华为USG6300系列下一代防火墙规格清单(渠道版)

OverviewWith the continuous digitalization and cloudification of enterprise services, networks play an important role in enterprise operations, and must be protected. Network attackers use various methods, such as identity spoofing, website Trojan horses, and malware, to initiate network penetration and attacks, affecting the normal use of enterprise networks.Deploying firewalls on network borders is a common way to protect enterprise network security. However, firewalls can only analyze and block threats based on signatures. This method cannot effectively handle unknown threats and may deteriorate device performance. This single-point and passive method does not pre-empt or effectively defend against unknown threat attacks. Threats hidden in encrypted traffic in particular cannot be effectively identified without breaching user privacy.Huawei's next-generation firewalls provide the latest capabilities and work with other security devices to proactively defend against network threats, enhance border detection capabilities, effectively defend against advanced threats, and resolve performance deterioration problems. The network processing chip provides pattern matching and encryption/decryption service processing acceleration functions, which greatly improve the firewalls ability to process content security detection and IPSec services.Huawei USG6515E/USG6550E/USG6560E/USG6580E Next-Generation FirewallsProduct HighlightsComprehensive and integrated protection•Integrates the traditional firewall, VPN, intrusion prevention, antivirus, data leak prevention, bandwidth management, URL filtering, and online behavior management functions all in one device.•Interworks with the local or cloud sandbox to effectively detect unknown threats and prevent zero-day attacks.DeploymentCloud-based management•Firewalls proactively register with and quickly incorporated into the cloud management platform to implement quick device deployment without manual attendance.•Remote service configuration management, device monitoring, and fault management are used to implement cloud-based management of mass devices and simplify O&M.Enterprise border protection•Firewalls are deployed at the network border. The built-in traffic probe extracts packets of encrypted traffic and sends the packets to the CIS, a big data analysis platform. In this way, threats in encrypted traffic are monitored in real time. The deception function in enabled on the firewalls to proactively respond to malicious scanning behavior and associate with the CIS for behavior analysis to quickly detect and record malicious behavior, protecting enterprise against threats in real time.USG6515E/USG6550E/USG6560E/USG6580EHUAWEI TECHNOLOGIES CO., LTD.•Implements refined bandwidth management based on applications and websites, preferentially forwards key services, and ensures bandwidth for key services.More comprehensive defense•The built-in traffic probe of a firewall extracts traffic information and reports it to the CIS, a security big data analysis platform developed by Huawei. The CIS analyzes threats in the traffic, without decrypting the traffic or compromising the device performance. The threat identification rate is higher than 90%.•The deception system proactively responds to hacker scanning behavior and quickly detects and records malicious behavior, facilitating forensics and source tracing.High performance•Uses the network processing chip based on the ARM architecture, improving forwarding performance significantly.•Enables chip-level pattern matching and accelerates encryption/decryption, improving the performance for processing IPS, antivirus, and IPSec services.Specifications1. The performance is tested under ideal conditions based on RFC2544, 3511. The actual result may vary with deployment environments.2. Antivirus, IPS, and SA performances are measured using 100 KB HTTP files.3. Full protection throughput is measured with Firewall, SA, IPS, Antivirus and URL Filtering enabled. Antivirus, IPS and SA performances are measured using 100 KB HTTP files.4. SSL inspection throughput is measured with IPS enabled and HTTPS traffic using TLS v1.2 with AES128-GCM-SHA256.5. SSL VPN throughput is measured using TLS v1.2 with AES128-SHA.*SA: Service Awareness.About This PublicationThis publication is for reference only and does not constitute any commitments or guarantees. All trademarks, pictures, logos, and brands mentioned in this document are the property of Huawei Technologies Co., Ltd. or a third party.Copyright©2019 Huawei Technologies Co., Ltd. All rights reserved.System Performance and Capacity。

