E1100W / E1600 / E1606 / E1700

Hillstone A-Series
Next-Generation Firewall

The Hillstone A-Series next-generation firewall features high security performance, expansion as
needed, complete advanced threat detection and prevention, and smart and automated policy
operation. This future-ready NGFW series is based on a brand new hardware architecture that
offers industry-leading application layer performance to meet real-world network security needs.
High-density ports ensure excellent access capability, and large storage options offer better
visibility and analytics. As part of the ZTNA solution, A-Series NGFW granularly controls the
application access with eliminated implicit trust and continuous verification. The Hillstone A-Series
NGFW offers complete, advanced defenses against known and unknown threats, coupled with
smart, automated and efficient policy operation that makes security operations easy.

Product Highlights

Advanced Threat Detection and Protection sandbox provides sophisticated detection and prevention of
malicious files through static analysis and pre-processing,
The Hillstone A-Series NGFW includes a full arsenal of mech-
followed by behavioral analysis that includes detection of eva-
anisms to provide real-time detection and protection across
sive maneuvers. Cloud intelligence then identifies and blocks
the full lifecycle of network attacks and malwares. Before a
malicious files, generates logs and reports, and shares threat
breach can even occur, proactive protections like IPS block
intelligence back to the cloud.
the vulnerabilities exploitation. IP reputation services block
Completing protections across the full threat lifecycle,
requests from risky sites potentially involved in malware and
the A-Series continues to defend even after a breach has
spamming. URL filtering prevents users from inadvertently
occurred. Hillstone’s advanced Botnet C&C prevention feature
accessing sites associated with phishing, malware down-
prevents communication to the control channel, and detect
loads and other exploits. Anti-virus detects and blocks known
and block bots within the intranet as well.
malwares at the network level with an advanced signature
In addition, A-Series NGFW leverages machine learning
database that is continuously updated. Anti-spam provides
technology for intelligent security protection against known
real-time spam classification and prevention for both inbound
and unknown threats, such as intelligent DDoS, DGA, and
and outbound traffic.
encrypted traffic detection without decryption.
During a breach, anti-virus plays an important role as well
Further, the system’s unified threat detection and analytics
by continuing to detect and block known malwares. A cloud
engine coordinates across all built-in security mechanisms

www.HillstoneNet.com © 2024 Hillstone Networks All Rights Reserved. | 1

Hillstone A-Series Next-Generation Firewall

Product Highlights (Continued)

to dramatically enhance efficiency while reducing network hard disk storage up to 2 TB.
latency. With more storage the system can save more logs and data
for longer time, enabling deeper analysis. In addition, the
expanded storage allows the system to provide richer reports
High-Performance Hardware Architecture
with far more information, including visualized results and
The future-ready A-Series features compact form factor and
actionable recommendations.
a powerful computing foundation that ensures high perfor-
Further, with deeper threat analysis the WebUI can display
mance with uncompromising security. A-Series NGFWs offer
much richer threat detection information, which in turn gives
robust performance for firewall throughput, concurrent and
admins better visibility. The increased visibility lets admins
new sessions, and blazing fast performance for application
quickly zero in on anomalies and other suspicious network
layer, which is critical in meeting the needs of current security
events or traffic, analyze them and respond.
environments. Powered with Hillstone proprietary hardware
acceleration engine, A-Series NGFW high-end models enable
Smart Policy Operation
fast packet forwarding with high throughput and ultra-low
The A-Series includes intelligent management and operation
latency by traffic offloading. It also offers a friendly software
across the full policy lifecycle, from deployment to man-
ecology for third-party integration to support additional secu-
agement, optimization and operation. The system features
rity features if desired. All rackmount models feature front
automated user policy deployment using RADIUS dynamic
and rear ventilation to assist in heat dissipation, which is a
authorization. Policy management is made far more efficient
concern in networks of almost any size.
through policy groupings based on business requirements. In
addition, policies can be aggregated to allow a set of poli-
Excellent Access Capability and Storage Expansion
cies to act as a single policy. An innovative policy assistant
The Hillstone A-Series offers high I/O port density, allowing
analyzes traffic patterns and recommends refined policies
the NGFW to act as a switch or router as needed, lowering
for faster, easier and more accurate policy management.
deployment and management costs. In addition, expansion
Policy operation is made more efficient and precise through
slots are available for a number of A-Series models to further
policy redundancy checks, which identify redundant policies
increase performance. Bypass pairs on most A-Series models
for deactivation or deletion, and policy hit count analysis, that
help ensure business continuity.
helps further refine and adjust policies.
All models, including the desktop versions, include a large
onboard storage and have expansion options for very-large

