华为USG 系列防火墙性能参数表

一、技术参数（一）防火墙华为USG2130网络端口：1个Wan+8个FE接口VPN支持：支持入侵检测：Dos,DDoS管理：支持命令行、WEB方式、SNMP、TR069等配置和管理方式，这些方式提供对设备的本地配置、远程维护、集中管理等多种手段，并提供完备的诊断、告警、测试等功能安全标准：CE，ROHS，CB，UL，VCCI处理器：多核处理器电源：AC:100-240V最大功率：54W产品尺寸：420*255*43.6mm产品重量：5kg适用环境：工作温度:0-45℃;工作湿度:10%-95%其他性能：UTM扩展槽位：1MIC（二）防火墙华为USG6380整机吞吐量(bps): 6G并发连接数: 400万每秒新建连接数: 8万IPSEC VPN性能: 吞吐量3G 4000条SSL VPN并发用户数: 默认100 最大1000固定接口： 8GE+4SFP扩展槽位： 2*WSIC接口模块类型：WSIC: 2×10GE (SFP+)+8×GE (RJ45)、8×GE (RJ45)、8×GE (SFP)、4×GE (RJ45) BYPASS产品形态桌面： 1U尺寸 (W×D×H)mm： 442×421×43.6满配重量：10kgHDD：选配300GB单硬盘，支持热插拔冗余电源：选配电源AC： 100～240V最大功率： 170W工作环境温度：0~45℃ (不含硬盘)/5℃～40℃ (包含硬盘)湿度：10%～90%非工作环境温度：-40℃～70℃ /湿度：5%～95%（三）入侵防御华为NIP2050专用管理口 : 1×GE(RJ45)固定接口：4×GE(RJ45) ，4×GE(combo)扩展槽位：2×FIC扩展网络接口：BYPASS: 4×GE(RJ45) 2Line(LC/UPC) 接口： 8×GE(RJ45)、 8×GE(SFP)功能特性：针对应用服务器提供全方位的安全防护，解决以下问题：系统漏洞攻击、服务漏洞攻击、暴力破解、SQL注入、跨站脚本、病毒防护尺寸（mm）（W×D×H）：442×560×43.6功率：150W电源：AC:100～240V 50/60Hz 支持冗余升级服务：NIP2050知识库升级服务标配三年。

华为USG6000系列下一代防火墙详细性能参数表能，与Agile Controller配合可以实现微信认证。

应用安全●6000+应用协议识别、识别粒度细化到具体动作，自定义协议类型，可与阻断、限流、审计、统计等多种手段自由结合在线协议库升级。

注：USG6320可识别1600+应用。

●应用识别与病毒扫描结合，发现隐藏于应用中的病毒，木马和恶意软件，可检出超过500多万种病毒。

●应用识别与内容检测结合，发现应用中的文件类型和敏感信息，防范敏感信息泄露。

入侵防御●基于特征检测，支持超过3500漏洞特征的攻击检测和防御。

●基于协议检测，支持协议自识别，基于协议异常检测。

●支持自定义IPS签名。

APT防御与沙箱联动，对恶意文件进行检测和阻断。

Web安全●基于云的URL分类过滤，支持8500万URL库，80+分类。

●提供专业的安全URL分类，包括钓鱼网站库分类和恶意URL库分类。

●基于Web的防攻击支持，如跨站脚本攻击、SQL注入攻击。

●提供URL关键字过滤，和URL黑白名单。

邮件安全●实时反垃圾邮件功能，在线检测，防范钓鱼邮件。

●本地黑、白名单，远程实时黑名单、内容过滤、关键字过滤、附件类型、大小、数量。

●支持对邮件附件进行病毒检查和安全性提醒。

数据安全●基于内容感知数据防泄露，对邮件，HTTP，FTP，IM、SNS等传输的文件和文本内容进行识别过滤。

●20+文件还原和内容过滤，如Word、Excel、PPT、PDF等），60+文件类型过滤。

安全虚拟化安全全特性虚拟化，转发虚拟化、用户虚拟化、管理虚拟化、视图虚拟化、资源虚拟化（带宽、会话等）。

网络安全●DDoS攻击防护，防范多种类型DDoS攻击，如SYN flood、UDP flood、ICMP flood、HTTP flood、DNS flood、ARP flood和ARP欺骗等。

