Network security

Authentication, authorization, and accounting（AAA services

Local authentication

RADIUS authentication, supports the PAP and CHAP authentication

HWTACACS authentication

AD/LDAP authentication

PKI certificate authentication

Firewall

Basic ACLS and advanced ACLS

Based on the secure area access control

Based on the time period of access control

ASPF state of the firewall  

DOS/DDOS attack prevention: including SYN Flood, UDP Flood, ICMP Flood, ACK Flood, RST Flood, DNS Flood, HTTP Flood

Deformity pack attacks such as: Land, Smurf And Fraggle, the WinNuke, Ping of Death, Tear Drop, IP Spoofing, IP fragmented packet attacks, fragmented packet attacks, TCP packet flags unlawful attack, super large ICMP packet attack, ICMP redirect or unreachable packets

Scan spy attack prevention: port scanning, address scan, IP route Record option packets, Tracert packets

IP Spoofing attack prevention

Static and dynamic blacklist function

Connection limits

Supports N:1 SCF cluster technology

· Support multi-machine cluster

· Trunking equipment unified management

· The cluster service distributed processing

Support 1:N the virtual firewall technology

· Containerized virtualization technology, virtual firewall feature with a physical wall characteristics consistent

· Virtual firewall for stand-alone GUI/CLI management

· Virtual firewall separate configuration files

· Virtual firewall to separate the log host and the log audit

· Virtual firewall resource allocation: throughput, concurrent, new, policy

· Virtual firewall interfaces share

· N:1:M virtualization: the first multi-device cluster, and then the virtual firewall divided

NAT

The source address of the NAT

· * * Support, according to the policy specified after the conversion of the address pool;

· Support PAT, support NO-PAT

· Support unlimited connections

· Support IP sustainability, to ensure that the same source after the conversion of the address remain the same

· Support Easy IP

The destination address of the NAT

· Support address and Port of the one-to-one mapping

· Support multiple public IP addresses to the same private network address

· Support for policy-based destination NAT

Support static NAT

· Supports one-to-one static NAT

· Support for net-to-net static NAT

Support NAT444

· Support static NAT444

· Support for dynamic NAT444

Support Fullcone, to solve the P2P traversal problem

Support C/S Mode, P2P mode Hairpin techniques

Support port block increment allocation

Support DNS Mapping

Support a variety of ALG, including FTP, DNS, TFTP, SQLNET, SIP, RTSP, H323, SCCP, RSH, MGCP, GTP, PPTP, QQ, MSN

DPI

Support IPS

Support for Application Control and application bandwidth management

Support telnet, FTP, SMTP/POP3, HTTP content filtering

VPN

L2TP VPN

Support LNS

Support Auto-Initiated LAC

L2TP supports VRF

GRE VPN

GRE Over IPV4

GRE Over IPV6

GRE support VRF

GRE P2MP(planning)

IPSec/IKE

Security Protocol supported AH/ESP

Support for Transport and tunnel mode

ESP supports DES, 3DES and AES three encryption algorithms

Support MD5 and SHA-1 authentication algorithm

Support by manual or IKE mode to establish the SA

Support the anti-replay attack

Supports IPSec policy template

Supports IPSec reverse route injection

Support of IKEV1

Support IKE main mode and aggressive mode

Supported by a pre-shared key and certificate to verify the IKE Peer identity

Supports DPD

Support IKE Keppalive

Support NAT traversal(aggressive mode and main mode)

VRF-aware: by IKE peer-to-end information to determine belongs VPN

Supports IPSec hot standby(planning)

Support of the IKEV2（planning）

Network Protocol

LAN Protocol

Ethernet_II

802.1 Q

Layer Protocol

STP

MSTP

Network Protocol

IP services

ARP

· Static ARP

· Dynamic ARP

· ARP proxy

· Gratuitous ARP

DNS

· Local static domain name

· DNS Client

· DNS Proxy

· DDNS dynamic domain name service

DHCP

· DHCP relay

· DHCP server

· DHCP client

NTP

· NTP Client

· NTP Server

IP routing

Static routing management

Policy routing

Dynamic routing

· RIP-1/RIP-2

· OSPF

· BGP

· ISIS

· Routing policy

Multicast

· IGMP

· PM-SM

· PM-DM

High reliability

Support cluster deployment(up to 2)

Supported cluster within the 1:1 backup

Supported cluster within the N:N backup

Support selectively turned on the hot spare

VRRP/VRRP6V3

Supports static link aggregation, support Dynamic Link Aggregation, support for Cross-Device Link Aggregation

Link quality detection NQA

Support BFD

Hotfixes

Configuration management

Command line interface

Through the Console port for local configuration

Via Telnet or SSH for local or remote configuration

Support based on RBAC fine-grained access control, you can control specific commands permissions

User-interface configured to provide the login user multiple ways of authentication and authorization functions

The WEB network management interface

Support via WEB configuration

Supports WEB administrators timeout offline.

WEB user login and authentication

Support based on RBAC fine-grained access control, you can control specific web menu's authority to operate

Supports standard network management SNMP

Support SNMPV1 and V2c and SNMPV3

External management platform integration

Supported by IMC SSM components for device status monitoring and security policies, attack prevention, NAT and other security configuration management

IMC SSM components can be a desktop terminal linkage, found that attacks the user, automatically using the user offline

IMC SSM components of the device can attack log to audit the attack for Statistical Classification, you can count the source of the attack, the attack object

IMC SSM components may be implemented on a device session information, statistics, based on the source and destination show TopN session information

Supported by IMC BIMS to the device for remote configuration management

Security audit

Attack real-time log

Inter-domain policy matching logs

Blacklist log

Connecting to limit the number of log

Session log

NAT log

Traffic statistics and analysis

Security incidents statistics functions

IPV6

IPV6 Service

TELNET/FTP/RADIUS

Domain name resolution

DHCP Server

DHCPrelay

DHCPThe client

IPV6 Route

Static routing

Policy routing

RIPng

OSPFv3

BGP4+

ISIS6

IPV6 security

IPV6 object

IPV6 security policy

IPV6 stateful firewall

IPV6 attack prevention

IPV6 ALG  

IPV6 connection limits

IPV6 URPF

IPV6 virtual fragmentation reassembly

IPV6 IPSec VPN

IPV6 virtual firewall

IPV6 transition technologies

NAT-PT

NAT64\IVI

DS-LITE tunnel

ISATAP tunnels

IPv6 Over IPv4 GRE tunnel