FortiGate Overview.

Presentación del tema: "FortiGate Overview."— Transcripción de la presentación:

1 FortiGate Overview

2 Agenda 1 2 3 4 Introducción La compañía Producto
Funcionalidades técnicas Fortinet Confidential 2

3 La naturaleza de las Amenazas evoluciona…
In the early days of computing, the biggest security concern was that someone was going to physically walk off with a disk pack or set of tapes. As networks became popular, both within and between organizations, it became possible for attackers to enter networks from outside, and to use CONNECTION-BASED attacks to reach and compromise private data and programs. Today, the most damaging and fast-moving threats are CONTENT-BASED. Content-based attacks don’t require sustained connections in order to do damage. Once a virus or worm has been inserted into a computer, it can act on its own and spread without a connection to the attacker. The big challenge with content-based threats is that they are almost always delivered using connections that are inherently trusted – like and Web traffic. In addition, content-based attacks don’t discriminate between different types of companies – they usually are spread automatically without regard for the size of a company or the value of their data. This means that every company is at risk. The same phenomenon is true of other types of content threats including inappropriate Web content or spam. The costs to businesses of these threats is huge – estimated at over $10 billion annually – and growing rapidly. Think of what the last virus attack cost your business! Fortinet Confidential

4 Principales Amenazas para las empresas – Seguridad de red
Source: InfoWorld IT Solutions Study- June 2004 Principales Amenazas para las empresas – Seguridad de red Test Center Research Report Fielded June 2004 Fortinet Webcast Presented on September 14, Conducted for InfoWorld and IDC by IDG Research Services Group Among those involved in the acquisition of security products and services and employed at companies with 50 or more employees. (Base 437) Q20-What is the single greatest threat to your company’s enterprise network security? Fortinet Confidential

5 Los Firewalls no analizan los Contenidos - los Ataques basados en Contenidos… pasan
PAQUETES DE DATOS STATEFUL INSPECTION FIREWALL Sólo inspeccionan las cabeceras – p.e. miran el sobre, pero no lo que contiene en su interior OK Four score and BAD CONTENT our forefathers brou OK OK ght forth upon this continent a new nation, OK n liberty, and dedicated to the proposition that all NO escaneado Basic packet processing, which is what firewalls do, won’t detect the key threats. Some vendors talk about doing “packet-level” scanning for viruses and worms, but that makes no sense! There’s no reason to believe that a virus will be contained completely within one packet – it will probably be chopped up and spread across multiple packets. Simply looking at the network-level contents of a single packet won’t catch most threats. The only way to effectively do network-based scanning for viruses and banned content is to first re-assemble the packets back into the original APPLICATION-level objects from which they were derived – i.e. the files, programs, etc. THEN, once the original content has been re-created, you can scan it for viruses, worms, bad URLs, bad words, etc. But conventional network devices can’t do this. Packet “headers” (A, DE, TIPO DE DATOS, etc.) Packet “payload” (datos) CONFIDENTIAL Fortinet Confidential

6 Algunos Firewalls dicen hacer “Deep Packet Inspection” – pero todavía dejan mucho…
Inspeccionan los contenidos paquete a paquete – pero fácilmente permiten pasar complejos ataques distribuidos en múltiples paquetes. No detectado Basic packet processing, which is what firewalls do, won’t detect the key threats. Some vendors talk about doing “packet-level” scanning for viruses and worms, but that makes no sense! There’s no reason to believe that a virus will be contained completely within one packet – it will probably be chopped up and spread across multiple packets. Simply looking at the network-level contents of a single packet won’t catch most threats. The only way to effectively do network-based scanning for viruses and banned content is to first re-assemble the packets back into the original APPLICATION-level objects from which they were derived – i.e. the files, programs, etc. THEN, once the original content has been re-created, you can scan it for viruses, worms, bad URLs, bad words, etc. But conventional network devices can’t do this. OK Four score and BAD CONTENT our forefathers brou ! OK ght forth upon this continent a new nation, OK n liberty, and dedicated to the proposition that all CONFIDENTIAL Fortinet Confidential