●丰富的VPN特性，IPSec VPN、SSL VPN、L2TP VPN、MPLS VPN、GRE等。

Huawei USG6630E/USG6650E/USG6680E Next-Generation FirewallsWith the continuous digitalization and cloudification of enterprise services, networks play an important rolein enterprise operations, and must be protected. Network attackers use various methods, such as identityspoofing, website Trojan horses, and malware, to initiate network penetration and attacks, affecting thenormal use of enterprise networks.Deploying firewalls on network borders is a common way to protect enterprise network security. However,firewalls can only analyze and block threats based on signatures. This method cannot effectively handleunknown threats and may deteriorate device performance. This single-point and passive method doesnot pre-empt or effectively defend against unknown threat attacks. Threats hidden in encrypted traffic inparticular cannot be effectively identified without breaching user privacy.Huawei's next-generation firewalls provide the latest capabilities and work with other security devicesto proactively defend against network threats, enhance border detection capabilities, effectively defendagainst advanced threats, and resolve performance deterioration problems. Network Processors providefirewall acceleration capability, which greatly improves the firewall throughput.Product AppearancesUSG6630E/USG6650E/USG6680EProduct HighlightsComprehensive and integrated protection• Integrates the traditional firewall, VPN, intrusion prevention, antivirus, data leak prevention, bandwidth management, URL filtering, and online behavior management functions all in one device.• Interworks with the local or cloud sandbox to effectively detect unknown threats and prevent zero-day attacks.• Implements refined bandwidth management based on applications and websites, preferentially forwards key services, and ensures bandwidth for key services.More comprehensive defense• The built-in traffic probe of a firewall extracts traffic information and reports it to the CIS, a security big data analysis platform developed by Huawei. The CIS analyzes threats in the traffic, without decrypting the traffic or compromising the device performance. The threat identification rate is higher than 90%.• The deception system proactively responds to hacker scanning behavior and quickly detects and records malicious behavior, facilitating forensics and source tracing.High performance• Uses the network processing chip based on the ARM architecture, improving forwarding performance significantly.• Enables chip-level pattern matching and accelerates encryption/decryption, improving the performance for processing IPS, antivirus, and IPSec services.• The throughput of a 1 U device can reach 80 Gbit/s.High port density• The device has multiple types of interfaces, such as 40G, 10G, and 1G interfaces. Services can be flexibly expanded without extra interface cards.DeploymentSmall Data center border protection• Firewalls are deployed at egresses of data centers, and functions and system resources can be virtualized.The firewall has multiple types of interfaces, such as 40G, 10G, and 1G interfaces. Services can be flexibly expanded without extra interface cards.• The 12-Gigabit intrusion prevention capability effectively blocks a variety of malicious attacks and delivers differentiated defense based on virtual environment requirements to guarantee data security.• VPN tunnels can be set up between firewalls and mobile workers and between firewalls and branch offices for secure and low-cost remote access and mobile working.Enterprise border protection• Firewalls are deployed at the network border. The built-in traffic probe extracts packets of encrypted trafficand sends the packets to the CIS, a big data analysis platform. In this way, threats in encrypted traffic are monitored in real time. Encrypted traffic does not need to be decrypted, protecting user privacy and preventing device performance deterioration.• The deception function in enabled on the firewalls to proactively respond to malicious scanning behaviorand associate with the CIS for behavior analysis to quickly detect and record malicious behavior, protecting enterprise against threats in real time.• The policy control, data filtering, and audit functions of the firewalls are used to monitor social networkapplications to prevent data breach and protect enterprise networks.Hardware1. HDD/SSD Slot2. 12 x GE (RJ45)3. 12 x 10GE (SFP+)4. 2 x 40GE (QSFP+)5. 1 x USB3.06. 1 x GE (RJ45) management port7. Console portUSG6630E/USG6650E1. HDD/SSD Slot2. 28 x10 GE (SFP+)3. 4 x 40GE (QSFP+)4. 2 x HA (SFP+)5. 1 x USB3.06. 1 x GE (RJ45) management port7. Console portUSG6680ESoftware FeaturesSpecificationsSystem Performance and Capacity1. P erformance is tested under ideal conditions based on RFC2544, 3511. The actual result may vary with deployment environments.2. Antivirus, IPS, and SA performances are measured using 100 KB HTTP files.3. F ull protection throughput is measured with Firewall, SA, IPS, Antivirus and URL Filtering enabled. Antivirus, IPS and SA performances are measured using 100 KB HTTP files.4. F ull protection throughput (Realworld) is measured with Firewall, SA, IPS, Antivirus and URL Filtering enabled, Enterprise Mix Traffic Model.5. SSL inspection throughput is measured with IPS-enabled and HTTPS traffic using TLS v1.2 with AES128-GCM-SHA256.6. SSL VPN throughput is measured using TLS v1.2 with AES128-SHA.*SA: Service Awareness.Note: All data in this document is based on USG V600R006.Hardware Specifications* Some 10G ports and 40G ports are mutually exclusive. The ports can be configured as follows: 4 x 40GE (QSFP+) + 20 x 10GE (SFP+) + 2 x 10GE (SFP+) HA + 1 x USB or 2 x 40GE (QSFP+) + 28 x 10GE (SFP+) + 2 x 10GE (SFP+) HA + 1 x USBCertificationsRegulatory, Safety, and EMC ComplianceOrdering GuideAbout This PublicationThis publication is for reference only and does not constitute any commitments or guarantees. All trademarks, pictures, logos, and brands mentioned in this document are the property of Huawei Technologies Co., Ltd. or a third party.For more information, visit /en/products/enterprise-networking/security.Copyright©2019 Huawei Technologies Co., Ltd. All rights reserved.。

