Basic Networking Capabilities

Deployment Mode

Supports routing, transparent, switching, hybrid, bypass multi-mode deployment

Network Protocol

Supports VLAN, manual/dynamic LACP, Jumbo Frames, BFD, LLDP, VXLAN L2/L3 gateway, support MAC, VNI, VTEP static binding

Routing Protocol

Supports IPv4/v6 static routing, PBRv4/v6, RIPv1/v2, RIPng, OSPF v2/v3, ISIS, ISISv6, BGPv4/v6 and Multicast routing, PIM-SM

IP Protocol

Supports IPv4, IPv6 dual-stack

NAT

Supports SNAT, DNAT, NAT-PT, NAT46, NAT64, NAT66, NAT ALG, supports NAT Address Anti-Block Detection, supports SNAT and DNAT hit analysis, supports monitoring of SNAT address pool utilization

Load Balancing

Supports multi-link load balancing, supports DNS traffic load balancing, supports server IP-based load balancing; supports IPSec VPN multi-link backup and load balancing, supports ISP routing load balancing, supports PBR load balancing, and intelligent route selection based on applications and services

Network Service

Supports DHCPv4/v6 server/relay, static DNS, DNS64, DNS proxy server, DDNS, NTP

IPSec VPN

Supports IKEv1/v2, supports multiple encryption algorithm: DES / 3DES / AES-128 / AES-256. Algorithm suites: AES-192, GCM-128, GCM-192, GCM-256, GMAC-128, GMAC-192, GMAC-256.

Supports local CA, supports reverse routing injection, supports DH group16/17/18//20/21/24/27/28/29/30/31

Other VPN

Supports L2TP VPN, PPTP VPN, GRE VPN, GRE over IPSec VPN, L2TP over IPSec VPN, DS-Lite, 6in4 Tunnel

Virtual System

Supports re-configuring performance resources of physical firewalls to generate multiple virtual firewalls. Supports full isolation of virtual system routing, switching, monitoring, auditing, protection, etc.

High Reliability

Supports HA, support "master-standby" and "master-master" mode under routing and transparent mode, supports long connection, interface linkage, link health detection

Refined Access Control

Access Control

Supports security policy based on 5-tuple/security zone/geographical region/user/application/tunnel/time/VLAN, etc., supports configure more than 10 types of advanced security functions. Supports hit time analysis and security policy recommendation, supports session limit based on address/app/time/user, etc.

Application Identification

and Control

Application signature database:  11,000+ entries. Supports displaying the traffic statistics of application in different time and risk. Supports filtering of applications and web content; filter actions include block and log.

Precisely control the abnormal behavior of SMTP, POP3, IMAP, FTP, TELNET, HTTP, SIP, MGCP, SCCP, H225-RAS, H225-931 and GDW3761 protocol

User Authentication

Supports web authentication, local authentication, Two-factor authentication, third-party authentication linked with AD active directory, LDAP, RADIUS, TACACS+, Certificate Verification, POP3, supports 802.1x

File Filtering

Filters file transfers (upload/download/bidirectional) for IM, file sharing, forums, microblogs, webmail, etc. Content filtering supports 29+ file types (HTML, DOC, DOCX, XLS, XLSX, PPT, PPTX, etc.). File type identification is extension-independent.

Mail Filtering

Supports filtering based on black/white list IPs, content keyword, RBL, email senders and recipients, and supports anti-spam function

URL Filtering

Preset rich URL resource library, supports offline/online update, supports custom URL filtering policy, supports URL keyword filtering, supports pushing URL filter notifications/messages

Content Filtering

Realize bidirectional content transmission filtering of various application protocols including HTTP, FTP, POP3, SMTP, IMAP, SMB, NFS and other protocol, and supports predefined and customized sensitive information databases

DNS Filtering

Supports filtering based on DNS, supports DNS black/white list, and supports custom DNS category

Bandwidth Management (QoS)

Supports bandwidth management based on time, IP, user, service, application and DSCP, supports 5-level bandwidth management, per-IP bandwidth quotas, dynamic allocation of remaining bandwidth by priority

Shared Access Management

For private routers and illegal wireless hot-spots, the control function can be optimized by setting control addresses and exception addresses, while supporting blocking or alarm actions

Integrated Attack Protection

Attack Protection

Supports security domain attacks: SYN Flood, ICMP Flood, UDP Flood, IP Flood, DNS Request/Reply Flood, HTTP/HTTPS Flood, NTP Query/ Reply Flood, SYN Cookie, IP scanning attack, port scanning, IP spoofing, DHCP monitoring auxiliary inspection, etc.

Supports anti-DDos attacks: Ping of Death, Teardrop, IP option, TCP exception, Smurf, Fraggle, Land, Winnuke, Christmas tree attack, DNS exception, IP fragmentation, NTP monlist, etc.

