Stonesoft Security Engine. Hardware Requirements for version 5.4

Transcription

1 Stonesoft Security Engine Hardware Requirements for version 5.4 Updated: December 17, 2012

2 Table of Contents System Requirements... 3 Stonesoft Appliances... 3 Certified Intel Platforms... 4 Basic Hardware Requirements... 4 Requirements for Virtual Node... 4 Example Hardware Configuration for 2 Gbps Security Engine... 5 Example Hardware Configuration for 10 Gbps Security Engine... 5 Licensing requirements... 5 Network Interface Cards... 5 Hardware driver versions... 6 NIC drivers... 6 SCSI Drivers... 7 Block Device Drivers Stonesoft Security Engine Hardware Requirements for Version 5.4

3 System Requirements These hardware requirements apply to version 5.4 of the Stonesoft Security Engine software in all roles (Firewall/VPN, IPS/IDS, and Layer 2 Firewall). Stonesoft Appliances At the time of release, this version of the Stonesoft Security Engine software is supported on the following Stonesoft appliances: FW-310 IPS-6000 FW-315 IPS-6100 FW-1030 IPS-6105 FW-1060 Stonesoft 1301 FW-1200e Stonesoft 1302 FW-5000 Stonesoft 3201 FW-5000L Stonesoft 3205 FW-5100 Stonesoft 3206 FW-5105 Stonesoft 5201 IPS-1030 Stonesoft 5205 IPS-1060 Stonesoft 5206 IPS-1205 Some features of this release are not available for all appliance models. See and for up-to-date appliance-specific software compatibility information. NOTE IPS-6105 with version 5.2 or later supports only 64-bit software versions. NOTE - Upgrading between 32-bit (i386) and 64-bit (x86-64) architecture software versions is not supported. Stonesoft appliances support only the software architecture version (32- bit or 64-bit) that they are pre-installed with. Changing the architecture for third-party hardware using software licenses require full re-installation using a CD-ROM. 3 Stonesoft Security Engine Hardware Requirements for Version 5.4

4 Certified Intel Platforms Stonesoft has certified specific Intel-based platforms for the Stonesoft Security Engine. The list of certified platforms can be found at We strongly recommend using certified hardware or a preinstalled Stonesoft appliance as the hardware solution for new Stonesoft Security Engine installations. If it is not possible to use a certified platform, the Stonesoft Security Engine can also run on standard Intel-based hardware that fulfills the Stonesoft Security Engine hardware requirements. Basic Hardware Requirements Intel Pentium 4 /Xeon processor -based hardware 16 GB IDE hard disk or SSD disk (IDE RAID controllers are not supported) and CD-ROM drive 1 GB RAM minimum (2 GB required if inspection-based features are used) for 32-bit (i386) installation 8 GB RAM minimum for 64-bit (x86-64) installation One or more certified network interfaces for the Firewall/VPN role (see Network Interface Cards on page 5) 2 or more certified network interfaces for IPS with IDS configuration 3 or more certified network interfaces for Inline IPS or Layer 2 Firewall VGA-compatible display and keyboard Requirements for Virtual Node VMware ESX Server versions 4.0 or 4.1, or ESXi versions 4.0, 4.1, or 5 8 GB virtual disk 1 GB RAM minimum (2 GB required if inspection-based features are used) A minimum of one virtual network interface for the Firewall/VPN role, three for IPS or Layer 2 Firewall roles The following limitations apply when Stonesoft Security Engine is run as a virtual node in the Firewall/VPN role: Only Packet Dispatching CVI mode is supported. Only Standby clustering mode is supported. Heartbeat requires a dedicated non-vlan-tagged interface. The following limitations apply when Stonesoft Security Engine is run as a virtual node in the IPS or Layer 2 Firewall role: Clustering is not supported. 4 Stonesoft Security Engine Hardware Requirements for Version 5.4

5 Recommended NIC driver to use in virtual appliances is vmxnet3. Example Hardware Configuration for 2 Gbps Security Engine Intel Core 2 Duo Processor, 2 Cores per CPU Intel Xeon E3-12xx-Family Processor, (if inspection-based features are used) 2 GB memory (8 GB required if inspection-based features are used) 2 or more certified network interfaces 16 GB IDE hard disk or SSD disk (IDE RAID controllers are not supported) CD-ROM drive, VGA-compatible display and keyboard 32-bit Security Engine software installation or 64-bit Security Engine software installation (if inspection-based features are used) Example Hardware Configuration for 10 Gbps Security Engine Two Intel Xeon 5500-Family Processor, 4 Cores per CPU Two Intel Xeon E5-26xx -Family Processor, 8 Cores per CPU (if inspection-based features are used) 8 GB memory (32 GB if inspection-based features are used) 2 or more certified network interfaces 32 GB IDE hard disk or SSD disk (IDE RAID controllers are not supported) CD-ROM drive, VGA-compatible display and keyboard 64-bit Security Engine software installation Licensing requirements Use of the 64-bit software version requires a license that supports the use of 64-bit software. As of version 5.4, the following types of licenses support 64-bit engine software: Software licenses for 10 Gbps or higher throughput Firewall/VPN or IPS CPU core-based Security Engine software licenses CPU core-based virtual Security Engine software licenses Network Interface Cards Stonesoft Security Engines support Ethernet, Fast Ethernet, Gigabit and 10 Gigabit Ethernet interfaces on the Intel platform. We strongly recommend using network interface cards that Stonesoft has certified. The list of certified normal network interface cards can be found at 5 Stonesoft Security Engine Hardware Requirements for Version 5.4

6 Hardware driver versions NIC drivers Network interface card (NIC) drivers and versions included in the kernel of Stonesoft Security Engine version are listed in the table below. Note that not all the drivers have been tested by Stonesoft. For a list of certified NICs, see Driver Version Description 3c59x.ko no version 3Com 3c59x/3c9xx Ethernet driver 8139cp.ko 1.3 RealTek RTL-8139C+ series 10/100 PCI Ethernet driver 8139too.ko sg RealTek RTL-8139 Fast Ethernet driver 8390.ko no version no description acenic.ko no version AceNIC/3C985/GA620 Gigabit Ethernet driver amd8111e.ko no version AMD8111 based 10/100 Ethernet Controller. Driver Version atl1e.ko NAPI Atheros 1000M Ethernet Network Driver atl1.ko Atheros L1 Gigabit Ethernet Driver b44.ko 2.0 Broadcom 44xx/47xx 10/100 PCI Ethernet driver bnx2.ko Broadcom NetXtreme II BCM5706/5708/5709/5716 Driver bnx2x.ko Broadcom NetXtreme II BCM57710/57711/57711E/57712/57712E Driver bpctl_mod.ko sg1 Silicom Bypass-SD Control driver cxgb.ko no version Chelsio 10Gb Ethernet Driver cxgb3.ko ko Chelsio T3 Network Driver cxgb4.ko ko Chelsio T4 Network Driver dl2k.ko no version D-Link DL2000-based Gigabit Ethernet Adapter e100.ko k2-NAPI Intel(R) PRO/100 Network Driver e1000_ik.ko k8-NAPI Intel(R) PRO/1000 Network Driver e1000bpe.ko silc.5.60-NAPI Intel(R) PRO/1000 Network Driver e1000bpx.ko silc NAPI Silicom PXBPI/PXTBI/PEBPI Network Driver e1000e.ko NAPI Intel(R) PRO/1000 Network Driver e1000e_ik.ko k2 Intel(R) PRO/1000 Network Driver e1000x.ko NAPI Intel(R) PRO/1000 Network Driver epic100.ko no version SMC 83c170 EPIC series Ethernet driver fealnx.ko no version Myson MTD-8xx 100/10M Ethernet PCI Adapter Driver forcedeth.ko no version Reverse Engineered nforce Ethernet driver hamachi.ko no version Packet Engines 'Hamachi' GNIC-II Gigabit Ethernet driver hp100.ko no version HP CASCADE Architecture Driver for 100VG-AnyLan Network Adapters igb.ko sg5+s1 Intel(R) Gigabit Ethernet Network Driver igb_ik.ko k2 Intel(R) Gigabit Ethernet Network Driver ipg.ko no version IC Plus IP1000 Gigabit Ethernet Adapter Linux Driver ixgb.ko k2-NAPI Intel(R) PRO/10GbE Network Driver ixgbe.ko sg9-NAPI Intel(R) 10 Gigabit PCI Express Network Driver ixgbe_ik.ko k2 Intel(R) 10 Gigabit PCI Express Network Driver mdio.ko no version Generic support for MDIO-compatible transceivers myri10ge.ko Myricom 10G driver (10GbE) natsemi.ko no version National Semiconductor DP8381x series PCI Ethernet driver 6 Stonesoft Security Engine Hardware Requirements for Version 5.4

7 ne2k-pci.ko no version PCI NE2000 clone driver netxen_nic.ko QLogic/NetXen (1/10) GbE Intelligent Ethernet Driver niu.ko 1.1 NIU Ethernet driver ns83820.ko no version National Semiconductor DP /100/1000 driver pcnet32.ko no version Driver for PCnet32 and PCnetPCI based ethercards qla3xxx.ko v k5 QLogic ISP3XXX Network Driver v k5 r6040.ko Feb2011 RDC R6040 NAPI PCI FastEthernet driver r8169.ko 2.3LK-NAPI RealTek RTL-8169 Gigabit Ethernet driver s2io.ko no description sc92031.ko no version Silan SC92031 PCI Fast Ethernet Adapter driver sis190.ko 1.4 SiS sis190/191 Gigabit Ethernet driver sis900.ko no version SiS 900 PCI Fast Ethernet driver skge.ko 1.13 SysKonnect Gigabit Ethernet driver sky2.ko 1.28 Marvell Yukon 2 Gigabit Ethernet driver slhc.ko no version no description starfire.ko 2.1 Adaptec Starfire Ethernet driver sundance.ko no version Sundance Alta Ethernet driver sungem.ko no version Sun GEM Gbit Ethernet driver sunhme.ko 3.10 Sun HappyMealEthernet(HME) 10/100baseT Ethernet driver tehuti.ko no version Tehuti Networks(R) Network Driver tg3.ko Broadcom Tigon3 Ethernet driver dmfe.ko Davicom DM910X fast Ethernet driver tulip.ko vlan-NAPI Digital 21*4* Tulip Ethernet driver uli526x.ko no version ULi M5261/M5263 fast Ethernet driver winbond-840.ko 1.01-e Winbond W89c840 Ethernet driver typhoon.ko 1.0 3Com Typhoon Family (3C990, 3CR990, and variants) uio-dma.ko 1.0 uio-dma kernel backend uio-ixgbe.ko 1.1.SG1 UIO-IXGBE kernel backend via-rhine.ko no version VIA Rhine PCI Fast Ethernet driver via-velocity.ko no version VIA Networking Velocity Family Gigabit Ethernet Adapter Driver virtio_net.ko no version Virtio network driver vmxnet.ko VMware Virtual Ethernet driver vmxnet3.ko k VMware vmxnet3 virtual NIC driver yellowfin.ko no version Packet Engines Yellowfin G-NIC Gigabit Ethernet driver SCSI Drivers SCSI drivers and versions included in the kernel of Stonesoft Security Engine version are listed in the table below. Note that not all the drivers listed have been tested by Stonesoft. Driver Version Description 3Ware 9xxx SATA_RAID [CONFIG_SCSI_3W_9XXX] ACARD AEC-6710/6712/67160 PCI Ultra/W/LVD SCSI ac [CONFIG_SCSI_ACARD] Adaptec / IBM ServeRAID [CONFIG_SCSI_IPS] Adaptec AACRAID [CONFIG_SCSI_AACRAID] Adaptec I2O RAID 2.4 Build 5go [CONFIG_SCSI_DPT_I2O] Adaptec SAS/SATA 3Gb/s [CONFIG_SCSI_AIC94X] Adaptec Ultra [CONFIG_SCSI_AIC7XXX] Adaptec Ultra [CONFIG_SCSI_AIC79XX] 7 Stonesoft Security Engine Hardware Requirements for Version 5.4

8 BusLogic MultiMaster and FlashPoint SCSI [CONFIG_SCSI_BUSLOGIC] Domex DMX3191D SCSI [CONFIG_SCSI_DMX3191D] Fusion MPT ScsiHost for FC/SPI/SAS [CONFIG_FUSION_FC/SPI/SAS] Initio INIA100 SCSI 1.02d [CONFIG_SCSI_INIA100] Intel PIIX/ICH PATA/SATA 2.13 [CONFIG_ATA_PIIX] LSI Logic MegaRAID (Legacy) [CONFIG_MEGARAID_LEGACY] LSI Logic MegaRAID (NEWGEN) [CONFIG_MEGARAID_NEWGEN] LSI Logic MegaRAID (SAS) rc1 [CONFIG_MEGARAID_SAS] NVIDIA nforce SATA 3.5 [CONFIG_SATA_NV] Pacific Digital ADMA 1.0 [CONFIG_PDC_ADMA] Promise SATA 0.12 [CONFIG_SATA_SX4] Promise SATA TX2/TX [CONFIG_SATA_PROMISE] QLogic IPS2x k [CONFIG_SCSI_QLA2XXX] QLogic ISP1240/1x80/1x160/1020/1040 SCSI [CONFIG_SCSI_QLOGIC_1280] ServerWorks / Apple K2 SATA 2.3 [CONFIG_SATA_SVW] Silicon Image 3124/3132 SATA 1.1 [CONFIG_SATA_SIL24] Silicon Image SATA 2.4 [CONFIG_SATA_SIL] Silicon Integrated Systems SATA 1.0 [CONFIG_SATA_SIS] Symbios/LSI logic 53C8XX/53C [CONFIG_SCSI_SYM53C8XX_2] Tekram DC390(T) PCI SCSI v2.05 [CONFIG_SCSI_DC390T] ULi Electronics SATA 1.3 [CONFIG_SATA_ULI] VIA SATA 2.6 [CONFIG_SATA_VIA] Vitesse VSC7174 SATA 2.3 [CONFIG_SATA_VITESSE] Vortex GDT Disk Array / Intel Storage RAID 3.05 [CONFIG_SCSI_GDTH] Block Device Drivers Block device driver versions included in the new kernel of Stonesoft Security Engine version are listed in the table below (updated drivers in boldface). Note that not all the drivers listed have been tested by Stonesoft. Device Version 3ware Storage controller AMD / NS 5535 IDE 09/20/2005 CMD-Technologies CMD640 IDE 1.02 CMD-Technologies CMD64x IDE Compaq Smart Array 5xxx Compaq SMART2 Array Cyrix / NS 5530 IDE Highpoint 366 IDE Intel PIIX IDE ITE 8211 IDE/8212 IDE RAID Mylec DAC960 / AcceleRAID / extremeraid PCI RAID RZ1000 IDE Serverworks OSB4 / CSB5 / CSB6 Silicon Image SiL IDE 8 Stonesoft Security Engine Hardware Requirements for Version 5.4

9 Copyright and Disclaimer Stonesoft Corporation. All rights reserved. These materials, Stonesoft products, and related documentation are protected by copyright and other laws, international treaties and conventions. All rights, title and interest in the materials, Stonesoft products and related documentation shall remain with Stonesoft and its licensors. All registered or unregistered trademarks in these materials are the sole property of their respective owners. No part of this document or related Stonesoft products may be reproduced in any form, or by any means without written authorization of Stonesoft Corporation. Stonesoft provides these materials for informational purposes only. They are subject to change without notice and do not represent a commitment on the part of Stonesoft. Stonesoft assumes no liability for any errors or inaccuracies that may appear in these materials or for incompatibility between different hardware components, required BIOS settings, NIC drivers, or any NIC configuration issues. Use these materials at your own risk. Stonesoft does not warrant or endorse any third party products described herein. THESE MATERIALS ARE PROVIDED "AS-IS." STONESOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO, THE INFORMATION CONTAINED HEREIN. IN ADDITION, STONESOFT MAKES NO EXPRESS OR IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR USE WITH RESPECT THE INFORMATION CONTAINED IN THESE MATERIALS. IN NO EVENT SHALL STONESOFT BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL OR INCIDENTAL DAMAGES, INCLUDING, BUT NOT LIMITED TO, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING FROM THE USE OF THESE MATERIALS, EVEN IF ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH DAMAGES. Trademarks and Patents Stonesoft, the Stonesoft logo and StoneGate are all trademarks or registered trademarks of Stonesoft Corporation. Multi-Link technology, Multi-Link VPN, and the Stonesoft clustering technology-as well as other technologies included in Stonesoft-are protected by patents or pending patent applications in the U.S. and other countries. All other trademarks or registered trademarks are property of their respective owners. Stonesoft Corporation Itälahdenkatu 22A FI Helsinki Finland Tel Fax Stonesoft Inc Crown Pointe Parkway Suite 900 Atlanta, GA USA Tel Fax Copyright 2012 Stonesoft Corporation. All rights reserved. All specifications are subject to change.