeitherthe NetExtenderclientorawebpagebasedgateway. Bottom%Line:%%Easy%reliable%access%for%remote%users.% IPv6Ready BGP WiththeIPv6readyfeaturetheSonicWALLappliancecanconnecttoIPv6. Bottom%Line:%Global%IP%v4%address%distribution%has%finished.%%IP%v6%will%be%a%must%have.% Apopularinternetroutingprotocol.Withthislicensetheappliancewillbeabletoroute usingbgp. Bottom%Line:%For%companies%that%use%BGP%this%is%important.% NetflowReporting TheNetflowreportingsoftwareallowsfordetailedreportingtobedoneonalltrafficthat passes through the SonicWALL appliance including web browsing and application usage. Thiscanbeusedforhistoricalreporting. Bottom%Line:%Detailed,%realLtime%and%historical,%reporting%on%all%traffic%usage.%%See%who%is% playing%games%and%browsing%the%web.% StatefulHighAvailability(HA) WhenstatelessHAisn tenoughthereisstatefulha.statelesshawilldropallconnections andreopenthem resultinginafewsecondsofdowntime.howeverwithstatefulhaeven whentheprimaryapplianceinanhapairfailsthereisnooutage.allmajorconnections suchassitetositevpnsandftpremainupwithzerodowntime. Bottom%Line:%%When%down%time%is%not%an%option %this%is%the%only%option.%

5 FEATURE GEN4 GEN5 TZ150 TZ170 TZ180 TZ190 TZ100 TZ200 TZ210 RealtimeApplicationVisibilityandControl " ApplicationFirewall " DPISSL SSLVPN ComprehensiveAntiSpamService " " " IPv6Ready BGP # GatewayAntiVirus " " " " " " " ContentFilteringSystem " " " " " " " Dynamic " " " " " " " SonicPointDualRadio/Ne/Ni* WXA* NetFlowReporting # # # StatefulHighAvailability LEGEND Noted edforfree " edwithsubscription # edwithperpetuallicense * RequiresAdditionalAppliance PRO1260 PRO2040 PRO3060 GEN4 PRO4060 PRO4100 PRO5060 Gen5 FEATURE RealtimeApplication VisibilityandControl " " " " " " " " " " ApplicationFirewall " " " " " " " " " " DPISSL # # # # # # # # SSLVPN ComprehensiveAntiSpam Service " " " " " " " " " " " IPv6Ready NSA240 NSA2400 NSA2400MX BGP # # # # # # # # # # # GatewayAntiVirus " " " " " " " " " " " " " " " " " ContentFilteringSystem " " " " " " " " " " " " " " " " " Dynamic " " " " " " " " " " " " " " " " " SonicPointDualRadio/Ne /Ni* WXA* # # # # # # # # # # # NetFlowReporting # # # # # # # # # # StatefulHighAvailability # # # # # # *AppIntonNSA2400MXisnotyetavailable. NSA3500 NSA4500 NSA5000 NSAE5500 NSAE6500 NSAE7500 NSAE8500 NSAE8510