Cisco PIX 525 Firewall Application Environment
The Cisco Secure PIX 525 Firewall is part of the world's leading Cisco Secure PIX Firewall series, providing unmatched security, reliability, and performance for today's network customers. Its full firewall protection and IP Security (IPSEC) virtual private Network (VPN) capabilities make it particularly appropriate to protect the boundaries of enterprise headquarters.
Strong security Features
The development of the Internet poses a greater security risk for businesses, governments, and private networks. Existing solutions such as the agent-based firewall running on the application tier have many limitations, including low performance, expensive general-purpose platforms, and security risks when using open systems such as UNIX.
While the Cisco Secure PIX Firewall delivers unprecedented security protection, the core of its protection mechanism is the ability to provide an adaptive security algorithm (ASA) for the functionality of the static-attached firewall. Static security, although relatively simple, but compared with packet filtering, the function is more robust, in addition, with the Application Layer Agent firewall, its performance is higher, scalability is stronger. ASA can track source and destination addresses, Transmission Control Protocol (TCP) serial numbers, port numbers, and additional TCP flags for each packet. Access is allowed through the Cisco Secure PIX Firewall Only if there are correct connections that have determined connection relationships. In doing so, internal and external authorized users can transparently access enterprise resources while protecting the internal network from unauthorized access.
In addition, real-time embedded systems can further enhance the security of the Cisco Secure PIX Firewall family. Although UNIX servers are an ideal open development platform for widespread use of open source code, the common operating system does not provide the best performance and security. The dedicated Cisco Secure PIX Firewall is specifically designed to achieve secure, high-performance protection.
Secure VPN with IPSec interop
Traditionally, the firewall implements the boundary security by maintaining the static control of all connections between the connected network segments. Today, more and more customers are looking for firewalls that provide VPN services in addition to access control. With VPNs, remote users or distributed branch offices can access the enterprise network at a lower cost, while using Internet access can significantly reduce the cost of telecommunications associated with a previous dedicated line or other private network. Companies do not need to maintain large modem pools and access servers to handle remote dial-up users, and these are things that require a lot of money and headaches for administrators. Now, with only a local call to the ISP, users can access the dedicated enterprise intranet securely over the Internet.
PIX 525 implements secure, confidential communication on the Internet or on all IP networks. It integrates the main features of the VPN-tunneling, data encryption, security, and firewalls-to provide a secure, scalable platform for better and more cost-effective use of public data services for remote access, remote office and extranet connectivity. 525 can connect up to 4 VPN tiers at the same time, providing users with complete IPSec standard implementations, where IPSec guarantees confidentiality, integrity, and authentication capabilities. For secure data encryption, Cisco's IPSec implementation methods support 56-bit Data Encryption Standard (DES) and 168-bit triple DES algorithms and AES algorithms.
The PIX Firewall delivers unprecedented reliability with an average of no downtime (MTBF) exceeding 60,000 hours. Even at this high level, companies that have Internet, intranet, or extranet connectivity as enterprise Lifelines recognize that firewall redundancy is a key factor. Every minute the firewall stops running, it means the loss of revenue, opportunity, or critical information. Cisco has created a failover bundle that works with the PIX 525-ur to meet these requirements simply and cheaply. This package provides a second firewall specifically designed to run in failover mode for an enterprise.
The Cisco Secure PIX 525 Firewall supports a variety of network interface cards (NICs). Standard NICs include single port or 4-port 10/100 Fast Ethernet, Gigabit Ethernet, 4/16 Token ring and dual-connected multimode FDDI cards.
In addition, the PIX 525 offers a variety of power options that allow users to choose between AC or 48V DC power. Each option is equipped with a pair of products for the second failover PIX system to achieve maximum redundancy and high availability.
