H3C SecPath M9000-X Firewall

High-performance hardware and software processing platform

Adopting a fully distributed architecture that separates control, business, and data, the hardware of the control engine, switching engine, business engine, and interface unit is separated, decoupling the key components of the system, and improving system reliability; the independent hardware switching engine supports high-performance security Business non-blocking processing and forwarding

Independent high-performance control engine to realize unified system configuration management and secure cluster

The security service engine adopts the latest multi-core high-performance processor, and the high-speed processing security service performance of a single board is the highest in the industry; a hardware board can simultaneously provide L2 - L7 comprehensive security defense, including firewall, NAT , LB , IPS , AV, ACG , VPN , etc.;

The built-in modular software system supports multi-process scheduling, and the running space between processes is isolated . The abnormality of a single process will not affect other parts of the system , which improves system reliability ; supports authority management functions, based on features, command lines, system resources, and WEB management Equal levels define user read and write permissions, improve system security; support hot patch, support ISSU , realize system upgrade without interrupting business, and improve system usability

Carrier-grade equipment with high reliability

Adopt the software and hardware platform with independent intellectual property rights owned by H3C. Product applications have gone through years of market tests from large and medium-sized enterprise users to major telecom operators

Support RBM (remote hot backup technology) 1:1 hot backup function, support Active/Active and Active/Passive and other working modes, realize load sharing and business backup

Powerful security protection features

Supports rich attack defense functions including: Land , Smurf , UDP Snork attack, UDP Chargen DoS attack (Fraggle), Large ICMP Traffic , Ping of Death , Tiny Fragment , Tear Drop , IP Spoofing , IP fragmentation packets, ARP spoofing, ARP active reverse query, TCP packet flag bit illegal, oversized ICMP packets, address scanning, port scanning and other attack defenses, including SYN Flood , Detection and defense of common DDoS attacks such as UPD Flood , ICMP Flood , DNS Flood, and CC .

Supports unified management The host + multi-service engine is always managed as a network element in a unified manner, and there is no need to plan the IP address of each card, which saves the user's IP address and greatly reduces the complexity of deployment, and can realize comprehensive management of the equipment. Configuration management, performance monitoring and log auditing.

Support intelligent flow distribution (IFF) After deploying multi-service cards, traffic is automatically load-shared among multiple service cards to achieve distributed processing.

divide security zones based on interfaces and VLANs

Supports packet filtering By using standard or extended access control rules between security zones, data packets can be filtered with the help of information such as UDP or TCP ports in the message, and it supports filtering according to time periods

Supports authentication, authorization and accounting ( AAA ) services including: authentication based on RADIUS/HWTACACS+ / LDAP(AD) , CHAP , PAP , etc.

Support static and dynamic blacklist

Support static NAT, source address NAT, destination address NAT

Support static and dynamic carrier CGN NAT

Support P2P traversal technologies such as Fullcone and Hairpin

Support VPN functions include: support L2TP, manual/automatic IPSec , GRE , MPLS VPN, etc.

Support rich routing protocols Support IPv4, IPv6 static routing, equal-cost routing, policy routing, and dynamic IPv4 routing protocols such as BGP, RIPv2, OSPF , ISIS, etc., support dynamic IPv6 routing protocols such as BGP4+ , OSPFv3 , ISISV6

Support security log Support operation log, inter-domain policy matching log, attack defense log; support DS-LITE log; support NAT444 log, support telecom, China Unicom, mobile format;

Support traffic monitoring statistics and management.

Flexible and scalable integrated deep security

The in-depth WEB security protection is not limited to the conventional IPS/AV protection. It provides detailed web application protection for intranet servers. For the most troublesome CC attacks on servers, abnormal outreach, SQL injection, HTTP slow attacks, cross- Common attacks such as website scripts, content detection and verification of various requests from web application clients to ensure their security and legality, real-time blocking of illegal requests, and effective protection of various websites.

Unknown threat detection relying solely on feature analysis is no longer sufficient to deal with complex network environments. In the face of typical APT (Advanced Persistent Threat, advanced persistent threat) attack sandbox technology is one of the most effective methods to defend against APT attacks. It is used to construct Isolated threat detection environment. The H3C firewall sends network traffic to the sandbox for isolation and analysis, and the sandbox draws a conclusion on whether there is a threat. If a traffic is detected as malicious, the device will block the traffic.

Terminal identification, shared management Terminal identification is an important prerequisite for establishing a secure connection to the Internet of Things, and is used to identify terminals in the Internet of Things. When terminal traffic flows through the device, the H3C firewall can analyze and extract terminal information, such as the manufacturer and model of the terminal, and supports sending The user sends the log, prompting the user. At the same time, the application detection method and IPID detection method are used to identify and manage the behavior of sharing the Internet through NAT technology or proxy technology.

