VSX-1.虚拟化安全.ppt

Click to edit Master title style,Click to edit Master text styles,Second level,Third level,Fourth level,Fifth level,*,UnrestrictedFor everyone,2009 Check Point Software Technologies Ltd.All rights reserved.,UnrestrictedFor everyone,2009 Check Point Software Technologies Ltd.All rights reserved.,Click to edit Master title style,Click to edit Master text styles,Second level,Third level,Fourth level,Fifth level,Check Point,的虚拟安全解决方案,VSX-1,如今企业安全挑战,Heterogeneous IT environment,Too many single-function security appliances,Complex management and provisioning,Underutilized hardware wastes space and power,Limited scalability,虚拟防火墙满足企业安全挑战需求,Consolidate Security,Hardware Cost Savings,Simplified Security Management,Better Availability and Scalability,Simplified Security Provisioning,Introducing the VSX-1 Appliances,10150 HAVS,The only virtualized security solution on a dedicated appliance with multi-layered security and comprehensive security management,Best virtualized security performance with linear scalability,Increase device utilization and conserve power,space and cooling by consolidating up to 150 security gateways in a single device,VSX-1 3070,VSX-1 9070,VSX-1 9090,510 VS,10150 VS,VSX,如何帮您降低,TCO,大幅度降低数据中心空间,3,个物理机架设备整合到一台单一设备,节省数千瓦能源,150,台,1U,设备,消耗能源超过,11,500 watts,VSX-1 9070,虚拟出,150,个虚拟系统,只需要消耗,140 watts,150,台,UTM-1 3070,需要,3,个机柜空间,(1 rack usually holds 40 to 42U).,一台,VSX-1 9070,仅仅,2U.,*,Based on 150 UTM-1 3070,业解唯一的多层次安全防护的虚拟安全网关,Complete functionality of a physical gateway on a virtual platform,Full IPSec and SSL VPN clientless secure remote access,Comprehensive security services including URL filtering,Single vendor sourcing and support,Centrally managed through SmartCenter and Provider-1,集中管理,Check Point reduces TCO and raises security,单一控制台管理,:,VPN-1 VE,Check Point Appliance,Check Point Software,“Secured by Check Point”Appliances,降低管理开销,确保安全一致性,VSX-1 Appliances,VSX-1 3070,VSX-1 9070,VSX-1 9090,Package,Target Market,Mid Enterprise,Large Enterprise,High End,License Bundle,Virtual Firewall,IPS,Performance Pack,IPSEC,High Availability/Load Sharing(VSLS),Number of VSes,5 or 10,10(Upgradeable to150),10(Upgradeable to 150),Base Price,$34,000 5 VS,$60,000 10 VS,$110,000 10 VS,Performance,FW Throughput,4.5 Gbps,13.5 Gbps,27 Gbps,VPN Throughput,1.2 Gbps,3.5 Gbps,7 Gbps,Concurrent Sessions,1.1 Million,1.1 Million,1.8 Million,Upgrade,On top of base,Additional Add-On Packs,$10,000 5 VS,20 VSes,$30,000,20 VSes,$55,000,Full Redundant,NEW!,Distributed Enterprise LAN,LAN Segment 2,LAN Segment 3,VS2,VS3,VSX-1 centralizes deployment,SmartCenter/Provider-1 used for management if each LAN segment has its own security policy,LAN Segment 1,VS1,SmartCenter/,Provider-1,VSX-1 9090,VSX,发展历程,VSX 1.0 Athena(2001)Multiple Security Policies,VSX 2.0.1 Brazil(2002)First version of Provider-1 Mgmt,Overlapping IP support,VSX NG AI R2 Canada(2003-4)Application Intelligence,SmartDefense,Desktop Security Support,VSX NGX Denmark(2005)L2/L3 