Main features and advantages
|Main characteristics and advantages of PIX525|
|168-bit 3DES IPSec VPN throughput||145Mbps|
|Concurrent VPN tunnels||2000|
|Concurrent connections||380,000 7500/sec|
PIX 535 Product Essentials and application environment
The load-level performance provided by Cisco Secure PIX Firewall 535 can meet the needs of large business networks and service providers. As part of the world's leading Cisco Secure PIX Firewall series, PIX 535 delivers unmatched security, reliability, and performance for today's network customers. The firewall combines static firewall and IP Security (IPSEC) virtual private Network (VPN) capabilities with Gigabit Ethernet throughput flexibly.
PIX 535 is a common firewall device capable of providing unprecedented protection. It is tightly integrated with the PIX operating system (OS), a dedicated curing system that eliminates security vulnerabilities and performance degradation costs. At the heart of the PIX535 Firewall is a protection mechanism based on adaptive Security Algorithm (ASA) that provides a firewall for static connections that enables 500,000 simultaneous connections while preventing common denial of service (DoS) attacks.
In addition, the PIX 535 is a fully functional VPN gateway capable of transmitting data securely over the public network, which supports site to site and remote access to VPN applications using 56-bit Data Encryption Standard (DES) or 168-bit 3DES. The integrated VPN capabilities of the PIX 535 are supported by the VPN accelerator card (VAC) option, providing throughput for 495 Mbps and 2000 IPSec tunnels.
High availability is achieved by deploying a redundant hot standby unit that maintains simultaneous connections through automatic static synchronization. This ensures that the conversation can be maintained even in the event of a system failure and that the switching process is done transparently to the network user. In addition, the PIX 535 allows you to add optional redundant, hot-swappable power to the AC or DC model to make it a truly fault-tolerant security device.
PIX535 Limited software version
The PIX 535, which contains limited software licenses, is equipped with 512MB of RAM, supports up to 6 Gigabit Ethernet or 10/100 Fast Ethernet interfaces, and a vac.
PIX535 Unlimited software version
The PIX 535, which contains unlimited software licenses, is equipped with 1GB of RAM, supports up to 8 Gigabit Ethernet or 10/100 Fast Ethernet interfaces, and a vac. In addition, the PIX 535-ur also adds the ability to share state information with the hot standby pix to achieve full firewall redundancy.
|Performance Summary of PIX535|
|168-bit 3DES IPSec VPN throughput||495Mbps|
|Concurrent VPN tunnels||2000|
|Concurrent connections||500,000 9400/sec|
Processor: 1.0 GHz Intel Pentium III
Random Read and write memory: MB or 1 GB SDRAM (hosting PC 133)
Flash Memory: MB
Cache: 256 KB level 2,1 GHz
System bus: Dual 64-bit, 66MHz PCI; Single 32-bit, 33MHz PCI
PCI bus: 9 PCI slots (4 64-bit/66mhz,5 32-bit/33mhz)
Random Read and Write memory: 6 DIMM slots, support up to 6GB of PC133 DRAM (PIX operating system maximum support 1GB)
Console port: RS-232 (RJ-45) 9600 Porter
Failover port: RS-232 (DB-15) 115Kbps (requires Cisco dedicated cable)
Cisco high-end firewall 6503/6506/6509 product Essentials and application environment, solution application
The Cisco catalyst?6503/6506/6509 High-end firewall is a high-speed, integrated firewall that delivers the fastest firewall data transfer rate in the industry: 5Gb throughput, 100000CPS, and 1 million concurrent connections. Up to four FWSM firewall modules can be installed in a single device, so that each device can provide up to 20Gb of throughput. As part of the world's leading Cisco PIX Firewall series, the 6503/6506/6509 high-end firewall provides unmatched security, reliability, and performance for large businesses and service providers.