Huawei USG6330/6350/6360 next-generation firewalls are security gateways designed for small- and medium-sized businesses and branch offices with 200 to 800 users. The firewalls provide VPN, intrusion prevention, and antivirus functions for comprehensive and integrated network protection, effectively reducing management costs. Refined bandwidth management improves bandwidth efficiency and ensures quality experiences for key services. These firewalls provide continuous next-generation network security in an easy and efficient way.HighlightsComprehensive and integrated protection• Multiple security functions, including firewall, VPN, intrusion prevention, and online behavior management,for complete versatility• Refined bandwidth management based on application and website category to prioritize bandwidth formission-critical services• Detection and prevention of unknown threats, such as zero-day attacks, using sandboxing and thereputation system*Simple management and rapid deployment• Zero-configuration deployment using USB disks to improve deployment efficiency• Predefined common-scenario defense templates to facilitate security policy deployment • Intelligent detection of redundant and invalid policies• Supports cloud-based management and enables Huawei Agile Controller-Cloud Manager to manage andconfigure the firewalls Flexible bandwidth management, improving Internet access experience•Differentiated user bandwidth and quota management for fair and prioritized bandwidth usageHUAWEI USG6330/6350/6360 Next-Generation Firewalls---Securely and Reliably Connect Small- and Medium-Sized Businesses• Application-based bandwidth management to prioritize bandwidth for mission-critical applications• Modification of URL category priorityDeploymentSecure interconnections between enterprise branches• Inspect services in six dimensions (application, user, content, threat, time, and location) and provide refined service access control at the Internet egress.• Establish IPsec or L2TP over IPsec permanent tunnels for branches and partners with fixed VPN gateways (L2TP over IPsec tunnel is recommended if account authentication is required).• Provide SSL VPN for remote access of people on the move and implement fine-grained control over the resources accessible to users.• Authenticate VPN tunnel users to ensure they are legitimate and authorized.• Enable intrusion prevention, antivirus, file blocking, and data filtering functions to prevent remote access users from introducing network threats or leaking information.HardwareUSG6330/6350/6360Interfaces1. USB Port2. Console Port3. 1 x GE (RJ45) Management Port4. 4 x GE (RJ45) Ports5. 2 x GE (Combo) PortsTable 1. Wide Service Interface Cards (WSICs) for USG6300 SeriesSoftware Features1: I f no hard disk is inserted, you can view and export system and service logs. By inserting a hard disk, you can also view, export, customize, and subscribe to reports.Functions marked with * are supported only in USG V500R001 and later versions.Specifications *System Performance and Capacity1. P erformance is tested under ideal conditions based on RFC 2544 and RFC 3511. The actual result may vary with deployment environments.2. Antivirus, IPS, and SA performances are measured using 100 KB of HTTP files.3. Throughput is measured with the Enterprise Traffic Model.4. SSL inspection throughput is measured with IPS-enabled and HTTPS traffic using TLS v1.2 with AES256-SHA.5. SSL VPN throughput is measured using TLS v1.2 with AES128-SHA.6. USG6000 V100R001 supports only the RESTCONF interface and cannot interwork with sandbox or third-party tools.* SA indicates Service Awareness.* This content is applicable only to regions outside mainland China. Huawei reserves the right to interpret this content. Hardware Specifications*WISC is not hot-swappable.CertificationsRegulatory, Safety, and EMC ComplianceOrdering GuideAbout This PublicationThis publication is for reference only and does not constitute any commitments or guarantees. All trademarks, pictures, logos, and brands mentioned in this document are the property of Huawei Technologies Co., Ltd. or a third party.For more information, visit /en/products/enterprise-networking/security.Copyright©2018 Huawei Technologies Co., Ltd. All rights reserved.。