www.HillstoneNet.com © 2024 Hillstone Networks All Rights Reserved. | 2

Hillstone A-Series Next-Generation Firewall

Features
Network Services SMTP, POP3, IMAP, FTP/SFTP, SMB Botnet C&C Prevention
• Dynamic routing (OSPF, OSPFv3, BGP with • Compressed file virus scanning • Discover intranet botnet host by monitoring C&C
graceful restart, RIPv2) connections and block further advanced threats
• Static and policy-based routing Attack Defense such as botnet and ransomware
• Route controlled by application • Abnormal protocol attack defense • Regularly update the botnet server addresses
• Built-in DHCP, NTP, DNS Server and DNS proxy • Flood attack defense, including ICMP flood, UDP • Prevention for C&C IP, domain name and URL
flood, DNS query flood, recursive DNS query flood, • Support TCP, HTTP, and DNS traffic detection
• Tap mode – connects to SPAN port DNS reply flood, SYN flood, SIP flood
• Interface modes: sniffer, port aggregated, • Allow and block list based on IP address, domain
• ARP spoofing and ND spoofing defense name, and URL
loopback, VLANS (802.1Q and Trunking)
• Scan and spoof defense, including IP address • Support DGA and DNS tunnel detection
• L2/L3 switching & routing spoof, IP address sweep, port scan
• Multicast(PIM-SSM) • Support DNS sinkhole
• Intelligent DoS/DDoS defense with ML-based
• Virtual wire (Layer 1) transparent inline baseline establishment, including ping of death
deployment attack, teardrop attack, IP fragment, IP option, IP Reputation
Smurf or Fragile attack, Land attack, large ICMP • Identify and filter traffic from risky IPs such as
Firewall packet, WinNuke attack botnet hosts, spammers, Tor nodes, breached
• Operating modes: NAT/route, transparent (bridge), • Allow list for destination IP address hosts, and brute force attacks
and mixed mode
• Active bypass with bypass interfaces • Logging, dropping packets, or blocking for different
• Policy objects: predefined, custom, aggregate types of risky IP traffic
• Support protection of brute force attacks including
policy, object grouping
VNC, RDP, SSH, LDAP, IMAP, SMB • Periodical IP reputation signature database
• Security policy based on application, role and upgrade
• Support protection of sensitive file scanning attack
geo-location
• Support reverse shell detection SSL Decryption
• Application Level Gateways and session support:
MSRCP, PPTP, RAS, RSH, SIP, FTP, TFTP, HTTP, URL Filtering • Application identification for SSL encrypted traffic
dcerpc, dns-tcp, dns-udp, H.245 0, H.245 1, H.323, • IPS enablement for SSL encrypted traffic
tcp full proxy • Flow-based web filtering inspection
• Manually defined web filtering based on URL, web • AV enablement for SSL encrypted traffic
• NAT and ALG support: NAT46, NAT64, NAT444,
SNAT, DNAT, PAT, Full Cone NAT (IPv4 and IPv6), content and MIME header • URL filter for SSL encrypted traffic
STUN • Dynamic web filtering with cloud-based real-time • SSL encrypted traffic whitelist
• NAT configuration: per policy and central NAT categorization database: over 140 million URLs • SSL proxy offload mode
table with 64 categories (8 of which are security related)
• SSL proxy supports IP whitelist and predefined
• VoIP: SIP/H.323/SCCP NAT traversal, RTP pin • Additional web filtering features: whitelist
holing - Filter Java Applet, ActiveX or cookie • SSL proxy supports session re-use
• Global policy management view - Block HTTP Post • Support AD/LDAP server connection via SSL
• Security policy redundancy inspection, policy - Log search keywords encryption
group, policy configuration rollback, aggregate - Exempt scanning encrypted connections on • Support TLS v1.2 to TLS v1.3
policy certain categories for privacy • Support application identification, DLP, IPS
• Policy Assistant for service base or application • Web filtering profile override: allows administrator sandbox, AV for SSL proxy decrypted traffic of
based policy recommendation to temporarily assign different profiles to user/ SMTPS/POP3S/IMAPS
• Policy analyzing and invalid policy cleanup group/IP
• Web filter local categories and category rating Endpoint Identification and Control
• Comprehensive DNS policy
override • Support to identify endpoint IP, endpoint quantity,
• Schedules: one-time and recurring
• Support URL allow list and block list on-line time, off-line time, and on-line duration
• Support policy import and export
• Support 10 operating systems including Windows,
• Support NAT redundancy detection Anti-Spam(1) iOS, Android, etc.
Intrusion Prevention • Real-time Spam Classification and Prevention • Support query based on IP, endpoint quantity,
• Confirmed Spam, Suspected Spam, Bulk Spam, control policy and status etc.
• Protocol anomaly detection, rate-based detection,
custom signatures, manual, automatic push or Valid Bulk • Support the identification of accessed endpoints
pull signature updates, integrated threat encyclo- • Protection Regardless of the language, format, or quantity across layer 3, logging and interference
pedia content of the message on overrun IP
• IPS Actions: default, monitor, block, reset • Support both SMTP and POP3 email protocols • Redirect page display after custom interference
(attackers IP or victim IP, incoming interface) with operation
• Inbound and outbound detection
expiry time • Supports blocking operations on overrun IP
• White lists to allow emails from trusted domains
• Packet logging option • User identification and traffic control for remote
• Filter Based Selection: severity, target, OS, appli- Cloud-Sandbox desktop services of Windows Server
cation or protocol • Upload malicious files to cloud sandbox for
Data Security
• IP exemption from specific IPS signatures analysis
• File transfer control based on file type, size and
• IDS sniffer mode • Support protocols including HTTP/HTTPS, POP3,
name
IMAP, SMTP, FTP and SMB
• Predefined prevention configuration • File protocol identification, including HTTP, FTP,
• Support file types including PE, ZIP, RAR, Office,
• IPS threat packet capture (with expansion storage SMTP, POP3 and SMB
PDF, APK, JAR, SWF and Script
only) • File signature and suffix identification for over 100
• File transfer direction and file size control
file types
Antivirus • Provide complete behavior analysis report for
• Content filtering for HTTP-GET, HTTP-POST, FTP
• Manual, automatic push or pull signature updates malicious files
and SMTP protocols
• Manually add or delete MD5 signature to the AV • Global threat intelligence sharing, real-time threat
• Content filtering for predefined keywords and file
database blocking
contents
• MD5 signature support uploading to cloud • Support detection only mode without uploading
• IM identification and network behavior audit
sandbox, and manually add or delete on local files
database • Filter files transmitted by HTTPS using SSL Proxy
• URL allow / block list configuration
and SMB
• Flow-based antivirus: protocols include HTTP,