The 6503/6506/6509 high-end firewall (FWSM) employs the Cisco PIX Technology and runs the Cisco PIX operating System (OS)-a real-time, solid embedded systems that eliminate security vulnerabilities and prevent all kinds of losses that can lead to performance degradation. The core of this system is a protection mechanism based on adaptive Security Algorithm (ASA), which can provide a stateful firewall with connection-oriented capabilities. Using ASA,FWSM, you can create a connection table entry for a session stream based on the source and destination addresses, random TCP serial numbers, port numbers, and other TCP flags. FWSM can control the flow of all inputs and outputs by enforcing security policies on these join table entries.
FWSM Integrated Firewall module
The 6503/6506/6509 high-end firewall is FWSM Firewall Service module installed inside the Cisco Catalyst 6500 Series Switch or Cisco 7600 Internet router, and any cat6k port can act as a firewall port. And the State firewall security is integrated into the network infrastructure. This functionality is important for systems with very limited rack space. Cisco Catalyst 6500 truly becomes the preferred IP service switch for customers who require a variety of intelligent services, such as firewall access, intrusion detection, virtual private network (VPN), and multi-tier LAN, WAN, and man switching capabilities.
Adapt to future needs
The 6503/6506/6509 high-end firewall (FWSM) can support 5Gb throughput, thus providing unmatched performance that allows users to meet future requirements without a thorough upgrade of the system. You can add up to four FWSM in Catalyst 6500 to meet the evolving needs of your users.
The FWSM firewall module is based on the Cisco PIX Technology and uses the same, verified Cisco PIX operating System-a secure, real-time operating system. FWSM can leverage proven Cisco PIX Technology detection groupings to provide a unique combination of performance and security on the same platform.
Low overall operating costs
FWSM can provide the best performance price ratio in all firewalls. Because the FWSM firewall module is based on the Cisco PIX Firewall, the training and management costs are low, and because it is integrated within the CAT6K device, the number of devices that need to be managed is greatly reduced.
Ease of Use
The intuitive graphical user interface (GUI) of the Cisco PIX Device Manager can be used to manage and configure FWSM.
|FWSM Firewall Features|
|Plunge Agent||Implementing security policies for each VLAN|
|AAA Support||Integrates common identity authentication, authorization, and accounting services with tacacs+ and RADIUS support|
|Nat/pat Support||Provides dynamic/static network address resolution (NAT) and port address resolution (PAT)|
|Cisco PIX Device Manager (PDM)|
|Secure network Management||Secure network management access with triple Data Encryption Standard (3DES) encryption|
|Access Control List|
|URL filtering||Set policy in the server and check the output URL request using the Websense software|
|Command authorization||Prioritize all CLI, creating a user account or login environment that corresponds to those priorities.|
|Object Group||Ability to combine network objects (such as hosts) and services (such as FTP and HTTP)|
|High Availability||State recovery--between the device and the device|
|Log||Comprehensive System log, FTP, URL, and ACL logs|
6503/6506/6509 High-end firewall application environment
6503/6506/6509 high-end firewalls are deployed in the network topology of the Enterprise Park's data center.
Today's enterprises not only need perimeter security, but also need to connect business partners and provide park security zone, for the various departments in the enterprise to provide security services. 6503/6506/6509 high-end firewalls provide a flexible, cost-effective, performance-based solution by allowing users and administrators to set up security domains in the enterprise with different policies. Figure 2 shows a park deployment that uses state filtering to create a different VLAN-based security domain.
With the 6503/6506/6509 high-end firewall, users can make corresponding policies for different VLANs.
Data centers also need to use stateful firewall security solutions to protect data and provide gigabit performance at the lowest possible cost. 6503/6506/6509 High-end firewalls can maximize the efficiency of capital investment by providing the best performance-price ratios in the firewall, allowing customers to forgo the expensive firewall products that they used to have to buy additional firewall load-balancing devices.
Cisco IOS router firewall products and features
Cisco's iOS routers offer powerful security features, and with the high integration requirements, Cisco's full range of routers and security-enabled iOS software are also a flexible option.
Cisco iOS firewall software highlights a wide variety of powerful security features, including: