لایسنس سیسکو FirePower

لایسنس سیسکو 9300 Firepower

فایروال سیسکو سری Firepower 9300

 

لایسنس سیسکو فایرپاور سری 9300 از جمله دیگر محصولات امنیتی کمپانی سیسکو می باشد. این محصول جهت استفاده در Data Centerها و دیگر موارد که نیاز به کارایی بالا، زمان تأخیر کم و توان عملیاتی بالا نیاز دارند، مناسب و ایده آل است. این دستگاه امنیتی یکپارچه و قابل ارتقاء را برای بار کاری و جریان داده بر روی محیط های Cloud، مجازی و فیزیکی ارائه می دهد.

فایروال سری Firepower 9300 با سرویس های یکپارچه شده که به همراه دارد، هزینه ها را کاهش می دهد و شبکه های Open Programmable را پشتیبانی می کند. فایروال 9300 پلتفرمی قابل ارتقاء می باشد که حداکثر 1.2Tbps توان عملیاتی را فراهم می کند. از جمله قابلیت های ویژه این دستگاه می توان به Carrier-grade و ماژولار بودن آن اشاره کرد. این محصول جهت استفاده در مراکز محاسبات با کارایی بالا، دانشگاه ها، محیط های تجاری با فرکانس زیاد و دیگر محیط هایی که به تأخیر کم (کمتر از 5 میکروثانیه offload) و توان عملیاتی بسیار بالا نیاز دارند، مناسب و ایده آل است. فایروال 9300 ویژگی های دیگری نظیرFlow-offloading ،Programmatic Orchestration و مدیریت سرویس های امنیتی با RESTful APIs را فراهم می آورد. فایروال 9300 از طریق کنترل اپلیکیشن، ۵۷ میلیون اتصال همزمان و ۵۰۰۰۰۰ اتصال جدید در هر ثانیه را پشتیبانی می کند.

شاسی 9300 که جز قدرتمند ترین فایروال های سیسکو می باشد دارای سایز 3RU است. این فایروال یک ماژول Supervisor دارد که وظیفه مدیریت ارتباط بین اجزای مختلف شاسی را بر عهده دارد. به صورت پیش فرض 8 پورت 10Gbps بر روی Supervisor قرار دارد و می توانیم دو ماژول دیگر نیز برای افزایش پورت به آن اضافه کنیم. ماژول هایی که اضافه می شوند قابلیت ارائه پورت ها با سرعت 40Gbps و حتی 100Gbps را نیز دارند.

فایروال مدل 9300 توانایی این را دارد تا بتوانیم حداکثر تا سه Security Module به آن اضافه کنیم که این Security Module ها در رده های مختلفی وجود دارند. فایروال 9300 برای شبکه های سرویس دهنده و Data Center های بزرگ مناسب می باشد.

Cisco Firepower 9300 Overview

 

firepower-9300

فروش لایسنس سیسکو فایرپاور

 

 

firepower-9300-supervisor-module

firepower-9300-supervisor-module

 

posted this on Apr 25, 2018

Cisco Firepower 9000 Series, Modular security platform for service providers

This carrier-grade next-generation firewall (NGFW) is ideal for data centers and other high-performance settings that require low latency and high throughput. Deliver scalable, consistent security to workloads and data flows across physical, virtual, and cloud environments. With tightly integrated services, the Firepower 9000 Series lowers costs and supports open, programmable networks.

Firepower 9300

1.2 Tbps clustered throughput
10/40/100 Gb Network Interfaces
57 million concurrent connections, with application control
500,000 new connections per second
Security services options: AVC, NGIPS, AMP, URL Filtering, DDos Mitigation

Supervisor

  • 8x 10GE SFP+ ports
  • Management processor: Unknown
  • Management memory: 32GB DDR4 2133MHz
  • Management SSD: Micron M500 mSATA 120GB
  • Backplane: Broadcom StrataXGS Trident II
  • Backplane model: BCM56852A0KFSBG 960Gbit/s

FirePower 9300 Security Module

Firepower 9300 can contain one supervisor with up to two network modules, three security modules (blades) of one kind (either SM24, SM36 or SM44) and two power supply’s in the front. In the back there are 4 hot-swappable fans.