www.HillstoneNet.com © 2024 Hillstone Networks All Rights Reserved. | 3

Hillstone A-Series Next-Generation Firewall

Features (Continued)
Application Control - IKEv1 support DH group 1,2,5,18,19,20,21,24 • Redundant heartbeat interfaces
• Over 6,000 applications that can be filtered by - IKEv2 support DH group • Active/Active peer mode with Hillstone Virtual
name, category, subcategory, technology and risk 1,2,5,14,15,16,18,19,20,21,24 Redundancy Protocol (HSVRP) support, and
• Each application contains a description, risk - XAuth as server mode and for dialup users Active/Passive mode
factors, dependencies, typical ports used, and - Dead peer detection • Standalone session synchronization
URLs for additional reference - Replay detection • HA reserved management interface
• Actions: block, reset session, monitor, traffic - Autokey keep-alive for Phase 2 SA • Failover:
shaping - Port, local & remote link monitoring
• IPsec VPN realm support: allows multiple custom
• Identify and control cloud applications in the cloud SSL VPN logins associated with user groups (URL - Stateful failover
• Provide multi-dimensional monitoring and paths, design) - Sub-second failover
statistics for cloud applications, including risk • IPsec VPN supports configuration guide. Config-
category and characteristics - Failure notification
uration options includes: route-based or policy
• Deployment options:
based
Quality of Service (QoS) - HA with link aggregation
• IPsec VPN deployment modes: gateway-to-
• Max/guaranteed bandwidth tunnels or IP/user - Full mesh HA
gateway, full mesh, hub-and-spoke, redundant
basis
tunnel, VPN termination in transparent mode - Geographically dispersed HA
• Tunnel allocation based on security domain,
• IPSec supports custom ports • Dual HA data link ports
interface, address, user/user group, server/server
group, application/app group, TOS, VLAN • IPSec VPN supports DPD On-Demand mode
Twin-mode HA (only available on A2715, A2815,
• Bandwidth allocated by time, priority, or equal • LLB and failover support over IPSec tunnels A3000 and above models)
bandwidth sharing • One time login prevents concurrent logins with the • High availability mode among multiple devices
• Type of Service (TOS) and Differentiated Services same username
• Multiple HA deployment modes
(DiffServ) and traffic-class support • SSL portal concurrent users limiting
• Configuration and session synchronization among
• Prioritized allocation of remaining bandwidth • SSL VPN port forwarding module encrypts client multiple devices
• Maximum concurrent connections per IP data and sends the data to the application server
• Bandwidth allocation based on URL category • Supports clients that run iOS, Android, Microsoft User and Device Identity
Windows, MacOS and Linux • Local user database
• Bandwidth limit by delaying access for user or IP
• Host integrity checking and OS checking prior to • Remote user authentication: TACACS+, LDAP,
• Automatic expiration cleanup and manual cleanup
SSL tunnel connections Radius, Active Directory, OAuth2
of user used traffic
• MAC host check per portal • Single-sign-on: Windows AD
Server Load Balancing • Cache cleaning option prior to ending SSL VPN • 2-factor authentication: 3rd party support,
• Weighted hashing, weighted least-connection, and session integrated token server with physical and SMS
weighted round-robin • L2TP client and server mode, L2TP over IPsec, and • User and device-based policies
• Session protection, session persistence and GRE over IPsec
• User group synchronization based on AD and
session status monitoring • View and manage IPsec and SSL VPN connec- LDAP
• Server health check, session monitoring and tions
• Support for 802.1X, SSO Proxy
session protection • PnPVPN
• WebAuth: page customization, force crack
• VTEP for VxLAN static unicast tunnel prevention, IPv6 support
Link Load Balancing
• Bi-directional link load balancing IPv6 • Interface based authentication
• Outbound link load balancing: policy based routing • Management over IPv6, IPv6 logging, HA and HA • Agentless ADSSO (AD Polling)
including ECMP, time, weighted, and embedded peer mode, twin-mode AA and AP • Use authentication synchronization based on
ISP routing; Active and passive real-time link • IPv6 tunneling: DNS64/NAT64, IPv6 ISATAP, IPv6 SSO-monitor
quality detection and best path selection GRE, IPv6 over IPv4 GRE, 6RD • Support IP-based and MAC-based user authenti-
• Inbound link load balancing supports SmartDNS • IPv6 routing including static routing, policy routing, cation
and dynamic detection ISIS, RIPng, OSPFv3 and BGP4+ • Radius server issues user security policy via CoA
• Automatic link switching based on bandwidth, • IPv6 support on LLB message
latency, jitter, connectivity, application etc.
• IPS, Application identification, URL filtering, Administration
• Link health inspection with ARP, PING, and DNS Antivirus, Access control, ND attack defense, iQoS,
• Management access: HTTP/HTTPS, SSH, telnet,
SSL VPN
VPN console, RestfulAPI, NETCONF
• IPv6 jumbo frame support
• IPsec VPN • Central Management: Hillstone Security Manager
• IPv6 Radius and sso-radius supports (HSM), web service APIs
- IPsec Phase 1 mode: aggressive and main ID
protection mode • IPv6 is supported in Active Directory whitelist • System Integration: SNMP, syslog, alliance partner-
- Peer acceptance options: any ID, specific ID, ID in • IPv6 support on the following ALGs: TFTP, FTP, ships
dialup user group RSH, HTTP, SIP, SQLNETv2, RTSP, MSRPC, • Rapid deployment: USB auto-install, local and
SUNRPC remote script execution
- Supports IKEv1 and IKEv2 (RFC 4306)
• IPv6 support on distributed iQoS • Dynamic real-time dashboard status and drill-in
- Authentication method: certificate and
pre-shared key • Track address detection monitoring widgets
- IKE mode configuration support (as server or • Language support: English
VSYS (only available on rackmount models)
client) • Administrator authentication: Active Directory and
• System resource allocation to each VSYS LDAP
- DHCP over IPsec
• CPU virtualization
- Configurable IKE encryption key expiry, NAT Logs & Reporting
traversal keep alive frequency • Non-root VSYS support firewall, IPsec VPN,
SSL VPN, IPS, URL filtering, app monitoring, IP • Logging facilities: local storage; up to 6 months log
- Phase 1/Phase 2 Proposal encryption: DES, reputation, QoS storage with expansion storage (SSD hard drive),
3DES, AES128, AES192, AES256 syslog server, Hillstone HSM or HSA
• VSYS monitoring and statistic, app monitoring, IP
- Phase 1/Phase 2 Proposal authentication: reputation, AV, QoS • Encrypted logging and log integrity with HSA
MD5, SHA1, SHA256, SHA384, scheduled batch log uploading
SHA512 High Availability • Reliable logging using TCP option (RFC 3195)

www.HillstoneNet.com © 2024 Hillstone Networks All Rights Reserved. | 4

Hillstone A-Series Next-Generation Firewall

Features (Continued)
• Detailed traffic logs: forwarded, violated sessions, on ZTNA tags and application resources, with • Support query of monitoring results based on
local traffic, invalid packets, URL etc. optional security protection and data security filtering conditions, including device type, IP
• Comprehensive event logs: system and adminis- • Support application resource management address, status, etc.
trative activity audits, routing & networking, VPN, • Support application resource configuration based • Support customized whitelists
user authentications, Wi-Fi related events on domain name
• IP and service port name resolution option • Support dynamic adjustment of authorization in
• Brief traffic log format option policy when the endpoint state changes
• Three predefined reports: Security, Flow and • Support application publishing, and displaying
Network reports authorized applications to end-users over ZTNA
• User defined reporting portal
• Reports can be exported in PDF, Word and HTML • Support single packet authentication(SPA)
via Email and FTP • Support domain name level permission
• Support policy configuration auditing management
• Support auto-selection of the optimal gateway
Statistics and Monitoring • Support smooth transition from current SSL VPN
• Application, URL, threat events statistic and to ZTNA solution
monitoring • Support operating systems including iOS, Android,
• Real-time traffic statistic and analytics Microsoft Windows, MacOS and Linux
• System information such as concurrent session, • Support centralized ZTNA management by HSM,
CPU, memory and temperature including upload monitoring data and statistics,
• iQOS traffic statistic and monitoring, link status and accept the configuration delivered
monitoring
CloudView
• Support traffic information collection and
forwarding via Netflow (v9.0) • Cloud-based security monitoring
• 24/7 access from web or mobile application
Zero Trust Network Access(ZTNA) • Device status, traffic and threat monitoring
• Support end-user access with a Zero-Trust • Cloud-based log retention and reporting
principle
• ZTNA tags support account password and IoT Security
terminal status • Identify IoT devices such as IP Cameras and
• Support Zero-Trust policy configuration based Network Video Recorders

www.HillstoneNet.com © 2024 Hillstone Networks All Rights Reserved. | 5

Hillstone A-Series Next-Generation Firewall

Specifications

SG-6000-A200-IN SG-6000-A200W-IN SG-6000-A1000-IN SG-6000-A1100-IN SG-6000-A2000-IN SG-6000-A2600-IN

Firewall Throughput (2) 

1 Gbps 1 Gbps 4 Gbps 5 Gbps 5 Gbps 5 Gbps
NGFW Throughput (3) 400 Mbps 400 Mbps 1.5 Gbps 1.7 Gbps 1.7 Gbps 2.5 Gbps
Threat Protection Throughput (4) 200 Mbps 200 Mbps 800 Mbps 800 Mbps 800 Mbps 2 Gbps
Maximum Concurrent Sessions (5) 450,000 450,000 450,000 450,000 1.5 Million 1.85 Million
New Sessions/s (6) 14,000 14,000 48,000 48,000 48,000 120,000
IPS Throughput (7) 610 Mbps 610 Mbps 3 Gbps 2.8 Gbps 2.8 Gbps 3 Gbps
AV Throughput (8) 550 Mbps 550 Mbps 1.8 Gbps 1.8 Gbps 1.7 Gbps 3.4 Gbps
IPsec VPN Throughput (9) 0.59 Gbps 0.59 Gbps 2.5 Gbps 2.7 Gbps 2.7 Gbps 3 Gbps
Virtual Systems (Default/Max) N/A N/A N/A N/A 1/5 1/5
Firewall Policy Number 4000 4000 4,000 4,000 8,000 12,000
SSL VPN Users (Default/Max) 8/128 8/128 8/128 8/128 8/1,000 8/2,000
IPsec Tunnel Number 2,000 2,000 2,000 2,000 4,000 6,000
1 × Console Port, 2 × 1 × Console Port, 2 × 1 × Console Port, 2 ×
1 × Console Port, 1 x 1 × Console Port, 1 x 1 × Console Port, 2 ×
Management Ports USB3.0 Ports, 1 × MGT USB3.0 Ports, 1 × MGT USB3.0 Ports, 1 × MGT
USB 2.0 Port USB 2.0 Port USB3.0 Ports
Port (RJ45) Port (RJ45) Port (RJ45)
8 × GE (including 1 8 × GE (including 1 8 × GE (including 1
Fixed I/O Ports (10) 1×SFP, 5×GE 1×SFP, 5×GE 4 × GE
bypass pair) bypass pair) bypass pair)

Wifi (IEEE802.11a/b/
Wi-Fi/ 4G Dongle 4G Dongle 4G Dongle 4G Dongle 4G Dongle 4G Dongle
g/n/ac), 4G Dongle

Available Slots for Expansion

N/A N/A N/A N/A N/A N/A
Modules
Expansion Module Option N/A N/A N/A N/A N/A N/A
Twin-mode HA N/A N/A N/A N/A N/A N/A
Local Storage 4 GB 4 GB 8 GB 8 GB 8 GB 8 GB
480GB / 960GB / 480GB / 960GB /
Expansion Storage Options N/A N/A 256 GB SSD 256 GB SSD
1.92TB SSD 1.92TB SSD

50W, Single AC 50W, Single AC

Power Specification 14W, Single AC (default) 14W, Single AC (default) 30W, Single AC 30W, Single AC (default), Dual AC (default), Dual AC
(optional) (optional)

Power Supply AC 100-240 V 50/60 Hz AC 100-240 V 50/60 Hz AC 100-240 V 50/60 Hz AC 100-240 V 50/60 Hz AC 100-240 V 50/60 Hz AC 100-240 V 50/60 Hz

Form Factor Desktop Desktop Desktop Desktop Rackmount, 1U Rackmount, 1U

Dimensions (W × D × H, mm) 180 × 110 × 28 180 × 110 × 28 270 × 160 × 44 270 × 160 × 44 436 × 320 × 44 436 × 320 × 44
Dimensions (W × D × H, inches) 7.1 × 4.3 × 1.1 7.1 × 4.3 × 1.1 10.6 × 6.3 × 1.7 10.6 × 6.3 × 1.7 17.2 × 12.6 × 1.7 17.2 × 12.6 × 1.7
Weight 2.2 lb (0.6 kg) 2.2 lb (0.6 kg) 3.1 lb (1.4 kg) 3.1 lb (1.4 kg) 8.6 lb (3.9 kg) 8.6 lb (3.9 kg)
Working Temperature 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C)
10-95% 10-95% 10-95% 10-95% 10-95% 10-95%
Relative Humidity
non-condensing non-condensing non-condensing non-condensing non-condensing non-condensing

www.HillstoneNet.com © 2024 Hillstone Networks All Rights Reserved. | 6

Hillstone A-Series Next-Generation Firewall

Specifications (Continued)
SG-6000-A2700-IN SG-6000-A2715-IN SG-6000-A2800-IN SG-6000-A2815-IN