Huawei USG6370/6380/6390 next-generation firewalls provide high-performance security protection for medium-sized businesses and branch offices with 800 to 1500 users. The firewalls provide VPN, intrusion prevention, and antivirus functions, and can ensure high performance even when multiple security functions are enabled. With comprehensive application control and advanced threat prevention, the firewalls provide cost-effective and all-around security protection for users.HighlightsComprehensive and integrated protection• Multiple security functions, including firewall, VPN, intrusion prevention, and online behavior management,for complete versatility.• Accurately identify more than 6000 applications to deliver fine-grained access control and improve thequality of key services.• Detection and prevention of unknown threats, such as zero-day attacks, using sandboxing and thereputation system*.Simple security management• Predefined common-scenario defense templates to facilitate security policy deployment.• Automatically generate policy-tuning suggestions based on risks in network traffic and applications inaccordance with the least privilege principle.• Intelligent detection of redundant and invalid policies.Third-party proven security capability• Obtained Firewall, IPS, IPsec, and SSL VPN certifications from the ICSA Labs.•Obtained the highest-level CC certificate (EAL4+), ranking among the highest security levels in the world.HUAWEI USG6370/6380/6390 Next-Generation Firewalls---Comprehensive Protection for Medium-Sized BusinessesIntelligent link selection for Internet access• Select the optimal egress based on services, applications, bandwidth, ISPs, and link priorities to fully utilize link resources, improve Internet access experience, and reduce bandwidth settlement fees.• Detect link and tunnel quality in real time and intelligently adjust traffic distribution based on detection results to improve service quality and stability.• Create a predefined ISP address library, from which the optimal Internet access link is selected to ensurea quality Internet access experience.DeploymentIntranet Control and Security Isolation for medium-sized businesses• F irewalls are deployed on the Internet egress and between enterprise departments to protect medium-sized businesses. The firewalls use firewall policy control, data filtering, and audit functions to monitor social network applications, prevent data leaks, and protect the enterprise network.• Intrusion prevention is enabled on the firewall deployed on the Internet egress for real-time application-layer threat prevention.• T he firewall provides refined bandwidth management based on applications and website categories to prioritize bandwidth for mission-critical services.• T he firewall manages online user behavior based on URL categories and applications to block access to infected websites and websites irrelevant to work.HardwareUSG6370/6380/6390Interfaces1. 2 x USB Ports2. Console Port3. 1 x GE (RJ45) Management Port4. 8 x GE (RJ45) Ports5. 4 x GE (SFP) PortsTable 1. Wide Service Interface Cards (WSICs) for USG6300 SeriesSoftware Features1: I f no hard disk is inserted, you can view and export system and service logs. By inserting a hard disk, you can also view, export, customize, and subscribe to reports.Functions marked with * are supported only in USG V500R001 and later versions.Specifications *System Performance and Capacity1. P erformance is tested under ideal conditions based on RFC 2544 and RFC 3511. The actual result may vary with deployment environments.2. Antivirus, IPS, and SA performances are measured using 100 KB of HTTP files.3. Throughput is measured with the Enterprise Traffic Model.4. SSL inspection throughput is measured with IPS-enabled and HTTPS traffic using TLS v1.2 with AES256-SHA.5. SSL VPN throughput is measured using TLS v1.2 with AES128-SHA.6. USG6000 V100R001 supports only the RESTCONF interface and cannot interwork with sandbox or third-party tools.* SA indicates Service Awareness.* This content is applicable only to regions outside mainland China. Huawei reserves the right to interpret this content. Hardware Specifications*WISC is not hot-swappable.CertificationsRegulatory, Safety, and EMC ComplianceOrdering GuideAbout This PublicationThis publication is for reference only and does not constitute any commitments or guarantees. All trademarks, pictures, logos, and brands mentioned in this document are the property of Huawei Technologies Co., Ltd. or a third party.For more information, visit /en/products/enterprise-networking/security.Copyright©2018 Huawei Technologies Co., Ltd. All rights reserved.。