FP 9300 Security Module 24-Enterprise

  • 24 physical cores (48 logical cores) Dual 12 core Xeon E5-2658v3 2.2GHz (2.9GHz turbo)
  • 256GB DDR4 RAM 2133MHz RDIMM
  • Two 800GB SSDs in RAID1
  • Two Smart NIC–Cruz custom Cisco ASIC
  • Two Crypto Accelerator-Cavium Nitrox V XL NHB PCIe Gen3 x16 (CNN55XX-NHB)

FP 9300 Security Module 36-Extreme

  • 36 physical cores (72 logical cores) Dual 18 core Xeon E5-2699v3 2.3GHz (3.6GHz turbo)
  • 256GB DDR4 RAM 2133MHz RDIMM
  • Two 800GB SSDs in RAID1
  • Two Smart NIC–Cruz custom Cisco ASIC
  • Two Crypto Accelerator-Cavium Nitrox V XL NHB PCIe Gen3 x16 (CNN55XX-NHB)

FP 9300 Security Module 44

  • 44 physical cores (88 logical cores) Dual 22 core Xeon E5-2699v4 2.2GHz (3.6GHz turbo)firepower-9300
  • 256GB DDR4 RAM 2400MHz RDIMM
  • Two 800GB SSDs in RAID1
  • Two Smart NIC–Cruz custom Cisco ASIC
  • Two Crypto Accelerator-Cavium Nitrox V XL NHB PCIe Gen3 x16 (CNN55XX-NHB)

Cisco Firepower 9300 Series appliances

Cisco Firepower® 9300 is a scalable (beyond 1 Tbps when clustered), carrier-grade, modular platform designed for service providers, high-performance computing centers, large data centers, campuses, high- frequency trading environments, and other point in network requiring low (less than 5-microsecond offload) latency and exceptional throughput. Firepower 9300 supports flow-offloading, programmatic orchestration, and the management of security services with RESTful APIs. It is also available in Network Equipment Building Standards (NEBS)-compliant configurations. The 9300 Series runs either the Cisco Secure Firewall ASA or Threat Defense (FTD) software.

Model overview

Cisco Firepower 9300 Series summary

Model

Firewall – ASA Software

Firewall – Threat Defense (FTD) Software

IPS Throughput

Interfaces

Optional interfaces

SM-24 75G 21G 30G 8 x SFP+ on-chassis 2 x NM’s: 1/10/40/100G, FTW
SM-36 80G 29G 37G 8 x SFP+ on-chassis 2 x NM’s: 1/10/40/100G, FTW
SM-40 (New) 80G 48G 57G 8 x SFP+ on-chassis 2 x NM’s: 1/10/40/100G, FTW
SM-44 80G 43G 57G 8 x SFP+ on-chassis 2 x NM’s: 1/10/40/100G, FTW
SM-44 x 3 234G 132G 148G 8 x SFP+ on-chassis 2 x NM’s: 1/10/40/100G, FTW
SM-48 (New) 80G 55G 65G 8 x SFP+ on-chassis 2 x NM’s: 1/10/40/100G, FTW
SM-56 (New) 80G 64G 73G 8 x SFP+ on-chassis 2 x NM’s: 1/10/40/100G, FTW
SM-56 x 3 235G 153G 175G 8 x SFP+ on-chassis 2 x NM’s: 1/10/40/100G, FTW

Detailed performance specifications and feature highlights

Table 1.        Performance specifications and feature highlights for Cisco Firepower 9300 with the Cisco Threat Defense (FTD) image

Features

SM-24

SM-36

SM-40

SM-44

3 x SM-44

SM-48

SM-56

3 x SM-56

Throughput: Firewall (FW) + Application Visibility and Control (AVC) (1024B) 25 Gbps 34 Gbps 54 Gbps 50 Gbps 148 Gbps 64 Gbps 70 Gbps 168 Gbps
Throughput: FW + AVC + Intrusion Prevention

System (IPS (1024B)

21 Gbps 29 Gbps 48 Gbps 43 Gbps 132 Gbps 55 Gbps 64 Gbps 153 Gbps
Maximum concurrent sessions, with AVC 30 million 30 million 35 million 30 million 63 million 35 million 35 million 60 million
Maximum new connections per second, with AVC 130K 185K 380K 295K 850K 450K 490K 1.1M
TLS (Hardware Decryption)2 7.5 Gbps 8.5 Gbps 10 Gbps 10 Gbps 25 Gbps 11 Gbps 12 Gbps 28 Gbps
Throughput: NGIPS (1024B) 30 Gbps 37 Gbps 57 Gbps 57 Gbps 148 Gbps 66 Gbps 73 Gbps 175 Gbps
IPSec VPN throughput

(1024B TCP /Fastpath)