7 Parar los Ataques basados en Contenidos requiere algo más que Deep Packet Inspection
PROTECCIÓN COMPLETA DE CONTENIDOS 1. De Paquetes individuales a Contenido inicial Four score and BAD CONTENT our forefathers brou ght forth upon this continent a new nation, n liberty, and dedicated to the proposition that all BAD CONTENT NASTY THINGS NASTIER THINGS CONTENIDO NO PERMITIDO Basic packet processing, which is what firewalls do, won’t detect the key threats. Some vendors talk about doing “packet-level” scanning for viruses and worms, but that makes no sense! There’s no reason to believe that a virus will be contained completely within one packet – it will probably be chopped up and spread across multiple packets. Simply looking at the network-level contents of a single packet won’t catch most threats. The only way to effectively do network-based scanning for viruses and banned content is to first re-assemble the packets back into the original APPLICATION-level objects from which they were derived – i.e. the files, programs, etc. THEN, once the original content has been re-created, you can scan it for viruses, worms, bad URLs, bad words, etc. But conventional network devices can’t do this. Four score and seven years ago our forefathers brought forth upon this BAD CONTENT a new liberty, and dedicated to the proposition that all… FIRMAS DE ATAQUES !! !! 2. Compara con contenidos no permitidos y listas de ataques CONFIDENTIAL Fortinet Confidential

8 …Complete Content Protection requiere una enorme poder de procesado
La Seguridad Fortinet es una Revolución, no una Evolución, de las soluciones de seguridad anteriores. PODER DE PROCESADO RQUERIDO 1990 2000 Spam Virus Troyanos Gusanos Contenido Web Inapropiado Stateful inspection Intrusiones Simples Denial of Service Ataques Deep Packet Inspection Complete Content Protection 1995 2005 Sofisticadas 1 10 100 1000 Fortinet Confidential

9 Seguridad Multi-Nivel – Ventajas e Inconvenientes
Proporciona un acercaminto completo a la Seguridad Minimiza el tiempo de caída frente a ataques individuales Inconvenientes Requiere múltiples productos Incrementa la complejidad de la red y sus costes operacionales No defiende contra “blended threats” VPN Servers URL Filters Firewall Antivirus IPS / IDS Users Anti-SPAM Fortinet Confidential

10 Amenazas basadas en contenido: Ahora
Ataques combinados Combine functionality of worms, viruses, trojans, malicious mobile code, more Example: Sobig.F Vector Function Propagation Payload New blended threats combine the functionality of viruses, worms, trojans, mobile code and now spam Fast to propagate, expensive, difficult to secure, and contain Started with NIMDA Writers Variants Sobig.F Interestingly, human engineering is still a key to infection with .PIF or .SCP attachment Harvest addresses Send using spoofed source address with built-in SMTP engine At pre-designated time, ping one of 20 sites to retrieve URL. Download file referenced in URL. Execute the downloaded program. Fortinet Confidential

11 Los ataques recientes evaden la aproximación convencional
Slammer, LovSan/MSBlaster, SoBig, MyDoom, Sasser No capturados por muchos sistemas antivirus o IDP Por qué? Los sistemas Antivirus hacen scan de un número limitado de protocolos Mail (SMTP, POP3, IMAP), Web (HTTP), File Transfer (FTP) Los nuevos ataques usan protocolos no escaneados por los AV RPC, TFTP, SQL, etc. Algunos IPS precisan de actualizaciones manuales Los nuevos ataques se propagan rápidamente y las actualizaciones manuales son muy lentas La línea entre AV e IDP tiende a desaparecer Mix the best aspects of both technologies Protocol agility of IDP Low false positives & dynamic updates of AV Fortinet Confidential

12 Agenda 1 2 3 4 Introducción La compañía Producto
Funcionalidades técnicas Fortinet Confidential 12

13 Fortinet Primer fabricante de Plataformas de Seguridad Multi-Nivel con aceleración ASIC La mayor Compañía privada de seguridad de redes ~750 empleados/ > 300 R&D 200,000 FortiGate WW Fundada in 2000 Operaciones Globales en U.S., EMEA & Asia Pac Certificaciones Independientes 8 ICSA certifications (único fabricante) Government Certifications (FIPS-2, Common Criteria EAL4+) 50+ industry awards VB 100 and NSS Certifications Fortinet Confidential Fortinet Confidential 13

14 Fortinet – Liderazgo de Mercado y Crecimiento
48% combined annual growth rate En 2009 el segmento UTM será el mayor mercado – el mercado IDP estará a la par con el de Firewall/VPN. Fortinet es pionero en el mercado UTM y ha sido el líder mundial del mercado UTM mundial durante los últimos 3 años. Fortinet Confidential