Server abnormal outreach detection Server outreach protection is a protection mechanism for intranet servers, which can effectively identify active outreach behaviors of servers, formulate corresponding outreach protection strategies to identify abnormal messages, and output alarm information for management staff for further processing. It provides a basis for the administrator to check the server, thereby preventing the server from becoming a part of the botnet, launching external attacks or infiltrating internally.

The high-precision and high-efficiency intrusion detection engine adopts the FIRST (Full Inspection with Rigorous State Test, comprehensive detection based on accurate state) engine with independent intellectual property rights of H3C. The FIRST engine integrates a number of detection technologies, realizes comprehensive detection based on accurate status, and has extremely high intrusion detection accuracy; at the same time, the FIRST engine adopts parallel detection technology, and the software and hardware can be flexibly adapted, which greatly improves the performance of intrusion detection. efficiency.

Real-time virus protection flow engine virus checking technology, so as to quickly and accurately kill viruses and other malicious codes in network traffic .

Comprehensive and timely security signature database Through years of operation and accumulation, H3C has a senior attack signature database team in the industry, and is equipped with a professional attack and defense laboratory to keep up with the latest developments in the field of network security, thereby ensuring timely and accurate update of the signature database .

Industry-leading IPv6 features

Support IPv6 basic protocols Support TCP6, UDP6, RAWIP6, ICMPV6, PPPoEv6, DHCPV6 Server, DHCPv6 Client, DHCPV6 Relay, DNSv6, RADIUS6 and other protocols; support IPv6 routing protocols. Support static routing, BGP4+ \O SPFv3 \ ISISV6 routing policy and policy routing; support IPv6 ASPF.

Support IPV6 attack defense. Support IPv6 Multicast.

Various IPv6 transition technologies are supported, including NAT-PT, IPv6 Over IPv4 GRE tunnel, manual tunnel, 6to4 tunnel, IPv4 compatible IPv6 automatic tunnel, ISATAP tunnel, NAT444, DS-Lite, etc.

Next-generation multi-service features

Integrated link load balancing feature, through link status detection, link busy protection and other technologies, effectively realize multi-link automatic balancing and automatic switching of enterprise Internet egress.

Integrate SSL VPN features to meet the security access requirements of mobile office and employee business trips. It can not only combine USB-Key and SMS for mobile user identity authentication, but also combine with the original authentication system of the enterprise to realize an integrated authentication interface. enter.

DLP basic function support, support email filtering, provide SMTP email address, title, attachment and content filtering; support web page filtering, provide HTTP URL and content filtering; support file filtering of network transmission protocols; support application layer filtering, provide Java / ActiveX Blocking and SQL injection attack prevention.

Professional intelligent management

Self-inspection operation and maintenance, policy risk tuning Through redundancy and hit analysis of security policies, redundant and missing security policies are identified to help administrators conduct in-depth analysis and processing of security policies on devices. At the same time, the application layer detection engine intelligently analyzes the potential risks in the traffic allowed by the security policy, and conducts an overall assessment of the safety factor of all security policies in the device.

Supports standard network management SNMPv3, and is compatible with SNMP v1 and v2. Device management and security service configuration can be performed through the command line interface, meeting the needs of professional management and mass configuration

Support packet capture based on interface and IP. Generate the captured packets with a .cap suffix file that can be recognized by Wireshark (a network packet analysis software), and save them to the local or external server for users to analyze and diagnose the traffic entering and exiting the device.

Support the packet loss statistics function to analyze and record the detailed reasons for discarding packets in the forwarding process of the device and security business modules (such as: attack defense, session management, and connection limit, etc.)

Support webpage diagnosis function When the intranet user accesses the webpage and there is a failure, the basic diagnosis of the network is carried out, and the cause of the failure is given.

Support message trace function Support real flow, import message, construct message, etc., used to analyze and track each security business module in the device (such as: attack defense, uRPF, session management and connection limit, etc.) By viewing the detailed information of the packet trace records, it is helpful for the administrator to quickly troubleshoot and locate network faults.

Graphical interface, providing easy-to-use web management

Through H3C's self-developed management system, unified management is realized, which integrates functions such as security information and event collection, analysis, and response, and solves the problems of isolation of network and security devices, unintuitive network security status, slow response to security incidents, and difficulties in network fault location and other issues, so that IT and security administrators can get rid of tedious management work, can concentrate on core business, and greatly improve work efficiency

normalizes logs in different formats ( Syslog , binary flow logs, etc.). At the same time, high aggregation compression technology is used to store massive events, and log files can be automatically compressed, encrypted and saved to external storage systems such as DAS , NAS or SAN to avoid loss of important security events

Provides rich reports, mainly including application-based reports, network flow-based analysis reports, etc.

through the web interface, and the customized content includes the time range of the data, the source device of the data, the generation cycle and the output type, etc.