Huawei Secospace USG6300 Series

Next-Generation Firewall

Product Features
Granular Application Access Control
USG6320
•• Identifies the application-layer attacks and their application, content,
time, user, and location information.
•• Provides all-round visibility into service status, network environment,
security postures, and user behaviors.
USG6330/6350/6360 •• Provides an analysis engine that integrates application identification and
security functions, such as IPS, AV, and data leak prevention, to prevent
application-based malicious code injections, network intrusions, and
data interceptions.

Excellent Performance
USG6370/6380/6390
•• Provides an Intelligent Awareness Engine (IAE) capable of parallel processing
with all security functions enabled after intelligent application identification.
Overview •• Improves application-layer protection efficiency and ensures the 10G+
Enterprise networks are evolving into next-generation networks that performance with all security functions enabled.
feature mobile broadband, big data, social networking, and cloud
services. Yet, mobile applications, Web2.0, and social networks expose Easy Security Management
enterprise networks to the risks on the open Internet. Cybercriminals can •• Classifies 6000+ applications into 5 categories and 33 subcategories
easily penetrate a traditional firewall by spoofing or using Trojan horses, and supports application access control based on the subcategories.
malware, or botnets. •• Complies with the minimum permission control principle and automatically
generates policy tuning suggestions based on network traffic and application risks.
HUAWEI Secospace USG6300 series is designed to address these •• Analyzes the policy matching ratio and discovers redundant and invalid
challenges, and providing a reliable and secure network for small and policies to remove policies and simplify policy management.
medium-sized enterprises. It analyzes intranet service traffic from six
dimensions, including application, content, time, user, attack, and Prevention of Unknown Threats
location and then automatically generates security policies as suggestions •• provide samples of worldwide suspicious threats. The USG6300 series
to optimize the security management and provide high-performance executes suspicious samples within the sandbox in the cloud to monitor
application-layer protection for enterprise networks. the activities of the samples and identifies unknown threats.
•• Automatically extracts threat signatures and rapidly synchronizes the
Note: USG6300 is next-generation firewall products series in USG (Unified signatures to the devices to defend against zero-day attacks.
Security Gateway) product family. •• Prevent Advanced Persistent Threat (APT) attacks using a reputation system.

INNOVATIVE ICT BUILDING A BETTER CONNECTED WORLD

Specifications
Model USG6320 USG6330 USG6350 USG6360 USG6370 USG6380 USG6390
Firewall throughput 2 Gbit/s 1 Gbit/s 2 Gbit/s 3 Gbit/s 4 Gbit/s 6 Gbit/s 8 Gbit/s
IPS throughput 700 Mbit/s 500 Mbit/s 950 Mbit/s 1.1 Gbit/s 2 Gbit/s 2 Gbit/s 2 Gbit/s
IPS+AV throughput 700 Mbit/s 500 Mbit/s 950 Mbit/s 1.1 Gbit/s 2 Gbit/s 2 Gbit/s 2 Gbit/s
Concurrent sessions 500,000 1,500,000 2,000,000 3,000,000 4,000,000 4,000,000 4,000,000
New sessions per second 20,000 30,000 30,000 30,000 60,000 70,000 80,000
VPN Throughput (IPSec) 400Mbit/s 400Mbit/s 400Mbit/s 400Mbit/s 3Gbit/s 3Gbit/s 3Gbit/s
Virtual firewalls 20 50 50 50 100 100 100
MTBF 19.06years 11.58years 11.58years 11.58years 11.96years 11.96years 11.96years
Fixed port 8GE 4GE+2Combo 8GE+4SFP
Expansion Slots - 2×WSIC
Interface module - 2×10GE (SFP+)+8×GE (RJ45), 8×GE (RJ45), 8×GE (SFP), 4×GE (RJ45) BYPASS
Height Desktop 1U
Dimensions (H×W×D) 300*220*44.5 442*421*43.6
Weight (full configuration) 1.7kg 10 kg
HDD - Optional. Supports single 300 GB hard disks (hot swappable).
Redundant power supply Adepter Optional
AC power supply 100 V to 240 V
DC power supply -
Maximum power 60W 170W
Temperature:
Operating environment: 0°C to 40°C Temperature: 0°C to 40°C/5°C to 40°C(with optional HDD)
(Temperature/ Humidity) Humidity: Humidity: 10% to 90%
10% to 90%
Non-operating environment Temperature: -40°C to 70°C/Humidity: 5% to 95%
Certifications ICSA Labs: Firewall, IPS
Functions
ACTUAL (Application, Content, Time, User, Attack, Location)–based awareness capabilities
Context awareness
Eight authentication methods (local, RADIUS, HWTACACS, SecureID, AD, CA, LDAP, and Endpoint Security)
Fine-grained identification of over 6000 application protocols, application-specific action, and online update of
protocol databases
Combination of application identification and virus scanning to recognize the viruses (more than 5 millions), Trojan
Application security
horses, and malware hidden in applications
Combination of application identification and content detection to identify file types and sensitive information to
prevent information leaks
Provides over 5000 signatures for attack identification.
Intrusion prevention Provides protocol identification to defend against abnormal protocol behaviors.
Supports user-defined IPS signatures.
Cloud-based URL filtering with a URL category database that contains over 85 million URLs in over 130 categories
Defense against web application attacks, such as cross-site scripting and SQL injection attacks
Web security
HTTP/HTTPS/FTP-based content awareness to defend against web viruses
URL blacklist and whitelist and keyword filtering
Real-time anti-spam to detect and filter out phishing emails
Local whitelist and blacklist, remote real-time blacklist, content filtering, keyword filtering, and mail filtering by
Email security
attachment type, size, and quantity
Virus scanning and notification for POP3/SMTP/IMAP email attachments
Data leak prevention based on content awareness
Data security File reassembly and data filtering for more than 30 file types (including Word, Excel, PPT, and PDF), and file blocking
for more than 120 file types
Virtualization of security features, forwarding statistics, users, management operations, views, and resources (such
Security virtualization
as bandwidths and sessions)
Defense against more than 10 types of DDoS attacks, such as the SYN flood and UDP flood attacks
Network security
VPN technologies: IPSec VPN, SSL VPN, L2TP VPN, MPLS VPN, and GRE
IPv4: static routing, RIP, OSPF, BGP, and IS-IS
Routing
IPv6: RIPng, OSPFv3, BGP4+, IPv6 IS-IS, IPv6 RD, and ACL6
Transparent, routing, or hybrid working mode and high availability (HA), including the Active/Active and Active/
Working mode and availability
Standby mode
Evaluates the network risks based on the passed traffic and intelligently generates policies based on the evaluation
to automatically optimize security policies. Supports policy matching ratio analysis and the detection of conflict and
Intelligent management redundant policies to remove them, simplifying policy management.
Provides a global configuration view and integrated policy management. The configurations can be completed in one page.
Provides visualized and multi-dimensional report display by user, application, content, time, traffic, threat, and URL.

e.huawei.com