Huawei's next-generation firewall is about to be presented

With the popularization of intelligent terminals and facing new challenges, Huawei’s security has its own unique claims. ICT convergence involves the cloud, management, and end. Huawei's entire industry is closely related to the ICT pipeline. Security solutions also focus on cloud data center security solutions, campus network and wide area network security solutions, and mobile office security solutions. Expand. As the core component of the next-generation campus network security, Huawei NGFW will also be officially launched in September at the network conference, and it will be sold worldwide.

The word NGFW was first proposed by Gartner. In 2009 Gartner released a white paper that first proposed the concept of a next-generation firewall. Four years later, many security vendors claim that next-generation firewall products have mushroomed. However, why is China officially releasing next-generation firewall products in the second half of this year? What are the strengths of Huawei's next-generation firewall and what are the differences between these firewalls in the industry? Zhu Feng, Huawei's enterprise network product line security marketing manager gave a splendid speech on these issues and also explained in detail how Huawei has defined the next-generation firewall.

Before describing the features of Huawei firewalls, Zhu Fengxian led everyone to review the development of the entire firewall. "In the PC era that began in 1989, firewalls were still based on packet filtering mechanisms. Their main function was basic access control. In 1994, when it entered the Internet age, firewalls introduced a session mechanism, mainly based on state detection. Some well-known manufacturers have launched their own Products; In 1998, the arrival of the Internet era, ASIC-based firewalls also officially debuted, creating a company such as NetScreen, began to use a dedicated chip to enhance performance; 2004 to 2008, is the era of web2.0, when the firewall stressed The multi-functional overlay has also been improved in performance due to the adoption of a multi-core and distributed architecture. Huawei's 10-Gigabit firewall service was also released during this period; in 2009, with the advent of the mobile Internet era, the traditional firewall The management mechanism has become unable to cope with the new network changes. In this way, Gartner defined the NGFW and began to have a next-generation firewall based on user + application + content as the basis for management and control, and it is really a manufacturer.

From the initial development to the present evolution of the firewall, there are three main points. The first point is the access control, from the initial simple access control to the session-based control and then to the next-generation firewall based on applications, users and content. Controls are all aimed at achieving more effective and accurate access control. The second is that threat protection is getting stronger and stronger. The firewall was originally used for isolation. Later, DDoS protection, intrusion detection, and other threat protection functions were gradually added. The protection methods for threats, including the next-generation firewall, were also increasing. The scope of protection is also growing. The third is the enhancement of performance. The performance is increasing along with the needs of the entire business. Through the design of hardware and software, the business matches the degree.

Now some firewall products just add some simple application identification, or from the form of traffic control plus some threat prevention and control capabilities, it is called the next-generation firewall. Currently, these next-generation firewalls on the market are mixed, and most of them are still in order to cater to market propaganda. They are not really the next-generation firewalls. The next-generation firewall must meet the following requirements: First, it should have the basic firewall functions, such as NAT, VPN, and application identification capabilities. This is the core nature of the NGFW; the second is to talk to the depth of the IPS. The integration cannot be a simple function overlay. Third, Gartner also requires the NGFW to provide some auxiliary functions such as intelligent linkage and intelligent analysis. In addition, the main application scenario of the next-generation firewall at the beginning of design is the export of large-scale enterprises, mainly for medium and high-end users.

Although the concept of the next-generation firewall has been proposed for four years, the IT environment has undergone tremendous changes in four years: socialization, mobility, virtualization, and cloudization, making mobile and web applications the main battlefield for security; hacking attacks Industrialization makes the attack activities more intensive and the threat environment more treacherous. APT makes it takes longer to find threats and malicious behavior is difficult to find. In the four years, user needs have also changed. Their appeal to the NGFW is generally concentrated on the following issues:

First, whether the control is accurate enough. How to identify the latest applications, how to identify risks in the application process, how to solve the problem of the boundary failure in the new IT environment, and re-establish the effective management and control of the network boundary has become the top challenge of the NGFW.

Second, management is simple enough. With the addition of many management and control dimensions for the next-generation firewall, the complexity of management configuration has been doubled, but for users, the simpler the better.

Third, the unknown threat can be discerned. In recent years, new threats and new challenges have continued to increase. In particular, there are more and more unknown attacks. Many attacks are very subtle and require time-delay detection. Hackers are already organized and even nationalized. The role of the firewall is similar to that of the gatekeeper at the exit of the network. It must be able to protect against new threats.

Fourth, the performance is enough. Some products once forced protection is turned on, the performance drops sharply and is basically unavailable. If the NGFW does not want to make the same mistakes, it must have special testing methods and thresholds in terms of performance. It does not mean that certain features can be used to meet these requirements. To be available in a real network environment rather than furnishings.

Talking about how Huawei defines the next-generation firewall, Zhu Feng said: “We think that NGFW should make corresponding improvements in the following aspects. First, we hope that NGFW will do more fine-grained management and control to match the mobility, virtualization, and socialization of IT. In addition to value applications, users, and content, they should also be aware of locations, risks, and equipment, etc. Second, intelligent management, Huawei hopes to provide a new management and control method for NGFWs, giving users and administrators more intelligent IT managers. A more concise way to use next-generation firewalls, and can automatically identify applications, risks, and problems in the network, give reasonable opinions and suggestions.The third is comprehensive protection, not only identify applications, but also identify application threats, identify risks As well as identifying unknown threats, we need to have ATP defense techniques and means to tell them what risks are there. Fourth, we believe that the basic performance of the NGFW is firewall plus application identification. It must be based on applications. , but no longer what the so-called big packet FW throughput, packet FW throughput, the user bought NGFW will open If the application identification function is used, the FW performance after the application recognition is enabled can represent the basic performance of the NGFW, and in addition, the performance of the full threat protection is relatively low compared to the basic performance in order to make various threat features of the NGFW available. %."

Talking about why Huawei started promoting NGFW products this year, Zhu Feng said: "Huawei has been a firewall product since 2003, and has released 10Gb products by 2009, and has released a new software version by the end of 2011. The integration of user applications and content management and control methods is in full compliance with the NGFW standard, but we did not say that we are an NGFW, but only an upgrade. We believe that at that time the product did not meet the target in terms of customer experience, and it was not sufficient to Fundamentally solving the new problems faced by users: Huawei hopes to officially launch its own strength after being injected into NGFW products instead of hurrying out to cater to market promotion, so Huawei redesigned the hardware of NGFW products and rewritten the software. And stand in a new perspective to design the user experience."

Huawei will soon release a full range of NGFW products in a total of 10 devices, covering 1G-40G application layer performance, with 20G full threat protection performance. Compared with other vendors' products, Huawei NGFW has four major advantages. The first is to provide the most accurate access control. Through Huawei's unique ACTUAL six-dimensional control mechanism, it can provide more than 6000 application identifications and 85 million web filtering. The second is to have the simplest management configuration, with active traffic learning and automatic policy advice features, TCO reduction of up to 30%; Third, the most comprehensive threat protection, the use of the cloud and sandbox defense and protection mechanisms to reach the full threat of the application layer Defensive and 10Gb traffic monitoring; Fourth, through the redesigned hardware and the use of advanced dedicated processors, to provide users with the highest performance experience.