Dell Sonicwall Supermassive Next-Generation Firewall Series
Total Page:16
File Type:pdf, Size:1020Kb
Dell SonicWALL SuperMassive Next-Generation Firewall Series Network security The Dell™ SonicWALL™ SuperMassive™ eliminate threats before they enter the Series is Dell’s Next-Generation Firewall network and provides protection against (NGFW) platform designed for large millions of unique malware variants networks to deliver scalability, reliability without file size, performance or latency and deep security at multi-gigabit speeds limitations. The RFDPI engine also with near zero latency. provides full inspection of SSL-encrypted SuperMassive E10000 Series traffic as well as non-proxyable Built to meet the needs of enterprise, applications enabling complete government, university, and service protection regardless of transport provider deployments, the SuperMassive or protocol. Series is ideal for securing enterprise networks, data centers and service Application traffic analytics allow for SuperMassive 9000 Series providers. the identification of productive and unproductive application traffic in real Combining its massively multi-core time which can then be controlled Benefits: architecture and Dell SonicWALL’s through powerful application-level • Complete threat protection including patented* Reassembly-Free Deep Packet policies. Application control can be high performance intrusion prevention Inspection® (RFDPI) technology, the exercised on both a per-user and and low latency malware protection SuperMassive E10000 and 9000 Series per-group basis, along with schedules • Superior granular application deliver industry-leading application and exception lists. All application, intelligence, control and visualization control, intrusion prevention, malware intrusion prevention, and malware • Full inspection of SSL encrypted protection and SSL inspection at multi- signatures are constantly updated traffic without overhead, latency, and gigabit speeds. The SuperMassive Series is by the Dell SonicWALL Threats Research memory thrashing associated with designed with power, space, and cooling Team. Additionally, SonicOS, an advanced socket-based SSL proxies (PSC) in mind, providing the leading purpose-built operating system, provides • Massively scalable multicore Gbps/Watt NGFW in the industry for integrated tools that allow for custom architecture designed for 10/40 Gbps application control and threat prevention. application identification and control. infrastructure The Dell SonicWALL RFDPI engine scans The design of the SuperMassive every byte of every packet across all Series firewalls provides near-linear ports, delivering full content inspection of performance increases and scales up to the entire stream while providing high 96 cores of processing power to deliver performance and low latency. This up to 30 Gbps of threat prevention and technology is superior to outdated proxy 30 Gbps of application inspection and designs that reassemble content using control. The SuperMassive E10000 Series sockets bolted to anti-malware programs is field upgradeable, future-proofing the that are plagued with inefficiencies and security infrastructure investment as overhead of socket memory thrashing network bandwidth and security that leads to high latency, low performance requirements increase. and file size limitations. The RFDPI engine delivers full content inspection to *U.S. Patents 7,310,815; 7,600,257; 7,738,380; 7,835,361 Series lineup modules, and massively scales up to 96 management interfaces, with an The Dell SonicWALL SuperMassive processing cores. expansion port for an additional 2 x E10000 Series chassis includes 6 x 10-GbE SFP+ interfaces (future release). 10-GbE SFP+ and 16 x 1-GbE SFP ports, The Dell SonicWALL SuperMassive 9000 The 9000 Series features dual hot redundant 850W AC power supplies, Series features 4 x 10-GbE SFP+, 8 x swappable fan modules and power hot swappable dual redundant fan 1-GbE SFP, 8 x 1-GbE Copper and 1 GbE supplies. SuperMassive E10000 Series 80 GB 6 x 10-GbE 16 x LCD display LCD controls SSD drive SFP+ ports 1-GbE SFP ports Hot swappable redundant 850W power supplies Module slot fan Console Future 1-GbE Dual Status LED port use management USB ports indicators Two hot swappable dual redundant fan modules interface SuperMassive 9000 Series LCD Dual 4 x 10-GbE 8 x 1-GbE 8 x 1-GbE Expansion bay for Dual hot controls USB ports SFP+ ports SFP ports ports future use swappable fans LCD Console 1 GbE management display port interface Two hot swappable redundant power supplies Capability 9200 9400 9600 E10200 E10400 E10800 Processing cores 24 32 32 24 48 96 Firewall throughput 15 Gbps 20 Gbps 20 Gbps 10 Gbps 20 Gbps 40 Gbps Application intelligence 30 Gbps 5 Gbps 8 Gbps 9.7 Gbps 7.5 Gbps 15 Gbps throughput IPS throughput 5 Gbps 8 Gbps 9.7 Gbps 7.5 Gbps 