15 Magic Quadrant for Enterprise Network Firewalls, 2H07
Source: Gartner, Inc., “2H07 Enterprise Firewall Magic Quadrant” by G. Young and J. Pescatore, Sept. 13, This Magic Quadrant graphic was published by Gartner, Inc. as part of a larger research note and should be evaluated in the context of the entire report. The Gartner report is available upon request from Fortinet. The Magic Quadrant is copyrighted Sept. 13, 2007 by Gartner, Inc., and is reused with permission. The Magic Quadrant is a graphical representation of a marketplace at and for a specific time period. It depicts Gartner's analysis of how certain vendors measure against criteria for that marketplace, as defined by Gartner. Gartner does not endorse any vendor, product or service depicted in the Magic Quadrant, and does not advise technology users to select only those vendors placed in the "Leaders" quadrant. The Magic Quadrant is intended solely as a research tool, and is not meant to be a specific guide to action. Gartner disclaims all warranties, express or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. Fortinet Confidential

16 Fortinet ha desarrollado una Arquitectura Única para una COMPLETA Protección de Red en TIEMPO REAL
Servicios FortiGuard Updates Instantáneos Gestion Centralizada Soporte Completo Fortinet Confidential

17 Los Servicios FortiProtect™ Aseguran Respuesta Rápida a Nuevos Ataques
Fortinet Threat Response Team and Update Distribution Servers FortiProtect Center Web Portal & Bulletins Update Automático AV & IDP de las Uds. FortiGate en todo el mundo en menos de 5 Minutos Fortinet Confidential

18 Our IBERIA References I
Central Gobernment Industry Banking & Finance Print/ Media / Retail Telecom Fortinet Confidential

19 Our IBERIA References II
Regional Gobernment Health Education Fortinet Confidential

20 2007 IBERIA Key wins > $100 K deals
Industry Telco/MSSP Gobernment Health/Education Fortinet Confidential

21 Agenda 1 2 3 4 Introducción La compañía Producto
Funcionalidades técnicas Fortinet Confidential 21

22 Powerful Centralized Management & Reporting
Product Portfolio FortiGate-50B – FortiGate-100A SMB & Remote Office FortiGate-200A – FortiGate-800F Enterprise FortiGate-1000A – FortiGate-5000 Carrier, MSSP & Large Enterprise Powerful Centralized Management & Reporting We apply this platform to a broad range of hardware options. … Secure & Client Software Fortinet Confidential

23 FortiGate 50 – 100 Series Platforms for SMB, SOHO, and Enterprise Branch Offices
FortiGate / FortiGate FortiWifi FortiGate FortiGate FortiWifi 50B 60B 60B 60 ADSL 100A HARDWARE SPECIFICATIONS LAN / WAN / DMZ interfaces 3 / 2 / NA 6 / 2 / / 2 / 1 4 / 2 / / 2 / 2 Internal switch Yes Yes Yes Yes Yes Analog modem Yes Yes ADSL interface Annex A - POE (Powered Device) Yes* CardBus Slot No Yes Yes No No Wireless LAN a/b/g b/g* a/b/g (* FortiWifi 50B only) NETWORKING FEATURES DHCP/PPPoE Client/Server Yes Yes Yes Yes Yes Static/Dynamic Routing* Yes Yes Yes Yes Yes Traffic shaping Yes Yes Yes Yes Yes Radius, LDAP, Active Dir Yes Yes Yes Yes Yes Local DB Yes Yes Yes Yes Yes User group support Yes Yes Yes Yes Yes SYSTEM PERFORMANCE Firewall/VPN 3DES 50/48 Mbps /64Mbps /64 Mbps 70/20 Mbps /40 Mbps Concurrent sessions 25, , , , ,000 New sessions/second 2, , , , ,000 Site-site IPSec VPN tunnels Antivirus throughput Mbps Mbps Mbps Mbps Mbps Fortinet Confidential 23

