User Guide

T E C H N I C A L S P E C I F I C A T I O N S
Services Supported
•
Bootp, http, irc, netstat, pop3, SNMP, tftp, pptp,
dns, https, kerberos, nntp, rip, ssh, who, RADIUS,
eigrp, ident, LDAP, ntp, rip2, syslog, shell, X11,
exec, gmp, login, OSPF, rlogin, telnet, talk, H.323,
SIP, ftp, imap, mbone, ping, rsh, traceroute, lotus
notes, VoIP/SIP, Gopher, IPSec, netbios, pointcast,
mtp, sql*net
• Any IP protocol (user definable)
•
Any IP protocol + layer 4 ports (user definable)
•
Support for non-IP protocols as defined by
S
AP/Ethertype
Layer-7 Application Support
• Application Filter architecture supports layer-7
protocol inspection (deep packet inspection) for
c
ommand and protocol validation, protocol a
n
omaly detection, dynamic channel pinholes and
a
pplication layer address translation. Application
filters include http, ftp, RPC, tftp, H.323/H.323
RAS, SMTP, Oracle SQL*Net, NetBIOS, ESP, DHCP
Relay, DNS, GTP, and SIP
Firewall Attack Detection
and Protection
• Generalized Day 0 anomaly-based flood
protection with patent-pending Intelligent Cache
Management Protections
• SYN flood protection to specifically protect
inbound servers, e.g. Web servers, from inbound
TCP SYN floods
• Strict TCP validation to ensure TCP session state
enforcement, validation of sequence and ac
knowledgement numbers,
• Rejection of bad TCP flag combinations
• Initial Sequence Number (ISN) rewriting for weak
TCP stack implementations
• Fragment flood protection with robust
fragment reassembly, ensures no partial
or overlapping fragments are transmitted
• Generalized IP packet validation including
detection of malformed packets
• DoS mitigations for over 190 DoS attacks,
including ping of death, land attack, tear drop
attack, etc.
• Drops bad IP options as well as source route
options
• Connection rate limits to minimize effects of new
attacks.
QoS/Bandwidth Management
•
Classified by physical port, virtual firewall,
firewall rule, session bandwidth guarantees – Into
and out of virtual firewall, allocated in bits/second
•
Bandwidth limits - Into and out of virtual
f
irewall, allocated in bits/second, packets/
s
ession, sessions/second
•
ToS/DiffServ marking and matching
• Integrated with application layer filters
Content Security
• HTTP Filter Keyword support integrated with HTTP
Application Filter
• Basic content filtering with configurable
whitelist/blacklist and content keyword matching.
• URL redirection for blacklist sites
•
Rules-based routing feature for HTTP, SMTP
a
nd FTP features (Security Management Server
v9.1 or later)
¬ Interoperates with all 3rd party Anti-virus,
Anti-Spam, and Content Filtering systems
¬ Redirects only protocol-specific packets to
3rd party systems performing Anti-virus,
Anti-spam, and content filtering services.
• Application-layer protocol command
recognition and filtering
• Application-layer command line length
enforcement
• Unknown protocol command handling
• Extensive session-oriented logging for
application-layer commands and replies
• Hostile mobile code blocking (Java®, ActiveX™)
Firewall User Authentication
• Browser-based authentication allows
authentication of any user protocol
• Built-in internal database – user limit 10,000
• Local passwords, RADIUS, SecurID
• User assignable RADIUS attributes
• Certificate authentication
VPN
•
Maximum number of dedicated VPN
tunnels – 7,500
•
Manual Key, IKEv1, IKEv2, DoD PKI, X.509
•
3DES (168-bit), DES (56-bit)
• AES (128, 192, 256-bit)
•
SHA-1 and MD5 authentication/integrity
•
Replay attack protection
• Remote access VPN
• Site-to-site VPN
•
IPSec NAT Traversal/UDP encapsulated IPSec
•
IKEv2 IPSec NAT Traversal and dead peer
d
etection
•
LZS compression
•
Spliced and nested tunneling
• Fully meshed or hub and spoke site-to-site VPN
VPN Authentication
• Local passwords, RADIUS, SecurID, X.509 digital
certificates
• PKI Certificate requests (PKCS 12)
• Automatic LDAP certificate retrieval
• DoD PKI
High Availability
• VPN Firewall Brick security appliance to VPN Firewall
Brick security appliance active/passive failover with
full synchronization
• 400 millisecond device failure detection and
activation
• Session protection for firewall, VoIP and VPN
• Link failure detection
• Alarm notification on failover
• Encryption and authentication of session
synchronization traffic
• Self-healing synchronization links
• Pre-emption and IP tracking for improved health
state checking
• Seamless system upgrade with no downtime for
redundant deployments
3Alcatel-Lucent VPN Firewall Brick 1200