华为USG6000系列下一代防火墙详细性能参数表能，与Agile Controller配合可以实现微信认证。

应用安全●6000+应用协议识别、识别粒度细化到具体动作，自定义协议类型，可与阻断、限流、审计、统计等多种手段自由结合在线协议库升级。

注：USG6320可识别1600+应用。

●应用识别与病毒扫描结合，发现隐藏于应用中的病毒，木马和恶意软件，可检出超过500多万种病毒。

●应用识别与内容检测结合，发现应用中的文件类型和敏感信息，防范敏感信息泄露。

入侵防御●基于特征检测，支持超过3500漏洞特征的攻击检测和防御。

●基于协议检测，支持协议自识别，基于协议异常检测。

●支持自定义IPS签名。

APT防御与沙箱联动，对恶意文件进行检测和阻断。

Web安全●基于云的URL分类过滤，支持8500万URL库，80+分类。

●提供专业的安全URL分类，包括钓鱼网站库分类和恶意URL库分类。

●基于Web的防攻击支持，如跨站脚本攻击、SQL注入攻击。

●提供URL关键字过滤，和URL黑白名单。

邮件安全●实时反垃圾邮件功能，在线检测，防范钓鱼邮件。

●本地黑、白名单，远程实时黑名单、内容过滤、关键字过滤、附件类型、大小、数量。

●支持对邮件附件进行病毒检查和安全性提醒。

数据安全●基于内容感知数据防泄露，对邮件，HTTP，FTP，IM、SNS等传输的文件和文本内容进行识别过滤。

●20+文件还原和内容过滤，如Word、Excel、PPT、PDF等），60+文件类型过滤。

安全虚拟化安全全特性虚拟化，转发虚拟化、用户虚拟化、管理虚拟化、视图虚拟化、资源虚拟化（带宽、会话等）。

网络安全●DDoS攻击防护，防范多种类型DDoS攻击，如SYN flood、UDP flood、ICMP flood、HTTP flood、DNS flood、ARP flood和ARP欺骗等。

●丰富的VPN特性，IPSec VPN、SSL VPN、L2TP VPN、MPLS VPN、GRE等。