Firewall Throughput (2) 10 Gbps 10 Gbps 16 Gbps 16 Gbps

NGFW Throughput (3) 4 Gbps 4.5 Gbps 5 Gbps 5 Gbps
Threat Protection Throughput (4) 2.5 Gbps 2.5 Gbps 2.8 Gbps 2.8 Gbps
Maximum Concurrent Sessions (5) 2.2 Million 2.2 Million 2.4 Million 2.4 Million
New Sessions/s (6) 130,000 130,000 130,000 130,000
IPS Throughput (7) 8 Gbps 9 Gbps 9 Gbps 9 Gbps
AV Throughput (8) 4.5 Gbps 4.5 Gbps 4.5 Gbps 4.5 Gbps
IPsec VPN Throughput (9) 5 Gbps 5.2 Gbps 5.5 Gbps 5.3 Gbps
Virtual Systems (Default/Max) 1/5 1/5 1/5 1/5
SSL VPN Users (Default/Max) 8/4,000 8/4,000 8/4,000 8/4,000
IPsec Tunnel Number 6,000 6,000 6,000 6,000
Firewall Policy Number 12,000 12,000 12,000 12,000

1 × Console port, 2 × USB3.0 ports, 1 × Console port, 2 × USB3.0 ports,

1 × Console Port, 2 × USB3.0 Ports, 1 1 × Console Port, 2 × USB3.0 Ports, 1
Management Ports 1 × HA port (RJ45), 1 × MGT port 1 × HA port (RJ45), 1 × MGT port
× MGT Port (RJ45) × MGT Port (RJ45)
(RJ45) (RJ45)

2 × SFP+, 8 × SFP, 8 × SFP, 8 × GE (including 2 bypass 2 × SFP+, 8 × SFP, 8 × SFP, 8 × GE (including 2 bypass
Fixed I/O Ports (10)
8 × GE pairs) 8 × GE pairs)

Wi-Fi/ 4G Dongle 4G Dongle 4G Dongle 4G Dongle 4G Dongle

Available Slots for Expansion
N/A 1 N/A 1
Modules

IOC-A-F-4SFP+-IN IOC-A-F-4SFP+-IN
Expansion Module Option N/A IOC-A-F-8SFP+-IN N/A IOC-A-F-8SFP+-IN
IOC-A-F-8GE-IN IOC-A-F-8GE-IN

Twin-mode HA N/A Yes N/A Yes

Local Storage 8 GB 8 GB 8 GB 8 GB

Expansion Storage Options 480GB / 960GB / 1.92TB SSD 480GB / 960GB / 1.92TB SSD 480GB / 960GB / 1.92TB SSD 480GB / 960GB / 1.92TB SSD

50W, Single AC (default), Dual AC 60W, Single AC (default), Dual AC 50W, Single AC (default), Dual AC 60W, Single AC (default), Dual AC
Power Specification
(optional) (optional) (optional) (optional)

Power Supply AC 100-240V, 50/60 Hz AC 100-240V, 50/60 Hz AC 100-240V, 50/60 Hz AC 100-240V, 50/60 Hz

Form Factor Rackmount, 1U Rackmount, 1U Rackmount, 1U Rackmount, 1U

Dimensions (W × D × H, mm) 440 x 320 x 44 440 × 340 × 44.4 440 x 320 x 44 440 × 340 × 44.4
Dimensions (W × D × H, inches) 17.3 x 12.6 x 1.7 17.3 × 13.4 × 1.75 17.3 x 12.6 x 1.7 17.3 × 13.4 × 1.75

Weight 9 lb (4.1 kg) 10.0 lb (4.55 kg) 9 lb (4.1 kg) 10.0 lb (4.55 kg)

Working Temperature 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C)

10-95% 10-95% 10-95% 10-95%

Relative Humidity
non-condensing non-con densing non-condensing non-condensing

www.HillstoneNet.com © 2024 Hillstone Networks All Rights Reserved. | 7

Hillstone A-Series Next-Generation Firewall

Specifications (Continued)
SG-6000-A3000-IN SG-6000-A3600-IN SG-6000-A3615-IN SG-6000-A3700-IN SG-6000-A3800-IN SG-6000-A3815-IN

Firewall Throughput (2) 20 Gbps 20 Gbps 20 Gbps 20/30 Gbps 20/30 Gbps 20 Gbps
NGFW Throughput (3) 5.5 Gbps 5.5 Gbps 5.5 Gbps 6 Gbps 12 Gbps 13 Gbps
Threat Protection Throughput (4) 3 Gbps 3 Gbps 2.95 Gbps 3.1 Gbps 6 Gbps 6.5 Gbps
Maximum Concurrent Sessions (5) 3 Million 4.5 Million 4.5 Million 7 Million 8 Million 8 Million
New Sessions/s (6) 135,000 135,000 135,000 140,000 310,000 310,000
IPS Throughput (7) 10 Gbps 10 Gbps 10 Gbps 10 Gbps 16 Gbps 14 Gbps
AV Throughput (8) 5 Gbps 5.0 Gbps 5 Gbps 5.2 Gbps 9.4 Gbps 10 Gbps
IPsec VPN Throughput (9) 6 Gbps 6 Gbps 6 Gbps 6.5 Gbps 12 Gbps 12 Gbps
Virtual Systems (Default/Max) 1/50 1/100 1/100 1/250 1/250 1/250
SSL VPN Users (Default/Max) 8/4,000 8/8,000 8/8,000 8/10,000 8/10,000 8/10,000
IPsec Tunnel Number 8,000 10,000 10,000 20,000 20,000 20,000
Firewall Policy Number 20,000 20,000 20,000 20,000 40,000 40,000

1 × Console Port, 2 × 1 × Console Port, 2 × 1 × Console port, 2 × 1 × Console Port, 2 × 1 × Console Port, 2 × 1 × Console port, 2 ×
USB3.0 Ports, 1 × MGT USB3.0 Ports, 1 × MGT USB3.0 ports, 1 × HA USB3.0 Ports, 1 × MGT USB3.0 Ports, 1 × MGT USB3.0 ports, 1 × HA
Management Ports
Port (RJ45), 1 × HA Port Port (RJ45), 1 × HA Port port (RJ45), 1 × MGT Port (RJ45), 1 × HA Port Port (RJ45), 1 × HA Port port (RJ45), 1 × MGT
(RJ45) (RJ45) port (RJ45) (RJ45) (RJ45) port (RJ45)