华为HiSecEngine USG6300E系列AI防火墙（桌面型）华为HiSecEngine USG6307E/USG6311E/USG6331E是为小型企业、行业分支、连锁商业机构设计开发的新一代桌面型防火墙设备。

除了传统防火墙管理模式，还支持云管模式。

云管模式为大量分支机构安全接入网络提供了即插即用、业务配置自动化、运维自动化可视化和网络大数据分析等优势。

自研网络处理芯片提供模式匹配以及加解密业务处理加速能力，使得防火墙处理内容安全检测、IPSec等业务的性能显著提升。

产品图华为HiSecEngine USG6300E系列AI防火墙（桌面型）华为HiSecEngine USG6300E 系列AI 防火墙（桌面型）5-2自主创“芯”HiSecEngine USG6300E 系列AI 防火墙使用华为自研安全芯片，内置转发、加密、模式匹配三大协处理引擎，有效将小包转发性能，IPS 、AV 业务性能以及IPSec 业务性能提升2倍。

内置华为自研AI 芯片，具备8TOPS 16位浮点数算力，有效支撑高级威胁防御模型加速。

“智”能防御HiSecEngine USG6300E 系列AI 防火墙内置NGE 、CDE 威胁防御引擎。

NGE 作为NGFW 检测引擎，提供IPS 、反病毒和URL 过滤等内容安全相关的功能，有效保证内网服务器和用户免受威胁的侵害。

产品亮点“芯”能防御运维全新自研CDE （Content-based Detection Engine ）病毒检测引擎，用AI 重新定义恶意文件检测。

提供数据深度分析，暴露威胁的细节，快速检测恶意文件，有效提高威胁检出率，构建“普惠式”AI ，帮助客户做到更全面的网络风险评估，有效应对攻击链上的网络威胁，真正实现攻击防御“智”能化。

极“简”运维融合云管理方案，即插即用，实现极速简易开局。

安全控制器组件化融入AC-Campus ，实现统一管理，策略下发，有效提升防火墙运维管理。

华为HiSecEngine USG6300E系列AI防火墙（桌面型）华为HiSecEngine USG6307E/USG6311E/USG6331E是为小型企业、行业分支、连锁商业机构设计开发的新一代桌面型防火墙设备。

除了传统防火墙管理模式，还支持云管模式。

云管模式为大量分支机构安全接入网络提供了即插即用、业务配置自动化、运维自动化可视化和网络大数据分析等优势。

自研网络处理芯片提供模式匹配以及加解密业务处理加速能力，使得防火墙处理内容安全检测、IPSec等业务的性能显著提升。

产品图华为HiSecEngine USG6300E系列AI防火墙（桌面型）华为HiSecEngine USG6300E 系列AI 防火墙（桌面型）5-2自主创“芯”HiSecEngine USG6300E 系列AI 防火墙使用华为自研安全芯片，内置转发、加密、模式匹配三大协处理引擎，有效将小包转发性能，IPS 、AV 业务性能以及IPSec 业务性能提升2倍。

内置华为自研AI 芯片，具备8TOPS 16位浮点数算力，有效支撑高级威胁防御模型加速。

“智”能防御HiSecEngine USG6300E 系列AI 防火墙内置NGE 、CDE 威胁防御引擎。

NGE 作为NGFW 检测引擎，提供IPS 、反病毒和URL 过滤等内容安全相关的功能，有效保证内网服务器和用户免受威胁的侵害。

产品亮点“芯”能防御运维全新自研CDE （Content-based Detection Engine ）病毒检测引擎，用AI 重新定义恶意文件检测。

提供数据深度分析，暴露威胁的细节，快速检测恶意文件，有效提高威胁检出率，构建“普惠式”AI ，帮助客户做到更全面的网络风险评估，有效应对攻击链上的网络威胁，真正实现攻击防御“智”能化。

极“简”运维融合云管理方案，即插即用，实现极速简易开局。

安全控制器组件化融入AC-Campus ，实现统一管理，策略下发，有效提升防火墙运维管理。