24 Fortinet Security Solutions for the 50 – 100 Series
FortiGate / FortiGate FortiWifi FortiGate FortiGate FortiWifi 50B 60B 60B 60 ADSL 100A SECURITY FEATURES Gateway antivirus protection (virus, spyware, trojan) Yes Yes Yes Yes Yes Integrated IPS (signature & anomaly) Yes Yes Yes Yes Yes Integrated URL filtering Yes Yes Yes Yes Yes Integrated spam filtering Yes Yes Yes Yes Yes VPN (IPSec, SSL, PPTP) Yes Yes Yes Yes Yes VOIP Security (H323, SIP) Yes Yes Yes Yes Yes OPTIONAL SUBSCRIPTION SERVICES Automatic and scheduled Antivirus and IPS updates Yes Yes Yes Yes Yes URL categorizing Yes Yes Yes Yes Yes Antispam RBL/SURBL Yes Yes Yes Yes Yes CERTIFICATIONS ICSA: Firewall, IPSec, SSL, Antivirus, IPS COMPLIANCE FCC Class B (FG100A – Class A), Part 15, UL/CUL, C Tick, CE, VCCI Fortinet Confidential 24

25 FortiGate 200-800 Series Platforms For Medium-Sized Enterprise Networks
FortiGate FortiGate FortiGate FortiGate FortiGate 200A 300A 400A 500A 800F/800 HARDWARE SPECIFICATIONS 10/100 interfaces 10/100/1000 interfaces * 4-port switch Yes Yes - User-Definable Ports - Yes Yes Yes Yes * Optional fiber SFP interfaces NETWORKING FEATURES DHCP/PPPoE Client/Server Yes Yes Yes Yes Yes 1:1 NAT, 1:Many NAT, PAT Yes Yes Yes Yes Yes Static/Dynamic Routing** Yes Yes Yes Yes Yes Traffic shaping Yes Yes Yes Yes Yes Radius, LDAP, Active Dir Yes Yes Yes Yes Yes Local DB Yes Yes Yes Yes Yes User group support Yes Yes Yes Yes Yes SYSTEM PERFORMANCE Firewall/VPN 3DES /70 Mbps /120Mbps /140 Mbps /150 Mbps /200 Mbps Concurrent sessions K K 400K K K New sessions/second 4, , , , ,000 Site-Site IPSec VPN tunnels , , , ,000 Antivirus throughput Mbps Mbps Mbps Mbps Mbps ** Including BGP,OSPF,RIP Fortinet Confidential 25

26 FortiGate 200-800 Series Platforms For Medium-Sized Enterprise Networks
FortiGate FortiGate FortiGate FortiGate FortiGate 200A 300A 400A 500A 800F/800 SECURITY FEATURES Gateway antivirus protection (virus/worm, spyware, Trojan) Yes Yes Yes Yes Yes Integrated IPS (signature & anomaly) Yes Yes Yes Yes Yes Integrated URL filtering Yes Yes Yes Yes Yes Integrated spam filtering Yes Yes Yes Yes Yes VPN (IPSec, SSL, PPTP) Yes Yes Yes Yes Yes VOIP Security (H323, SIP) Yes Yes Yes Yes Yes SUBSCRIPTION SERVICES Automatic and scheduled Antivirus and IPS updates Yes Yes Yes Yes Yes URL categorizing Yes Yes Yes Yes Yes Antispam RBL/SURBL Yes Yes Yes Yes Yes CERTIFICATIONS ICSA: Firewall, IPSec, SSL, Antivirus, IPS COMPLIANCE FCC Class A, Part 15, UL/CUL, C Tick, CE, VCCI * Including BGP,OSPF,RIP) Fortinet Confidential 26

27 Introducing the FortiGate 1000A-3800A Series
FortiGate 1000A and 1000A FA2 Flexible Perimeter Security High port capacity for DMZ deployments Accelerated port performance option FW + IPS + AV + AS + WF FortiGate 3016B High Performance Next Generation FW 16 port NP2 ASIC accelerated FW + VPN High capacity VPN support FW + VPN +IPS FortiGate 3600A High Performance Data Center Security Dual Core CPUs provide higher overall UTM performance Accelerated port performance (2 ports) FW + VPN + IPS + AV +AS + WF FortiGate 3810A Expandable 10-Gig UTM Platform Supports up 4 ASIC based 10-Gig ports High capacity UTM performance Four AMC expansion slots FW + VPN +IPS + AV Fortinet Confidential 27