2 × SFP+, 8 × SFP, 2 × SFP+, 8 × SFP, 2 × SFP+, 8 × SFP, 2 × SFP+, 8 × SFP,

8 × SFP, 8 × GE (includ- 8 × SFP, 8 × GE (includ-
Fixed I/O Ports (10) 16 × GE (including 2 16 × GE (including 2 16 × GE (including 2 16 × GE (including 2
ing 2 bypass pairs) ing 2 bypass pairs)
bypass pairs) bypass pairs) bypass pairs) bypass pairs)

Wi-Fi/ 4G Dongle 4G Dongle 4G Dongle 4G Dongle 4G Dongle 4G Dongle 4G Dongle

Available Slots for Expansion
N/A N/A 2 1 1 2
Modules

IOC-A-F-4SFP+-IN IOC-A-F-4SFP+-IN
IOC-A-F-8SFP+-IN IOC-A-4SFP+-IN, IOC-A-4SFP+-IN, IOC-A-F-8SFP+-IN
IOC-A-F-8GE-IN IOC-A-2MM-BE-IN, IOC-A-2MM-BE-IN, IOC-A-F-8GE-IN
Expansion Module Option N/A N/A IOC-A-4SFP+-IN IOC-A-4SFP+-IN
IOC-A-2QSFP+-IN IOC-A-2SM-BE-IN IOC-A-2SM-BE-IN IOC-A-2QSFP+-IN
IOC-A-2MM-BE-IN IOC-A-2QSFP+-IN IOC-A-2QSFP+-IN IOC-A-2MM-BE-IN
IOC-A-2SM-BE-IN IOC-A-2SM-BE-IN

Twin-mode HA Yes Yes Yes Yes Yes Yes

Local Storage 8 GB 8 GB 8 GB 8 GB 8 GB 8 GB
480GB / 960GB / 480GB / 960GB / 480GB / 960GB / 480GB / 960GB / 480GB / 960GB / 480GB / 960GB /
Expansion Storage Options
1.92TB SSD 1.92TB SSD 1.92TB SSD 1.92TB SSD 1.92TB SSD 1.92TB SSD

75W, Single AC
100W, Single AC (de- 100W, Single AC (de- 100W, Single AC (de- 100W, Dual AC (default), 90W, Dual AC (default),
Power Specification (default), Dual AC
fault), Dual AC (optional) fault), Dual AC (optional) fault), Dual AC (optional) Dual DC (optional) Dual DC (optional)
(optional)

Power Supply AC 100-240 V 50/60 Hz AC 100-240 V 50/60 Hz AC 100-240V, 50/60 Hz AC 100-240 V 50/60 Hz AC 100-240 V 50/60 Hz AC 100-240V, 50/60 Hz

Form Factor Rackmount, 1U Rackmount, 1U Rackmount, 1U Rackmount, 1U Rackmount, 1U Rackmount, 1U

Dimensions (W × D × H, mm) 436 × 437 × 44 436 × 437 × 44 436 × 459.5 × 44.4 436 × 437 × 44 436 × 437 × 44 436 × 459.5 × 44.4
Dimensions (W × D × H, inches) 17.2 × 17.2 × 1.7 17.2 × 17.2 × 1.7 17.2 × 18.1 × 1.75 17.2 × 17.2 × 1.7 17.2 × 17.2 × 1.7 17.2 × 18.1 × 1.75

Weight 13.2 lb (6 kg) 13.2 lb (6 kg) 13.7 lb (6.2 kg) 13.4 lb (6.1 kg) 15 lb (6.8 kg) 19.8 lb (8.98 kg)

Working Temperature 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C)

10-95% 10-95% 10-95% non-con 10-95% 10-95% 10-95%

Relative Humidity
non-condensing non-condensing densing non-condensing non-condensing non-condensing

www.HillstoneNet.com © 2024 Hillstone Networks All Rights Reserved. | 8

Hillstone A-Series Next-Generation Firewall

Specifications (Continued)
SG-6000-A5100-IN SG-6000-A5155-IN SG-6000-A5200-IN SG-6000-A5255-IN SG-6000-A5500-IN SG-6000-A5555-IN

Firewall Throughput (2) 25/50 Gbps 25/50 Gbps 32/65 Gbps 32/65 Gbps 40/80 Gbps 40/80 Gbps
NGFW Throughput (3) 20 Gbps 20 Gbps 20 Gbps 22 Gbps 25 Gbps 27 Gbps
Threat Protection Throughput (4) 10 Gbps 11 Gbps 12 Gbps 14 Gbps 15 Gbps 17 Gbps
Maximum Concurrent Sessions (5) 9 Million 9 Million 15 Million 15 Million 18 Million 18 Million
New Sessions/s (6) 480,000 490,000 600,000 650,000 700,000 700,000
IPS Throughput (7) 20/30 Gbps 21/30 Gbps 25/35 Gbps 27/35 Gbps 30/40 Gbps 32/40 Gbps
AV Throughput (8) 15 Gbps 15 Gbps 20 Gbps 20 Gbps 25 Gbps 25 Gbps
IPsec VPN Throughput (9) 15 Gbps 18 Gbps 20 Gbps 25 Gbps 28 Gbps 30 Gbps
Virtual Systems (Default/Max) 1/250 1/250 1/250 1/250 1/250 1/250
SSL VPN Users (Default/Max) 8/10,000 8/10,000 8/10,000 8/10,000 8/10,000 8/10,000
IPsec Tunnel Number 20,000 20,000 20,000 20,000 20,000 20,000
Firewall Policy Number 40,000 40,000 40,000 40,000 60,000 60,000

1 × Console Port, 2 1 × Console Port, 2 1 × Console Port, 2 1 × Console Port, 2 1 × Console Port, 2 1 × Console Port, 2
× USB3.0 Ports, 1 × × USB3.0 Ports, 1 × × USB3.0 Ports, 1 × × USB3.0 Ports, 1 × × USB3.0 Ports, 1 × × USB3.0 Ports, 1 ×
Management Ports
MGT Port (RJ45), 2 MGT Port (RJ45), 1 MGT Port (RJ45), 2 MGT Port (RJ45), 1 MGT Port (RJ45), 2 MGT Port (RJ45), 1
× HA ports (SFP+) × HA port (SFP) × HA ports (SFP+) × HA port (SFP) × HA ports (SFP+) × HA port (SFP)

