R&S SITGate Next-Generation Firewall Secure access to Internet and cloud services

Transcription

1 Secure Communications Product Brochure R&S SITGate Next-Generation Firewall Secure access to Internet and cloud services

2 R&S SITGate Next-Generation Firewall At a glance The R&S SITGate is a multifunctional, nextgeneration firewall that uses the latest technology for analyzing data traffic at very high speed. The firewall blocks hazardous or unauthorized use and warns of attacks and abuse. The R&S SITGate is a next-generation firewall featuring advanced single-pass technology. The innovative deep packet inspection of incoming and outgoing network traffic protects against current and future threats, without neglecting rising performance requirements. This is made possible by running the decoded data stream through a series of security checks that are bundled on multiple levels. Current IT threats are not only highly complex they change practically every day. The emergence of layer-7 malware and rapidly transforming threats render most conventional network security solutions useless. It is no longer possible to protect networks effectively with conventional IP and port-based firewalls. Simple intrusion prevention systems can no longer keep pace with the technical development of evasive malware, which is sometimes hidden deep within legitimate layer-7 applications. Today's business processes require a variety of applications that often have to communicate with business sites and mobile users that are very far away. Modern Web 2.0 applications increase customer proximity and the productivity of many companies, but also provide attack vectors for malware. Among other things, this can interfere with staff productivity. Key facts Next-generation firewall with deep packet inspection, intrusion prevention and malware protection Context-based protocol analysis for uncovering threats posed by botnets, Web 2.0 applications and zero-day attacks Complete TCP re-assembly even detects hidden attacks on encrypted connections Powerful VPN concentrator for secure connection of external sites and mobile users Seamless integration in Active Directory and LDAP makes it possible to create user-specific rules R&S SITGate L500. R&S SITGate M Series. 2

3 R&S SITGate Next-Generation Firewall Benefits and key features Maximum security despite growing threats More secure than stateful firewall and more effective than unified threat management Comprehensive application detection and continuous protocol validation, even for encrypted connections Powerful malware protection Intrusion prevention system (IPS) with daily updates page 4 Simple implementation of security guidelines in existing infrastructures Seamless integration into Active Directory and LDAP directories Precise application of organizational guidelines for stringent Internet access Secure integration of remote locations, mobile users and cloud services page 5 Advanced single-pass technology made in Germany Content-based and context-specific screening of each connection Decoding of all major application protocols Data leakage prevention IT security made in Germany page 6 R&S SITGate S Series. Abbreviations AV IP IPS HTTPS Gbit/s LDAP Mbit/s SSL TCP TLS UDP UTM VPN Antivirus Internet protocol Intrusion prevention system Hypertext transport protocol secure Gigabit per second Lightweight directory access protocol Megabit per second Secure sockets layer Transmission control protocol Transport layer security User datagram protocol Unified threat management Virtual private network Rohde & Schwarz R&S SITGate Next-Generation Firewall 3

4 Maximum security despite growing threats More secure than stateful firewall and more effective than unified threat management The idea of the next-generation firewall incorporates all UTM technologies to create a unified and consistent screening method on all levels. This minimizes the danger of conflicting configurations and unknown threats. The various compatible screening methods simplify administrative tasks and increase network throughput. Comprehensive application detection and continuous protocol validation, even for encrypted connections The application detection feature implemented in the R&S SITGate analyzes network traffic and detects hundreds of network applications with the greatest possible accuracy and maximum throughput rate. Even applications such as BitTorrent and Skype, which communicate via encrypted connections, are detected and can be allowed or blocked. The various communications protocols undergo constant validation. Connections showing protocol violations are blocked immediately. The R&S SITGate is therefore also able to protect against potential attacks that exploit zero-day security gaps. Powerful malware protection Downloaded documents and files are constantly screened for malware using protection based on Bitdefender antimalware technology. The screening is already performed in the data stream, so there are no file size restrictions. Intrusion prevention system (IPS) with daily updates The R&S SITGate currently has a database containing over 9000 decoder-based IPS signatures that are updated on a daily basis. The R&S SITGate protects against current and future threats. 4

5 Simple implementation of security guidelines in existing infrastructures Seamless integration into Active Directory and LDAP directories External and internal users are identified by their IP addresses. For the sake of simplicity, security guidelines can be implemented by specifying user names or groups, since the R&S SITGate accesses internal directories such as Active Directory or other LDAP-compatible directory services. Precise application of organizational guidelines for stringent Internet access The web filter integrated in the R&S SITGate contains millions of well-known and categorized websites. Access to these sites is controlled by the user name or group membership. The R&S SITGate provides a port-based and IP-based stateful firewall, which is complemented by comprehensive application detection. This allows security guidelines to be implemented in a highly detailed way for each user or group. (Example: Marketing department may view but not post to Twitter. ) Whitelisting and blacklisting are also supported. Secure integration of remote locations, mobile users and cloud services The R&S SITGate terminates incoming VPN connections. The resulting data traffic is treated as a separate security zone, which allows other security guidelines to be applied. Secure TLS/SSL connections such as HTTPS can be analyzed even though they are encrypted. This exposes potential threats or even unauthorized data leaks that exploit encrypted connections. Security guidelines can be adapted for specific applications in a highly granular fashion. R&S SITGate reporting feature. Rohde & Schwarz R&S SITGate Next-Generation Firewall 5

