Huawei NIP6000 Next-Generation IPS Firewall Hardware

Huawei NIP6000 Next-Generation IPSThanks to the development of the cloud and mobile computing technologies, many enterprises currently allow their employees to use smart devices, such as smartphones and tablets, and popular network applications, such as Facebook and Twitter, for work to improve employee productivity. The problem with these technologies is that they blur network borders and increase the exposure to risks. The increasing number of security incidents indicates that the threat landscape in information security is changing and traditional technologies cannot protect against the new generation of threats.  New threats are mostly zero-day vulnerability-based attacks that target specific victims. Traditional defense technologies are slow to create signatures, thereby giving attacks ample time to cause severe damage. In addition, attackers may customize the attack for the target environment and remain undetected for a long time. The increasing number of attacks proves that traditional technologies cannot help enterprises defend against this new generation of attacks. Enterprises now need a fundamentally different new-generation solution to protect their IT infrastructures from such threats.HUAWEI NIP6000, an advanced, New Generation Intrusion Prevention System (NGIPS), provides context, application, and content awareness capabilities and defends against unknown threats to better protect network infrastructures, bandwidth performance, servers, and clients.Product characteristicsNew hardware and software architecture, providing industry-Leading performanceMost software matching engines process regular expressions slowly, which severely restricts the device detection performance. Huawei NGIPS engine uses an MIPS64 processor from Cavium, a world-renowned chip provider, to provide high-performance hardware pattern matching. Huawei NGIPS also employs the new Intelligent Awareness Engine (IAE) for threat detection, which enables in-depth detection and delivers 15 Gbit/s detection efficiency.The NIP6000 series NGIPS, with the new unified hardware-software architecture, uses a dedicated multi-core platform and co-processors to process massive numbers of packets that require high computing performance. Packets that require less computing performance are processed using software. Such processing mechanisms improve the overall device performance.With the asynchronous matching technology, the NIP6000 uses a hardware-based matching engine to process the most resource-intensive services (especially services that are CPU-intensive) so that the CPU is free to process other services during matching. The concurrent processing greatly improves the speed and efficiency.The greater the number of signatures loaded, the lower the matching efficiency of traditional IPS engines and device performance. In contrast, the NIP6000 uses a hardware-based matching engine to concurrently load tens of thousands of threat signatures without affecting the matching performance.To detect compressed web pages or files, IPS engines must have powerful decompression capabilities. The NIP6000 uses a dedicated hardware-based engine with Cavium processors for file decompression and is capable of implementing high-performance intrusion detection on compressed files, such as ZIP files.Dynamic context awareness for intelligent policy tuning and severity-based log managementLegacy IPS devices detect attacks based only on attack signatures, without considering the attributes of the protected assets on live networks, leading to false positives. The NIP6000 is aware of environment changes and provides intelligent policy tuning and hierarchical log management functions to resolve this problem.The NIP6000 policy tuning and risk evaluation are based on asset information, including asset type, asset value, operating system, and enabled services. The asset information can be manually entered, automatically detected, or imported from third-party scanning software.Based on the asset information, the NIP6000 selects signatures and automatically generates intrusion prevention policies for attack defense. Upon detecting environment changes, the NIP6000 automatically tunes the policies or notifies the administrator to tune them to defend against new threats.Upon detecting an attack, the NIP6000 extracts from the attack signature the target information, such as the operating system and service, and compares this information with the asset information stored on the NIP6000. It then determines the risk level of the attack event based on the asset value and log severity so that administrators can prioritize high-risk