Supports protection against brute-force attacks on HTTP, SMTP, databases, FTP, SSH, and RDP.

Virus Protection

Supports a local virus database of no fewer than 30 million signatures, virus detection and removal over HTTP, FTP, POP3, SMTP, IMAP, SMB, IPTUX, and NFS, and sample retention.

Supports 16-level compressed file scanning/removal, virus sample upload, local retention, cloud scanning, and page message push.

Intrusion Prevention

IPS signature database supports 3000+ signature, supports vulnerability protection and anti-spyware for DoH, FTP, HTTP, IMAP, OTHER_APP, POP3, SMTP, NFS, SMB, DNS, and DCERPC,etc.

Vulnerability protection signature database queries: attack type, name, CVE ID, CNNVD ID, CWE ID, severity, platform, category, description, remediation suggestions, etc.

Supports custom vulnerability signatures for HTTP, TCP, and UDP

Cloud Linkage Protection

Supports local and cloud threat intelligence linkage,
supports virus cloud checking and killing, URL cloud recognition, cloud sandbox, application cloud recognition, emergency response, threat intelligence cloud detection and other functions

SSL Decryption

Supports decryption HTTPS, POP3S, SMTPS, IMAPS both of IPv4/v6;
Supports self-learning of decryption certificates, supports transparent deployment for SSL decryption, supports decrypting TLS1.3, TLS1.2, TLS1.1, TLS1.0, and SSL3.0 protocols.
Supports decryption flow mirroring, supports SSL decryption logs output

Honeypot Policy

Supports IPv4/v6 honeypot drainage strategies, supports drainage based on multiple conditions, supports forced drainage, supports threat drainage

Threat intelligence

Supports correlation between local and cloud threat intelligence. Local threat intelligence can be updated manually or automatically, and supports control, allow, block, and DNS sinkhole actions for DNS behavior.

Vulnerability Scanning

Supports network vulnerability scanning, system vulnerability scanning, and IoT vulnerability scanning. Support define TCP/UDP port range, support web login checking

WEB Attack Protection (WAF)

Supports WEB attack protection types includes: XSS, Malicious scanning, SQL injection, WEB attack, Code execution, Command execution, direction traversal, File inclusion, Upload exploits, Webshell exploits, etc.
Supports sample retention, feature library supports 2500+ web attack features.
Supports WAF white list, CSRF protection, HTTP exception protection

RA Control Strategy

Supports RA control strategy to prevent RA attacks. Supports based on source MAC, SSLA MAC, source address, VLAN, prefix, hop count and other conditions. Supports M and O marks.

Weak Password Detection

Supports active and passive detection, supports complete scanning based on network segment, protocol, username dictionary, and weak password dictionary. Supports detection based on numbers, letters, numbers and letters, natural order, keyboard order, special characters, usernames, and duplicate characters. Supports custom usernames and weak password dictionary objects

Visual Intelligent Management

Device Management & Maintenance

Supports device management through HTTPS, SSH, Console, WEB CLI, RESTful API, SNMPv1/v2c/v3,

Supports Netflow, TFTP/FTP, SPAN, Capture packets, Ping, Tracer, Dual system backup

Management Authority

Supports separation of three powers, supports custom administrators and authorities, supports trusted host and MAC, supports device administrator Ukey authentication

Network Analysis

location, perform statistics and ranking through 5 dimensions of session, threat, content, URL, and byte count, displaying the current policy usage and network activity status, and locating abnormal behavior

Threat Analysis

The firewall presents advanced threat behaviors in the network based on hosts accessing malicious URLs and malicious domain names, combined with threat activity policies. In this way, it can be judged that there are compromised hosts in the intranet, or that the current security policy is not perfect

Blocking Analysis

Supports displaying blocking logs of users, applications, threats, content, URLs, etc. Administrators can judge malicious behaviors and potentially risky terminals in the network, and also judge whether normal behaviors have been blocked by mistake

Log Output

Supports querying URL filtering/mail filtering/threat/domain name/behavior/traffic/SSL proxy/content/NAT444/IM/Operation/system log, and supports sending different types of logs to designated server separately.

Alarm Notification

Supports SNMP Trap, email, voice, SMS and other forms to notify administrators of alarm information

Statistics Analysis

Supports the sorting of applications, IPs, users, etc. within a specified time range.

Supports historical statistics of new connections and concurrent connections.

Supports ranking statistics based on traffic in the network.

Supports threat maps to help users understand the geographic location-based threat distribution in large networks.

Monitoring Analysis

Supports monitoring and analysis of system resources, users, tunnels, service chain, assets, sessions, routes, etc.