6 Advanced singlepass technology made in Germany Content-based and context-specific screening of each connection The R&S SITGate is built with future-oriented singlepass technology that runs network traffic through several security checks which screen both the content and the context of the connection. Single-pass technology has been implemented in the R&S SITGate with a high degree of parallelism. The maximum configuration can process several million connections simultaneously. Data leakage prevention The R&S SITGate provides maximum protection against unwanted data leaks because it is able to block the entire flow of network traffic and connections originating from unknown activities. IT security made in Germany For more than 20 years, the name Rohde & Schwarz SIT GmbH has been synonymous with encryption and IT security. The company is the security partner of the Federal Republic of Germany and provides its customers around the world with innovative solutions for protecting their information and telecommunications equipment. Decoding of all major application protocols Single-pass technology uses the most advanced deep packet inspection method, which detects hundreds of applications and can decode a great variety of different protocols. The connection can be examined closely for all important applications. Traffic is screened rigorously for malware and undesirable content. The protocol decoders make it possible to forgo complex sets of rules and excessive use of regular expressions. This results in better performance and greater transparency for administrative tasks. False positives and false negatives are minimized. Single-pass checks data traffic on various levels in near realtime speed Web filter Data flow 6

7 Specifications in brief Specifications in brief R&S SITGate S series M series L series Dimensions (W H D) S100 M200 M400 L500 L mm 44 mm 320 mm (1 HU) (16.8 in 1.7 in 12.6 in) 430 mm 44 mm 437 mm (1 HU) (17.0 in 1.7 in 17.2 in) 430 mm 80 mm 548 mm (2 HU) (17.0 in 3.1 in 21.6 in) Ethernet ports 6 1 Gigabit Ethernet 9 1 Gigabit Ethernet 9 1 Gigabit Ethernet 16 1 Gigabit Ethernet 12 1 Gigabit Ethernet, 2 10 Gigabit Ethernet For local management configurable configurable and WAN/uplink Recommended users up to to to to to Firewall throughput 1) 180 Mbit/s 1.5 Gbit/s 3 Gbit/s 6 Gbit/s 8 Gbit/s UTM throughput 2) 150 Mbit/s 500 Mbit/s 1 Gbit/s 2 Gbit/s 3 Gbit/s VPN throughput 30 Mbit/s 100 Mbit/s Mbit/s 600 Mbit/s Simultaneous connections New connections /s /s /s /s /s VPN users Zones Management intuitive, easy-to-use web browser configuration (AJAX), wizards for quick startup; adaptable widgets simplify individual administrative tasks 1) Large UDP packets, firewall only. 2) Real traffic (benchmark), IPS, AV, web filter enabled. Ordering information Designation Type Order No. S Series Base unit, 6 1 Gigabit Ethernet R&S SITGate S100 Base Unit Full protection one year R&S SITGate S100 FP1Y Full protection three years R&S SITGate S100 FP3Y M Series Base unit, 9 1 Gigabit Ethernet R&S SITGate M200 Base Unit Full protection one year R&S SITGate M200 FP1Y Full protection three years R&S SITGate M200 FP3Y Base unit, 9 1 Gigabit Ethernet R&S SITGate M400 Base Unit Full protection one year R&S SITGate M400 FP1Y Full protection three years R&S SITGate M400 FP3Y L Series Base unit, 16 1 Gigabit Ethernet R&S SITGate L500 Base Unit Full protection one year R&S SITGate L500 FP1Y Full protection three years R&S SITGate L500 FP3Y Base unit, 12 1, 2 10 Gigabit Ethernet R&S SITGate L800 Base Unit Full protection one year R&S SITGate L800 FP1Y Full protection three years R&S SITGate L800 FP3Y Rohde & Schwarz R&S SITGate Next-Generation Firewall 7

8 Service you can rely on J Worldwide J Local and personalized J Customized and flexible J Uncompromising quality J Long-term dependability About Rohde & Schwarz Rohde & Schwarz is an independent group of companies specializing in electronics. It is a leading supplier of solutions in the fields of test and measurement, broadcasting, radiomonitoring and radiolocation, as well as secure communications. Established more than 75 years ago, Rohde & Schwarz has a global presence and a dedicated service network in over 70 countries. Company headquarters are in Munich, Germany. Environmental commitment Energy-efficient products Continuous improvement in environmental sustainability Certified Quality System ISO 9001 Rohde & Schwarz SIT GmbH Am Studio 3 D Berlin Phone Fax info.sit@rohde-schwarz.com Rohde & Schwarz GmbH & Co. KG Regional contact Europe, Africa, Middle East customersupport@rohde-schwarz.com North America TEST RSA ( ) customer.support@rsa.rohde-schwarz.com Latin America customersupport.la@rohde-schwarz.com Asia/Pacific customersupport.asia@rohde-schwarz.com China / customersupport.china@rohde-schwarz.com R&S is a registered trademark of Rohde & Schwarz GmbH & Co. KG Trade names are trademarks of the owners Printed in Germany (ch) PD Version August 2012 R&S SITGate Data without tolerance limits is not binding Subject to change 2012 Rohde & Schwarz GmbH & Co. KG München, Germany