attack events and ignore false positives and minor issues.With context awareness and real-time attack detection, the NIP6000 identifies security risks to both static assets and dynamic traffic so that enterprises can gain visibility into their network status.Interworking with the sandbox and reputation systems to detect APT attacksSignature-based attack detection can detect attacks that exploit known vulnerabilities but cannot detect zero-day or APT attacks. The most effective method for APT attack defense is the sandbox technology, which creates an isolated threat detection environment in which traffic can be analyzed.The NIP6000 identifies the file types that require APT detection and sends the files to the sandbox for threat analysis.The sandbox parses the files, sends the threat detection result to the NIP6000, and displays the threat detection result in logs and reports.The NIP6000 submits information about the attack behavior to the cloud security center, which then generates reputation signatures based on this information and pushes the signatures to the NIP6000 to update the NIP6000's threat defense capability.Multi-level detection for comprehensive protectionAs the number of information assets connecting through the Internet is increasing, network attacks and information interception are also growing and have become a huge industry chain. This poses high requirements on the defense capabilities of NGIPS products. To address this challenge, the NIP6000 provides the following in-depth overall protections:Intrusion prevention: The NIP6000 detects and prevents attacks that exploit over 5,000 vulnerabilities and Web attacks, such as cross-site scripting and SQL injection.Antivirus: The antivirus engine on the NIP6000 defends against more than 5 million viruses and Trojan horses, and the antivirus signature database is updated daily.Unauthorized server connection detection: The NIP6000 detects unauthorized connections to servers and port stealing to protect key information assets.SSL decryption: The NIP6000 can function as a proxy to implement application-layer security protection, such as intrusion prevention, antivirus, data leak prevention, and URL filtering, on SSL encrypted traffic.Anti-DDoS: The NIP6000 identifies and prevents more than 100 types of DDoS attacks, such as SYN and UDP floods.Networking and applicationsInternet border protectionIn such a scenario, the NIP6000 is often deployed in the downstream of an egress firewall or a router and transparently connects to the network. To protect multiple links, you can use multiple interface pairs on the NIP6000.Intrusion prevention: The NIP6000 defends against worms, browser exploits, and plug-in vulnerabilities to ensure the enterprise network remains healthy. In addition, the NIP6000 stops Trojan horses and spyware that exploit vulnerabilities to protect key data information, such as privacy and identity information in office computers.Antivirus: The NIP6000 scans the files downloaded from the Internet for viruses to protect the PCs on the enterprise network.URL filtering: The NIP6000 restricts the websites accessible to enterprise users to prevent productivity loss and network threats.Application control: The NIP6000 controls P2P, video, and IM application traffic to guarantee major enterprise services operate smoothly.IDC/server upstream protectionIn such a scenario, dual NIP6000s are often deployed to avoid a single point of failure. The NIP6000s can be deployed in-line in front of servers to transparently access the network or attached to switches or routers. In the latter deployment mode, traffic exchanged between the Internet and servers is diverted to the NIP6000s for processing, after which it is injected back.Intrusion prevention: The NIP6000 defends against worms targeting web, mail, and DNS servers and exploits of service and platform vulnerabilities to prevent malware from damaging, tampering with, or stealing data on the servers. The NIP6000 also defends against SQL injection, scanning, guessing, and sniffing attacks targeting web applications.Unauthorized server connection detection: The NIP6000 detects unauthorized connections to servers to prevent information leaks.Antivirus: The NIP6000 scans the files to be uploaded to the servers for viruses to protect the servers.Anti-DDoS: The NIP6000 defends against DoS and DDoS attacks targeting servers.Network border protectionFor a large or medium-sized enterprise, the network is often divided into zones of different security levels. Isolation or security control is applied to communications between the zones. For example, departments or headquarters and branches must be isolated from each