6 × SFP+, 16 × SFP, 2 × QSFP+, 16 × SFP+, 6 × SFP+, 16× SFP, 2 × QSFP+, 16 × SFP+, 6 × SFP+, 16× SFP, 2 × QSFP+, 16 × SFP+,
Fixed I/O Ports (10) 8 × GE(including 2 8 × GE(including 4 8× GE(including 2 8 × GE(including 4 8× GE(including 2 8 × GE(including 4
bypass pairs) bypass pairs) bypass pairs) bypass pairs) bypass pairs) bypass pairs)

Wi-Fi/ 4G Dongle 4G Dongle 4G Dongle 4G Dongle 4G Dongle 4G Dongle 4G Dongle

Available Slots for Expansion
1 1 1 1 1 1
Modules
IOC-A-4SFP+-IN IOC-A-4SFP+-IN IOC-A-4SFP+-IN IOC-A-4SFP+-IN IOC-A-4SFP+-IN IOC-A-4SFP+-IN
IOC-A-2QSFP+-IN IOC-A-2QSFP+-IN IOC-A-2QSFP+-IN IOC-A-2QSFP+-IN IOC-A-2QSFP+-IN IOC-A-2QSFP+-IN
Expansion Module Option
IOC-A-2MM-BE-IN IOC-A-2MM-BE-IN IOC-A-2MM-BE-IN IOC-A-2MM-BE-IN IOC-A-2MM-BE-IN IOC-A-2MM-BE-IN
IOC-A-2SM-BE-IN IOC-A-2SM-BE-IN IOC-A-2SM-BE-IN IOC-A-2SM-BE-IN IOC-A-2SM-BE-IN IOC-A-2SM-BE-IN

Twin-mode HA Yes Yes Yes Yes Yes Yes

Local Storage 64 GB 64 GB 64 GB 64 GB 64 GB 64 GB
480GB / 960GB / 480GB / 960GB / 480GB / 960GB / 480GB / 960GB / 480GB / 960GB / 480GB / 960GB /
Expansion Storage Options
1.92TB SSD 1.92TB SSD 1.92TB SSD 1.92TB SSD 1.92TB SSD 1.92TB SSD

280W, Dual AC (default), 300W, Dual AC (default), 280W, Dual AC (default), 300W, Dual AC (default), 280W, Dual AC (default), 300W, Dual AC (default),
Power Specification
Dual DC (optional) Dual DC (optional) Dual DC (optional) Dual DC (optional) Dual DC (optional) Dual DC (optional)

AC 100-240V, 50/60 Hz AC 100-240V, 50/60 Hz AC 100-240V, 50/60 Hz AC 100-240V, 50/60 Hz AC 100-240V, 50/60 Hz AC 100-240V, 50/60 Hz
Power Supply
DC -36~-72 V DC -36~-72 V DC -36~-72 V DC -36~-72 V DC -36~-72 V DC -36~-72 V

Form Factor Rackmount, 1U Rackmount, 1U Rackmount, 1U Rackmount, 1U Rackmount, 1U Rackmount, 1U

Dimensions (W × D × H, mm) 436 × 437 × 44 436 × 437 × 44 436 × 437 × 44 436 × 437 × 44 436 × 437 × 44 436 × 437 × 44
Dimensions (W × D × H, inches) 17.2 × 17.2 × 1.7 17.2 × 17.2 × 1.7 17.2 × 17.2 × 1.7 17.2 × 17.2 × 1.7 17.2 × 17.2 × 1.7 17.2 × 17.2 × 1.7

Weight 18.7 lb (8.5 kg) 18.7 lb (8.5 kg) 18.7 lb (8.5 kg) 18.7 lb (8.5 kg) 18.7 lb (8.5 kg) 18.7 lb (8.5 kg)

Working Temperature 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C)

10-95% 10-95% 10-95% 10-95% 10-95% 10-95%

Relative Humidity
non-condensing non-condensing non-condensing non-condensing non-condensing non-condensing

www.HillstoneNet.com © 2024 Hillstone Networks All Rights Reserved. | 9

Hillstone A-Series Next-Generation Firewall

Specifications (Continued)
SG-6000-A5600-IN SG-6000-A5800-IN SG-6000-A6800-IN SG-6000-A7600-IN

Firewall Throughput (2) 60/85 Gbps 80/95 Gbps 200 Gbps 280/320 Gbps
NGFW Throughput (3) 35 Gbps 40 Gbps 55 Gbps 55 Gbps
Threat Protection Throughput (4) 20 Gbps 20 Gbps 30 Gbps 30 Gbps
Maximum Concurrent Sessions (5) 25 Million 30 Million 35 Million 42 Million
New Sessions/s (6) 900,000 1,000,000 900,000 900,000
IPS Throughput (7) 35 Gbps 45/88 Gbps 70 Gbps 70 Gbps
AV Throughput (8) 30 Gbps 32 Gbps 35 Gbps 35 Gbps
IPsec VPN Throughput (9) 36 Gbps 45 Gbps 45 Gbps 45 Gbps
Virtual Systems (Default/Max) 1/500 1/500 1/500 1/500
SSL VPN Users (Default/Max) 8/10,000 8/10,000 8/10,000 8/10,000
IPsec Tunnel Number 20,000 20,000 20,000 20,000
Firewall Policy Number 60,000 80,000 80,000 80,000

1 × Console Port, 2 × USB3.0 Ports, 1 × Console Port, 2 × USB3.0 Ports, 1 × Console Port, 2 × USB3.0 Ports, 1 × Console Port, 2 × USB3.0 Ports,
Management Ports 1 × MGT Port (RJ45), 1 × HA 1 × MGT Port (RJ45), 1 × HA 1 × MGT Port (RJ45), 1 × HA 1 × MGT Port (RJ45), 1 × HA
port (SFP) port (SFP) port (SFP) port (SFP)