15 Gbps 30 Gbps Anti-malware 3.5 Gbps 4.5 Gbps 5 Gbps 3 Gbps 6 Gbps 12 Gbps Maximum connections 1.25 M 1.25 M 1.5 M 3 M 6 M 12 M Deployment Modes 9200 9400 9600 E10200 E10400 E10800 L2 Bridge, Transparent Mode Yes Yes Yes Yes Yes Yes Wire Mode Yes Yes Yes Yes Yes Yes Gateway/NAT Mode Yes Yes Yes Yes Yes Yes Tap Mode Yes Yes Yes Yes Yes Yes Transparent Bridge Mode Yes Yes Yes Yes Yes Yes Maximum connections 1.25 M 1.25 M 1.5 M 3 M 6 M 12 M 2 Reassembly-Free Deep Packet and decryption in order to neutralize encounters a state of attack, or other Inspection engine advanced evasion techniques that “match” event, at which point a pre- seek to confuse detection engines set action is taken. In most cases, the The Dell SonicWALL Reassembly-Free and sneak malicious code into the connection is terminated and proper Deep Packet Inspection (RFDPI) engine network. Once a packet undergoes the logging and notification events are provides superior threat protection necessary pre-processing, including SSL created. However, the engine can also and application control without decryption, it is analyzed against a single be configured for inspection only or, in compromising performance. This proprietary memory representation of case of application detection, to provide patented engine relies on streaming three signature databases: intrusion Layer 7 bandwidth management services traffic payload inspection in order to attacks, malware and applications. The for the remainder of the application detect threats at Layers 3-7. The RFDPI connection state is then advanced to stream as soon as the application is engine takes network streams through represent the position of the stream identified. extensive and repeated normalization relative to these databases until it Packet assembly-based process Packet reassembly-free process Packet Proxy Scanning disassembly Trac in Trac out Trac in Traffic out When proxy Inspection time becomes full or Inspection capacity Inspection time Inspection capacity content too large, Less More files bypass Min Max Less More Min Max scanning Reassembly-free packet scanning without proxy or content size limitations Competitive architecture Dell SonicWALL architecture Extensible architecture for sophisticated detection techniques. approach delivers extremely high new extreme scalability and Another aspect of the platform design is session establishment rates (new conn/ performance the unique ability to establish new sec) while Deep Packet Inspection is connections on any core in the system, enabled—a key metric that is often a The RFDPI engine is designed from the providing ultimate scalability and the bottleneck for data center deployments. ground up with an emphasis on ability to deal with traffic spikes. This providing security scanning at a high level of performance, to match both the inherently parallel and ever-growing nature of network traffic. When combined with 24-, 32-, 48- or 96-core processor systems, this parallelism- centric software architecture scales up perfectly to address the demands of deep packet inspection at high traffic loads. The SuperMassive platform relies 240 GbE 16 x 1 GbE SFP SM Interconnect on processors that, unlike x86, are optimized for packet, crypto and network processing while retaining flexibility and programmability in the field—a weak point for ASICs systems. 6 x 10 GbE SFP+ This flexibility is essential when new code and behavior updates are necessary to protect against new attacks 96 Cores that require updated and more 3 Security and protection to protect against wide classes of attacks, The dedicated, in-house Dell covering up to tens of thousands of SonicWALL Threats Research Team individual threats with a single signature. works on researching and developing In addition to the countermeasures on countermeasures to deploy to the the appliance, SuperMassive firewalls also have access to the Dell SonicWALL firewalls in the field for up-to-date Protection Collection protection. The team leverages more CloudAV Service, which extends the than one million sensors across the onboard signature intelligence with Creation Classification globe for malware samples, and for more than twelve million signatures, telemetry feedback on the latest threat and growing. This CloudAV database is information, which in turn is fed into the accessed via a proprietary light-weight intrusion prevention, anti-malware and protocol by the firewall to augment the application detection capabilities. Dell inspection done on the appliance. With SonicWALL NGFW customers with the Geo-IP and botnet filtering capabilities, latest security capabilities are provided Dell SonicWALL NGFWs are able to block continuously updated threat protection traffic from dangerous domains or entire around the clock, with new updates geographies in order to reduce the risk taking