other for security.Intrusion prevention: The NIP6000 logically isolates the zones and detects and prevents sniffing, reconnaissance, worms, and Trojan horses from external networks.Violation monitoring: The NIP6000 monitors and controls unauthorized connections from enterprise networks to external networks.Off-line monitoringIntrusion prevention products can be deployed in off-line mode on networks to monitor the network security conditions. In such a scenario, the intrusion prevention product records attack events and web application traffic conditions, to provide evidence for cyber security event audit and user behavior analysis, but does not take defense actions. The NIP6000 is attached to a switch, and the switch sends a copy of traffic to be checked to the NIP6000 for detection and analysis.Intrusion detection: The NIP6000 detects the attacks initiated from the Internet and from enterprise employees, and then displays the attack events through logs and reports for the enterprise administrators to evaluate network security status. In addition, the NIP6000 provides an attack event risk evaluation function that makes it easier for administrators to evaluate risk.Application identification: The NIP6000 identifies and collects statistics on P2P, video, and IM application traffic and provides reports for enterprise managers to gain visibility into application usage.Firewall interworking: The NIP6000 notifies a connected firewall of attack events, so that the firewall blocks the attack traffic.Compliance: The NIP6000 complies with related laws and regulations.Product specificationsModelNIP6610NIP6330NIP6620NIP6650NIP6680PerformanceMid-range FELow-end GigabitMid-range GigabitHigh-end GigabitMid-range 10 GigabitScalabilityIPS Throughput600 Mbit/s1.0 Gbit/s2.0 Gbit/s6.0 Gbit/s15.0 Gbit/sFixed Ports4 GE + 2 Combo8 GE + 4 SFP8 GE + 4 SFP8 GE + 4 SFP4 x 10 GE +1 6 GE + 8 SFPHeight1U3UDimensions (mm)442 x 421 x 43.6442 x 415 x 130.5Weight10 Kg24 KgHard DiskOptional. Supports one 300 GB hard disk (hot-swappable).Optional. Supports one 300 GB hard disk (RAID1 and hot-swappable).Redundant Power SupplyOptionalStandardAC Power Supply100V to 240VDC Power Supply--48V to -60VPower Consumption170W350WOperating Environment●  Temperature0°C to 45°C (without optional hard disk)5°C to 40°C (with optional hard disk)●  Humidity10% to 90%FunctionsIntelligent ManagementDetects the types, operating systems, and enabled services of protected IT assets and dynamically generates suitable intrusion prevention policies for the IT environment.Evaluates the risk level of attack events based on the IT environment so that administrators can process critical attack events and ignore false positive attacks.Identifies application types of live network traffic and determines whether to implement intrusion detection based on the risk levels of the identified application types.Provides multiple types of logs, such as threat logs, operation logs, system logs, and policy matching logs, for the administrator to learn about network events.Provides multiple types of reports, such as traffic reports, threat reports, and policy matching reports, for the administrator to view network traffic and threat status. The NIP can also interwork with an eSight to provide more comprehensive and diversified reports.Provides a web UI, CLI (console, Telnet, and sTelnet), and network management system (SNMP) for device management.Intrusion PreventionDefends against common attacks, such as Worms, Trojan horses, botnets, cross-site scripting, and SQL injection, based on the signature database, and provides user-defined signatures to defend against new attacks.APT DetectionDetects APT attacks based on reputation systems and the sandbox. The NIP6300/6600 sends suspect files to the sandbox for detection and then displays attack events based on the sandbox detection result.Supports IP and C&C reputation to detect and prevent malicious IP addresses and domain names.Application SecurityAutomatically learns traffic patterns and defends against multiple types of DDoS attacks at the application layer, including HTTP, HTTPS, DNS, and SIP flood attacks.Scans for viruses in files transmitted through HTTP, FTP, SMTP, POP3, IMAP, NFS, and SMB and prevents virus-infected files from being transmitted.Identifies more than 6,000 applications, including P2P, IM, online gaming, social networking, video, and audio applications, and takes actions (block, traffic limiting, application usage display) for the identified applications.Web SecurityDecrypts HTTPS traffic and detects threats.Provides a URL blacklist to control online behavior.Network SecurityDetects threats in IPv6 traffic.Detects threats