13.5 Gbps 16 Gbps 20 Gbps 17 Gbps 51 Gbps 25 Gbps 27 Gbps 81 Gbps1
Maximum VPN Peers 20,000 20,000 20,000 20,000 60,000 20,000 20,000 60,000
Centralized management Centralized configuration, logging, monitoring, and reporting are performed by the Management Center or alternatively in the cloud with Cisco Defense Orchestrator
AVC Standard, supporting more than 4000 applications, as well as geolocations, users, and websites
AVC: OpenAppID support for custom, open-source

application detectors

Standard
Cisco Security Intelligence Standard, with IP, URL, and DNS threat intelligence
Cisco IPS License Available; can passively detect endpoints and infrastructure for threat correlation and Indicators of Compromise (IoC) intelligence
Cisco Malware

Defense for Networks

Available; enables detection, blocking, tracking, analysis, and containment of targeted and persistent malware, addressing the attack continuum both during and after attacks. Integrated threat correlation with Cisco Secure Endpoint is also optionally available
Cisco Malware Analytics
(sandboxing)
Available
URL filtering: number of categories More than 80
URL filtering: number of URLs categorized More than 280 million
Automated threat feed and IPS signature updates Yes: class-leading Collective Security Intelligence (CSI) from the Cisco Talos® group (https://www.cisco.com/c/en/us/products/security/talos.html)
Third-party and open- source ecosystem Open API for integrations with third-party products; Snort® and OpenAppID community resources for new and specific threats
High availability and clustering Active/standby; up to 6 modules across up to 6 different Firepower 9300 chassis.
Cisco Trust Anchor Technologies Cisco Firepower 9300 Series platforms include Trust Anchor Technologies for supply chain and software image assurance.

Note:     Performance varies depending on features activated, network traffic protocol mix, and packet size. Performance is subject to change with new software releases. Consult your Cisco rep for sizing guidance.

1 In unclustered configuration.

2 Throughput measured with 50% TLS 1.2 traffic with AES256-SHA with RSA 2048B keys.

Table 2.        ASA software performance and capabilities on Cisco Firepower 9300

Features

SM-24

SM-36

SM-40

SM-44

3 x SM-44

SM-48

SM-56

3 x SM-56

Stateful inspection firewall throughput1 75 Gbps 80 Gbps 80 Gbps 80 Gbps 234 Gbps 80 Gbps 80 Gbps 235 Gbps
Stateful inspection firewall throughput (multiprotocol)2 50 Gbps 60 Gbps 55 Gbps 60 Gbps 130 Gbps 60 Gbps 64 Gbps 172 Gbps
Concurrent firewall connections 55 million 60 million 55 million 60 million 70 million 60 million 60million 195 million
Firewall latency
(UDP 64B microseconds)
3.5 3.5 3.5 3.5 3.5 3.5 3.5 3.5
New connections per second 800,000 1.2 million 1.6 million 1.8 million 4 million 1.8 million 2 million 4.75 million
IPsec VPN throughput (450B UDP L2L test) 15 Gbps 18 Gbps 25 Gbps 20 Gbps 60 Gbps3 27 Gbps 30 Gbps 74 Gbps
Maximum VPN Peers 20,000 20,000 20,000 20,000 60,000 20,000 20,000 60,000
Security contexts (included; maximum) 10; 250
High availability Active/active and active/standby
Clustering Up to 16 security modules across up to 16 different Firepower 9300 chassis
Scalability VPN load balancing, firewall clustering
Centralized management Centralized configuration, logging, monitoring, and reporting are performed by Cisco Security Manager or alternatively in the cloud with Cisco Defense Orchestrator
Adaptive Security Device Manager Web-based, local management for small-scale deployments

1 Throughput measured with 1500B User Datagram Protocol (UDP) traffic measured under ideal test conditions.

2 “Multiprotocol” refers to a traffic profile consisting primarily of TCP-based protocols and applications like HTTP, SMTP, FTP, IMAPv4, BitTorrent, and DNS.

Performance testing methodologies LINK

Hardware specifications

Table 3.        Cisco Firepower 9300 Series hardware specifications

Specification

Description

Dimensions (H x W x D) 5.25 x 17.5 x 32 in. (13.3 x 44.5 x 81.3 cm)
Form factor 3 Rack Units (3RU), fits standard 19-in. (48.3-cm) square-hole rack
Security module slots 3
Network module slots 2 (within supervisor)
Supervisor Cisco Firepower 9000 Supervisor with 8 x 10 Gigabit Ethernet ports and 2 network module slots for I/O expansion
Security modules ●  Cisco Firepower 9000 Security Module 40 with 2 x SSDs in RAID-1 configuration