2 × QSFP+, 16 × SFP+, 8 × GE 2 × QSFP+, 16 × SFP+, 8 × GE 4 × QSFP28 (or 2 × QSFP+, 2 × 4 × QSFP28 (or 2 × QSFP+, 2
Fixed I/O Ports (10)
(including 4 bypass pairs) (including 4 bypass pairs) QSFP28), 12 × SFP+, 8 × SFP+/SFP ×QSFP28), 12 × SFP+, 8 × SFP+/SFP

Wi-Fi/ 4G Dongle 4G Dongle 4G Dongle N/A N/A

Available Slots for Expansion
1 1 1 1
Modules

IOC-A-4SFP+-IN, IOC-A-4SFP+-IN, IOC-A-4SFP+-IN IOC-A-4SFP+-IN

IOC-A-2QSFP+-IN, IOC-A-2QSFP+-IN, IOC-A-2QSFP+-IN IOC-A-2QSFP+-IN
Expansion Module Option
IOC-A-2MM-BE-IN, IOC-A-2MM-BE-IN, IOC-A-2MM-BE-IN IOC-A-2MM-BE-IN
IOC-A-2SM-BE-IN IOC-A-2SM-BE-IN IOC-A-2SM-BE-IN IOC-A-2SM-BE-IN

Twin-mode HA Yes Yes Yes Yes

Local Storage 64 GB 64 GB 64 GB 64 GB

Expansion Storage Options 480GB / 960GB / 1.92TB SSD 480GB / 960GB / 1.92TB SSD 480GB / 960GB / 1.92TB SSD 480GB / 960GB / 1.92TB SSD

300W, Dual AC (default), 300W, Dual AC (default), 310W, Dual AC (default), 310W, Dual AC (default),
Power Specification
Dual DC (optional) Dual DC (optional) Dual DC (optional) Dual DC (optional)

AC 100-240V, 50/60 Hz AC 100-240V, 50/60 Hz AC 100-240V, 50/60 Hz AC 100-240V, 50/60 Hz

Power Supply
DC -36~-72 V DC -36~-72 V DC -36~-72 V DC -36~-72 V

Form Factor Rackmount, 1U Rackmount, 1U Rackmount, 1U Rackmount, 1U

Dimensions (W × D × H, mm) 436 × 437 × 44 436 × 437 × 44 436 × 542 × 44 436 × 542 × 44
Dimensions (W × D × H, inches) 17.2 × 17.2 × 1.7 17.2 × 17.2 × 1.7 17.2 × 21.3 × 1.7 17.2 × 21.3 × 1.7

Weight 18.7 lb (8.5 kg) 18.7 lb (8.5 kg) 20.3 lb (9.2 kg) 20.3 lb (9.2 kg)

Working Temperature 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C)

Relative Humidity 10-95% non-condensing 10-95% non-condensing 10-95% non-condensing 10-95% non-condensing

www.HillstoneNet.com © 2024 Hillstone Networks All Rights Reserved. | 10

Hillstone A-Series Next-Generation Firewall

Module Options
IOC-A-4SFP+-IN IOC-A-2MM-BE-IN IOC-A-2SM-BE-IN IOC-A-2QSFP+-IN

4SFP+ Expansion Module for Back 4SFP Multi-mode Bypass Expansion 4SFP Single-mode Bypass Expansion 2QSFP+ Expansion Module for Back
Names
Panel Module for Back Panel Module for Back Panel Panel
4 × SFP, MM bypass (2 pairs of bypass 4 × SFP, SM bypass (2 pairs of bypass
I/O Ports (10) 4 × SFP+, SFP+ module not included 2 × QSFP+
ports) ports)
Dimension 1U 1U 1U 1U

Weight 2.09 lb (0.96 kg) 2.09 lb (0.96 kg) 2.09 lb (0.96 kg) 2.09 lb (0.96 kg)

IOC-A-F-4SFP+-IN IOC-A-F-8SFP+-IN IOC-A-F-8GE-IN

4SFP+ Expansion Module for Front 8SFP+ Expansion Module for Front 8GE (including 4 bypass pairs) Expan-
I/O Ports (10)
Panel Panel sion Module for Front Panel
Dimension 1U 1U 1U

Weight 0.55 lb (0.25 kg) 0.62 lb (0.28 kg) 0.6 lb (0.27 kg)

NOTES:
(1) Anti-Spam feature is not available on SG-6000-A200-IN and SG-6000-A200W-IN;
(2) Firewall throughput data is obtained under UDP traffic with 1518-byte packet size. The firewall throughput for A3700-IN/A3800-IN can be increased to 30 Gbps via additional IOC-A-4SFP+-IN or IOC-A-
2QSFP+-IN expansion module. The firewall throughput for A5100-IN/A5155-IN/A5200-IN/A5255-IN/A5500-IN/A5555-IN/A5600-IN/A5800-IN/A7600-IN can be increased to 50/50/65/65/80/80/85/95/320
Gbps via additional IOC-A-2QSFP+-IN expansion module;
(3) NGFW throughput data is obtained under 64 Kbytes HTTP traffic with application control and IPS enabled;
(4) Threat protection throughput data is obtained under 64 Kbytes HTTP traffic with Application Control, IPS, AV and URL filtering enabled;
(5) Maximum concurrent sessions is obtained under HTTP traffic;
(6) New sessions/s is obtained under HTTP traffic;
(7) IPS throughput data is obtained under bi-direction HTTP traffic detection with all IPS rules being turned on;
(8) AV throughput data is obtained under HTTP traffic with file attachment;
(9) IPsec throughput data is obtained under Preshare Key AES256+SHA-1 configuration and 1400-byte packet size;
(10) SFP+ ports support SFP+ 10Gbps optical module, SFP 1000Mbps optical module and SFP 1000Mbps copper module; QSFP+ ports support 40GE 1×40Gbps module and can be split to 4 × 10Gbps
tunnel.
All perimeter of A2715-IN/A2815-IN/A3615-IN/A3815-IN are obtained with additional IOC-A-F-4SFP+-IN or IOC-A-F-8SFP+-IN front panel expansion module. Unless specified otherwise, all performance,
capacity and functionality are based on StoneOS 5.5R10. Results may vary based on StoneOS® version and deployment.

www.HillstoneNet.com
© 2024 Hillstone Networks All Rights Reserved.
Version: EX-08.01-NGFW-A-Series-V5.5R10-0324-EN-01