28 Fortinet’s FortiGate 1000A-3800A Series High-performance for Large Enterprises
Product FW VPN IPS AV Policies Sessions Tunnels FG-1000A/1000FA2 2 Gbps 400 Mbps 1 Gbps 200 Mbps 30,000 600,000 5,000 FG-3016B 16/20 Gbps 12/15 Gbps 300 Mbps 100,000 2,500,000 10,000 FG-3600A 6/10 Gbps 800/3800 Mbps 3 Gbps 1,000,000 FG-3810A 7/26 Gbps 1/13 Gbps 4 Gbps 500 Mbps 2,000,000 Performance results displayed as base/full AMC expanded using UDP large packet sizes AV = http application throughput Fortinet Confidential

29 Introducing FortiAnalyzer
FortiAnalyzer is an integrated network logging, analysis, and reporting platform Ideal for: Enterprises (Small to Large) Service Providers Telecom Customers Centralizes functions for: Security Log Analysis / Forensics Graphical Reporting Content Archiving / Data Mining Network Analysis Malicious File Quarantine Vulnerability Assessment Fortinet Confidential

30 FortiAnalyzer Logging, Analysis and Reporting Platforms
FortiAnalyzer-100B For Small Sized Deployments Up to 10 FortiGate devices Up to 100 FortiClient devices FortiAnalyzer-800B For Medium Sized Deployments Up to 250 FortiGate Devices Up to 2500 FortiClient Agents FortiAnalyzer-2000A Up to 500 FortiGate Devices Up to 5000 FortiClient Agents For Medium-to-Large Sized Deployments FortiAnalyzer-4000A Up to 700 FortiGate Devices Up to 5000 FortiClient Agents For Large Sized Deployments See ordering guide section for other sizing limitations Fortinet Confidential 30

31 Introducing FortiManager
FortiManager is an integrated management and monitoring platform for all Fortinet products Ideal for: Enterprises (Small to Large) Service Providers Telecom Customers Centralizes functions for: Product Deployments Real-time Monitoring Device/Policy Maintenance Device/Security Updates Fortinet Confidential

32 FortiManager Centralized Management Platforms
Small Deployments 10 FortiGate devices 100 FortiClient agents FortiManager-400A Small-to-Medium Deployments 200 FortiGate devices 2000 FortiClient agents FortiManager-3000 Medium-to-Large Deployments 500 FortiGate devices 5000 FortiClient agents Fortinet Confidential 32

33 Email Security Challenges
Action is needed to secure mail inbound and outbound Fortinet Confidential

34 FortiMail Secure Email Messaging Platforms
Small Business Deployments Up to 54,000 s/hour (Full-Inspection) FortiMail-400 SME Deployments Up to154,800 s/hour (Full-Inspection) RAID Support FortiMail-2000 Large Enterprise & Service Provider Deployments Over 280,800 s/hour (Full-Inspection) RAID Support Redundant/Hot-Swappable Power Supplies & Fans FortiMail-4000A Large Enterprise/ Service Provider Deployments Over 295,200 s/hour (Full-Inspection) RAID Support Redundant/Hot-Swappable Power Supplies & Fans Inbound/Outbound inspection with a single device No user or mailbox restrictions All models support High Availability (HA) configurations Fortinet Confidential 34

35 The Buzz Around FortiClient PC
Centralized Management IPSEC VPN Anti-Virus, Anti-Spyware & Anti-Greyware Personal Firewall Web Content Filtering Anti-Spam FortiClient provides a multi-layered security approach to end point security. Subscription Updates FortiClient PC multi-layered security capabilities is ICSA Anti-Spyware, Anti-Virus and VB 100 certified! Fortinet Confidential

36 SECURITY OPERATION CENTER
MSSP Central Site Mapping from MPLS ID to VLAN tag Virtual Domain to isolate and secure customer traffic INTERNET MPLS SHARED / HOSTED SERVICES CUSTOMER B VLAN TRUNK CUSTOMER A SECURITY OPERATION CENTER Fortinet Confidential

37 SECURITY OPERATION CENTER
MSSP CPE Equipment in Client Site Remote Management & logging/reporting Equipment in Client Site Remote Management & logging/reporting INTERNET MPLS Mgment SHARED / HOSTED SERVICES CUSTOMER B Logs SECURITY OPERATION CENTER CUSTOMER A Fortinet Confidential

38 ¡ Gracias ! user:demo pass: fortigate