Huawei Next-Generation Firewall Analysis

A few days ago, at the 2013 Huawei Enterprise Network Conference, Huawei officially released Huawei's next-generation firewall product (NGFW).

In a white paper published by Gartner in 2009, the concept of next-generation firewalls was first proposed. In the four years since then, user needs have also changed. Their appeal to the NGFW is generally concentrated on the following issues:

First, whether the control is accurate enough. How to identify the latest applications, how to identify risks in the application process, how to solve the problem of the boundary failure in the new IT environment, and re-establish the effective management and control of the network boundary has become the top challenge of the NGFW.

Second, management is simple enough. With the addition of many management and control dimensions for the next-generation firewall, the complexity of management configuration has been doubled, but for users, the simpler the better.

Third, the unknown threat can be discerned. In recent years, new threats and new challenges have continued to increase. In particular, there have been more and more unknown attacks. Many of these attacks are very subtle and require delays to be detected and new threats must be protected.

Fourth, the performance is enough. Once mandatory protection is applied to some products, the performance drops sharply and is basically unavailable. The NGFW must have special testing methods and threshold requirements in terms of performance.

Now some firewall products just add some simple application identification, or from the form of traffic control plus some threat prevention and control capabilities, it is called the next-generation firewall, most of them are still to meet the market promotion. According to Gartner's definition, the next-generation firewall must meet the following requirements. First, it should have basic firewall functions, such as NAT and VPN, as well as application identification capabilities. This is the most essential nature of the NGFW; The integration with IPS depth should not be a simple function overlay. Third, Gartner also requires the NGFW to provide some auxiliary functions such as intelligent linkage and intelligent analysis. In addition, the main application scenario of the next-generation firewall at the beginning of design is the export of large-scale enterprises, mainly for medium and high-end users.

Huawei believes that the NGFW should make corresponding improvements in the following aspects: First, more granular management and control, matching IT mobility, virtualization, and socialization. In addition to value applications, users, and content, they should also be aware of location, risk, and Equipment and so on. The second is intelligent management. Huawei hopes to provide a new management and control method for the NGFW, allowing users and administrators to let IT managers use smarter, more concise methods to use next-generation firewalls and automatically identify applications and risks in the network. And questions, give reasonable opinions and suggestions. The third is comprehensive protection, not only identifying applications, but also identifying application threats, risks and unknown threats, and possessing ATP defense techniques and means. Fourth, the high-performance experience. The basic performance of the NGFW is the firewall plus application identification. After the application is enabled, the FW performance is recognized to represent the basic performance of the NGFW. In order to make various threat features of the NGFW available, the relative performance of the full threat protection is relatively low, which should not exceed 50%.

In addition, compared with other vendors' products, Huawei NGFW products have four major advantages:

The first is to provide the most accurate access control. Through Huawei's unique ACTUAL six-dimensional control mechanism, it can provide more than 6,000 application identifications and 85 million web filtering.

The second is to have the simplest management configuration, with active traffic learning and automatic policy suggestion functions, with a TCO reduction of up to 30%;

Thirdly, it is the most comprehensive threat protection, adopting the defense and protection mechanisms of the cloud and sandbox, reaching the full-threat defense and 10Gb traffic monitoring at the application layer;

The fourth is to provide users with the highest performance experience through redesigned hardware and advanced dedicated processors.