in VLAN, QinQ, MPLS, GRE, IPv4 over IPv6, and IPv6 over IPv4 tunnel traffic.Automatically learns traffic patterns and defends against multiple types of DDoS attacks at the network layer, including SYN, UDP, ICMP, and ARP flood attacks.Defends against multiple types of single-packet attacks, including:●  Scanning attacks, such as IP sweep and port scanning●  Malformed packet attacks, such as IP spoofing, LAND, Smurf, Fraggle, WinNuke, Ping of Death, TearDrop, IP fragment, ARP spoofing, and attacks using invalid TCP flagsControl message attacks, such as oversized ICMP packets, ICMP unreachable packets, ICMP redirect packets, Tracert, packets with options such as IP source routing, IP record route, and IP timestampBlacklists the source or destination IP addresses of attacks to block the follow-up packets from or to the blacklisted IP addresses.High AvailabilitySupports hot backup protocols, such as VRRP, VGMP, and HRP, and provides a hot standby mechanism to ensure that services can automatically and smoothly switch to the standby device if the active device fails.Provides a bypass card to ensure service continuity if the system encounters faults (such as hardware failures, and devices being powered off).Provides visualized fault diagnosis for the administrator to diagnose all possible fault causes and automatically displays the diagnosis results and troubleshooting suggestions.Signature Database UpdateSupports online and offline updates of the IPS-SDB, SA_SDB, and antivirus SDB for the device to have the latest defense capabilities.Ordering informationQuotation Items of NIP6000 SeriesExternal ModelPart NumberDescriptionNIP6610-AC02350CVYNIP6610, NIP6610-AC, NIP6610 AC Host (4 GE (RJ45) + 2 GE Combo, with Knowledge base Update Subscription 12 Months)NIP6330-AC02350CWCNIP6330, NIP6330-AC, NIP6330 AC Host (8 GE (RJ45) + 4 GE (SFP), with Knowledge base Update Subscription 12 Months)NIP6620-AC02350CWUNIP6620, NIP6620-AC, NIP6620 AC Host (8 GE (RJ45) + 4 GE (SFP), with Knowledge base Update Subscription 12 Months)NIP6650-AC02350CWDNIP6650, NIP6650-AC, NIP6650 AC Host (8 GE (RJ45) + 4 GE (SFP), 2 AC Power, with Knowledge base Update Subscription 12 Months)NIP6650-DC02350CWENIP6650, NIP6650-DC, NIP6650 DC Host (8 GE (RJ45) + 4 GE (SFP), 2 DC Power, with Knowledge base Update Subscription 12 Months)NIP6680-AC02350CWHNIP6680, NIP6680-AC, NIP6680 AC Host (16 GE (RJ45) + 8 GE (SFP) + 4 x 10 GE (SFP+), 2 AC Power, with Knowledge base Update Subscription 12 Months)NIP6680-DC02350CWJNIP6680, NIP6680-DC, NIP6680 DC Host (16 GE (RJ45) + 8 GE (SFP) + 4 x 10 GE (SFP+), 2 DC Power, with Knowledge base Update Subscription 12 Months)LIC-AV12-NIP63-HM88032TYQSoftware Charge, NIP6300, LIC-AV12-NIP63-HM, Anti-Virus Update Service Subscription 12 MonthsLIC-AV24-NIP63-HM88032TYRSoftware Charge, NIP6300, LIC-AV24-NIP63-HM, Anti-Virus Update Service Subscription 24 MonthsLIC-IPS12-NIP63-HM88032TYSSoftware Charge, NIP6300, LIC-IPS12-NIP63-HM, Knowledge Base Update Service Subscription 12 MonthsLIC-IPS24-NIP63-HM88032TYTSoftware Charge, NIP6300, LIC-IPS24-NIP63-HM, Knowledge Base Update Service Subscription 24 MonthsLIC-AV12-NIP66-LM88032UBJSoftware Charge, NIP6610, LIC-AV12-NIP66-LM, Anti-Virus Update Service Subscription 12 MonthsLIC-AV24-NIP66-LM88032UBKSoftware Charge, NIP6610, LIC-AV24-NIP66-LM, Anti-Virus Update Service Subscription 24 MonthsLIC-IPS12-NIP66-LM88032UBLSoftware Charge, NIP6610, LIC-IPS12-NIP66-HM, Knowledge Base Update Service Subscription 12 MonthsLIC-IPS24-NIP66-LM88032UBMSoftware Charge, NIP6610, LIC-IPS24-NIP66-HM, Knowledge Base Update Service Subscription 24 MonthsLIC-AV12-NIP66-LG88032UBNSoftware Charge, NIP6620&NIP6620D, LIC-AV12-NIP66-LG, Anti-Virus Update Service Subscription 12 MonthsLIC-AV24-NIP66-LG88032UBPSoftware Charge, NIP6620&NIP6620D, LIC-AV24-NIP66-LG, Anti-Virus Update Service Subscription 24 MonthsLIC-IPS12-NIP66-LG88032UBQSoftware Charge, NIP6620&NIP6620D, LIC-IPS12-NIP66-LG, Knowledge Base Update Service Subscription 12 MonthsLIC-IPS24-NIP66-LG88032UBRSoftware Charge, NIP6620&NIP6620D, LIC-IPS24-NIP66-LG, Knowledge Base Update Service Subscription 24 MonthsLIC-AV12-NIP66-HG88032UBSSoftware Charge, NIP6650&NIP6650D&NIP6680, LIC-AV12-NIP66-HG, Anti-Virus Update Service Subscription 12 MonthsLIC-AV24-NIP66-HG88032UBTSoftware Charge, NIP6650&NIP6650D&NIP6680, LIC-AV24-NIP66-HG, Anti-Virus Update Service Subscription 24 MonthsLIC-IPS12-NIP66-HG88032UBUSoftware Charge, NIP6650&NIP6650D&NIP6680, LIC-IPS12-NIP66-HG, Knowledge Base Update Service Subscription 12 MonthsLIC-IPS24-NIP66-HG88032UBVSoftware Charge, NIP6650&NIP6650D&NIP6680, LIC-IPS24-NIP66-HG, Knowledge Base Update Service Subscription 24 Months