Firewall features

DPI-based control of applications and content

Monitoring digital applications and precisely classifying network traffic at the application level are just two of the many tasks performed by a Deep Packet Inspection (DPI) engine. The industry-leading R&S®PACE 2 DPI engine inspects data packets down to layer 7 – in other words, it analyzes not only the metadata but also the data area of a data packet. Using Application Management, the DPI engine allows you to decide for yourself which applications, application groups or protocols should be allowed (validated), filtered, or blocked in your network (Application Filter, Application-based routing). Definable blacklists and whitelists allow you to target your management of malicious or trusted applications.

Whitepaper: R&S®PACE 2 DPI engine

Whitepaper: Network visibility through DPI and encryption proxies

Database-based protection against known threats

Known threats such as DDoS (Distributed Denial of Service), portscans, or botnets must also be taken seriously. To do this, the Intrusion Detection / Prevention System ("IDS / IPS") maintains a database of known threats to reliably protect end devices in the network from a wide range of hostile attacks. Included in the threat database is a blacklist of more than 40,000 active signatures, IP addresses, and patterns for detecting malware, interface and network scanning, as well as brute force attacks. The IDS mode detects and warns of malicious traffic. These alerts cause the IPS mode to terminate and henceforth block the communication link to hostile sources. In addition, "virtual patching" prevents the exploitation of known vulnerabilities, for example in non-patchable systems. In case of a "false alarm", the admin can allow the corresponding traffic and configure exceptions.

Protection against unknown threats with sandboxing and machine learning

To protect networks against cyber attacks on previously unknown vulnerabilities ("zero-day exploits"), a multi-stage scanning concept detects and eliminates potential threats. To do so, cloud-based sandboxing and machine learning (ML) are used after a local scan. Machine learning helps passing on information about new attack attempts to all firewalls connected to the Anti-Virus cloud. Specifically, all firewalls "learn" from each other's experiences. In an isolated cloud test environment (sandbox), suspicious files are identified, analyzed, scanned, tested, and blocked if necessary. Reliable scanning of protocols such as HTTP/S, FTP, POP3/S, SMTP/S, and IMAP/S can be controlled with configurable exceptions in blacklists and whitelists. With Recurrent Pattern Detection (RPD), spam, phishing, and malware are detected based on the distribution pattern of emails. Suspicious emails are then automatically rejected or deleted.

Infopaper: Avira Protection Cloud

Increased reliability of your Unified Firewalls

For trouble-free operation, high availability is a necessity in critical network installations. Therefore, multiple Unified Firewalls in a HA cluster ensure increased reliability and constant availability. Thanks to the active / passive cluster, the second firewall of the same model only steps in when it is really needed. Hot standby and stateful failover enable this without any interruptions immediately after the primary firewall fails, so that your business-critical systems are optimally protected at all times.

Secure and encrypted site networking

Company locations, such as branch offices or mobile employees in home offices, are securely connected via a virtual and private network (VPN). The client-configurable VPN acts like a secure data tunnel, although it uses the public Internet as a communication path. This creates a trustworthy Wide Area Network (WAN) that can only be accessed by authorized persons thanks to user authentication. With IPSec, SSL, and WireGuard, three different VPN technologies are available: IPSec uses the IKEv2 protocol recommended by the German Federal Office for Information Security (BSI) and supports NAT-T. IPsec tunnels can be used, for example, for high-performance site-to-site connections and SSL tunnels for flexible client-to-site connectivity. Support of the VPN standard WireGuard, on the other hand, effectively accelerates the establishment and administration of VPN connections and enables high data throughput by reducing encryption parameters.