●  Cisco Firepower 9000 Security Module 48 with 2 x SSDs in RAID-1 configuration

●  Cisco Firepower 9000 Security Module 56 with 2 x SSDs in RAID-1 configuration

Network modules

(2 module slots per chassis)

●  8 x 10 Gigabit Ethernet Enhanced Small Form-Factor Pluggable (SFP+) network modules

●  4 x 40 Gigabit Ethernet Quad SFP+ network modules

●  2 x 100 Gigabit Ethernet Quad SFP28 network modules

●  4 x 100 Gigabit Ethernet Quad SFP28 network modules

Note: Cisco Firepower 9300 may also be deployed as a dedicated threat sensor, with fail-to-wire network modules. Please contact your Cisco representative for details.

Maximum number of interfaces Up to 24 x 10 Gigabit Ethernet (SFP+) interfaces; up to 8 x 40 Gigabit Ethernet (QSFP+) interfaces with 2 network modules; up to 8 x 100 Gigabit Ethernet interfaces with two network modules
Integrated network management ports 1 x Gigabit Ethernet copper port (on supervisor)
Serial port 1 x RJ-45 console
USB 1 x USB 2.0
Storage Up to 4.8 TB per chassis (1.6 TB per security module in RAID-1 configuration)
Power supplies   AC power supply -48V DC power supply HVDC power supply
Input voltage 200 to 240V AC -40V to -60V DC* 240 to 380V DC
Maximum input current 15.5A to 12.9A 69A to 42A <14A at 200V
Maximum output power 2,500W 2,500W 2,500W
Frequency 50 to 60 Hz
Efficiency (at 50% load) 92% 92% 92% (at 50% load)
Redundancy 1+1
Fans 4 hot-swappable fans
Noise 75.5 dBA at maximum fan speed
Rack mountable Yes, mount rails included (4-post EIA-310-D rack)
Weight 105 lb (47.7 kg) with one security module; 135 lb (61.2 kg) fully configured
Temperature: standard operating Up to 10,000 ft (3000 M): 32 to 104°F (0 to 40°C) for SM-24 module 32 to 88°F (0 to 35°C) for SM-36 module at sea level

Altitude adjustment notes:

For SM-36, maximum temp is 35°C, for every 1000 feet above sea level subtract 1°C

Temperature: NEBS operating Long term: 0 to 45°C, up to 6,000 ft (1829 m) Long term: 0 to 35°C, 6,000 to 13,000 ft (1829-3964 m) Short term: -5 to 55°C, up to 6,000 ft (1829 m)

Note: Firepower 9300 NEBS compliance applies only to SM-24,SM-40,SM-44 and SM-48 configurations.

Temperature: nonoperating -40 to 149°F (-40 to 65°C); maximum altitude is 40,000 ft
Humidity: operating 5 to 95% noncondensing
Humidity: nonoperating 5 to 95% noncondensing
Altitude: operating SM-24: 0 to 13,000 ft (3962 m)

SM-36: 0 to 10,000 ft (3048 m); please see above Operating Temperature section for temperature adjustment notes

Altitude: nonoperating 40,000 ft (12,192 m)

* Minimum turn-on voltage is -44V DC.

Table 4.        Cisco Firepower 9300 Series NEBS, regulatory, safety, and EMC compliance

Specification

Description

NEBS Cisco Firepower 9300 is NEBS compliant with SM-24,SM-40, SM-44 and SM-48 Security Modules
Regulatory compliance Products comply with CE markings per directives 2004/108/EC and 2006/108/EC
Safety ●  UL 60950-1

●  CAN/CSA-C22.2 No. 60950-1

●  EN 60950-1

●  IEC 60950-1

●  AS/NZS 60950-1

●  GB4943

EMC: emissions ●  47CFR Part 15 (CFR 47) Class A (FCC Class A)

●  AS/NZS CISPR22 Class A

●  CISPR22 CLASS A

●  EN55022 Class A

●  ICES003 Class A

●  VCCI Class A

●  EN61000-3-2

●  EN61000-3-3

●  KN22 Class A

●  CNS13438 Class A

●  EN300386

●  TCVN7189

EMC: immunity ●  EN55024

●  CISPR24

●  EN300386

●  KN24

●  TVCN 7317

●  EN-61000-4-2, EN-61000-4-3, EN-61000-4-4, EN-61000-4-5, EN-61000-4-6, EN-61000-4-8, EN61000-4-11

دیدگاهتان را بنویسید

نشانی ایمیل شما منتشر نخواهد شد. بخش‌های موردنیاز علامت‌گذاری شده‌اند *