support,Dynamic Routing,Multicast,Simplified Provisioning/Mgmt,VSX NGX with Scalability Pack(2006)Dextra VSLS,Resource Control and Lightweight QoS,VSX NGX R65 Ecuador(2007)SNX,URLF,VSX-1,技术介绍,VSX,虚拟防火墙,一个,VSX,网关上运行多个单独的防火墙，每个防火墙保护一个不同的网络（客户）,进入,VSX,网关的包根据进入接口，源地址或目的地址被路由到相关的防火墙,VSX,功能,Firewall,功能,VPN,功能,入侵防护功能,URL,过滤功能,伸缩自如的管理,Provider-1,和,SmartCenter,管理,一个,VSX,网关支持,250,个虚系统,千兆性能,Hardware Cost Savings,Better availability and scalability,Consolidating Hardware,Consolidating Security!,Hardware Cost Savings,Better availability and scalability,Simplified Security Management,Simplified SecurityProvisioning,VSX,的基本元素,VPN-1 VSX NGX,建立了包括多个虚拟设备的虚拟网络环境,虚拟系统,(VS),虚拟电缆（,Warp,链接）,虚拟路由器,(VR),虚拟交换机,(V-SW),虚拟系统（,Virtual System,）,一个虚拟系统是一个唯一的路由和安全域，提供一般的,Check Point,网关绝大部分防火墙和,VPN,功能,存在于相同的物理机器时，每个虚拟系统拥有自己单独的,:,状态表,安全和,VPN,策略,配置参数,安全内部通信证书,每个虚系统都拥有一个虚拟,IP,堆栈,虚拟路由器,一个虚拟路由器允许,:,共享物理接口,内部虚拟系统通信,VS 1,VS 2,J,Internet,虚拟交换机,虚拟交换机设施,在多个,VS,之间共享物理接口,内部,VS,通讯,降低跳的数量,无需,IP,分配流程,802.1q,192.168.1.1,172.169.1.1,192.150.2.1,200.128.4.1,虚拟交换机不需要,IP,地址,便于内外部连接,Internet,212.150.48.254,212.150.48.1,212.150.48.3,212.150.48.4,212.150.48.2,接口,支持的接口,Vlan,物理,Warp,链接,支持的接口数量多达,60,个,虚拟接口,VLAN(802.1q),接口通常用于连接虚系统到被保护的网络,Internet,Switch,VS 1,VS 2,J,管理模型,Provider-1,支持,每个或多个虚系统单独的管理域,允许,:,多个管理员,细致的权限划分,单独数据库,SmartCenter,支持,一个管理域：,一个管理员,一个目标库,多策略,三级分域管理模型,:Provider-1,支持,VSX Gateway,Multi-Domain GUI(MDG),Customer Management Add-On(CMA),Customer Management Add-On(CMA),Customer Management Add-On(CMA),Customer B,Customer A,Customer C,Customer Management Add-On(“Main CMA”),P-1,多级分域管理模型,三级集中管理模型,:SmartCenter,SmartDashboard,Customer B,Customer A,Customer C,SmartCenter,VSX Gateway,集中管理,Check Point reduces TCO and raises security,单一控制台管理,:,VPN-1 VE,Check Point Appliance,Check Point Software,“Secured by Check Point”Appliances,降低管理开销,确保安全一致性,企业分布式环境,LAN,部门,2,LAN,部门,3,VS2,VS3,VSX-1,虚拟防火墙部署,SmartCenter/Provider-1,集中管理不同部门,/,虚拟墙，使用自己专有安全策略,LAN,部门,1,VS1,SmartCenter/,Provider-1,VSX-1 9090,VSX-1,设备,VSX-1 3070,VSX-1 9070,VSX-1 9090,Package,Target Market,Mid Enterprise,Large Enterprise,High End,License Bundle,Virtual Firewall,IPS,Performance Pack,IPSEC,High Availability/Load Sharing(VSLS),Number of VSes,5 or 10,10(Upgradeable to150),10(Upgradeable to 150),Performance,FW Throughput,4.5 Gbps,13.5 Gbps,27 Gbps,VPN Throughput,1.2 Gbps,3.5 Gbps,7 Gbps,Concurrent Sessions,1.1 Million,1.1 Million,1.8 Million,全新,!,Key Features,Check Point,Cisco,Juniper,Fortinet,Comments,Perimeter Firewall,Market-leading firewall vendor,IPSec VPN,Support common types of VPN in a virtual context,SSL VPN,Integrated per virtual context,Integrated IPS per Virtual System,Highly integrated IPS with simple one-click database update,VoIP Security,Capable of deep inspection of VoIP protocols per virtual system,Application Security Support,Supports Web application firewall with extensive granularity,HA and Load Sharing,Seamless HA failover,URL Filtering per Virtual System,Integrated URL filtering,Dynamic Routing Support,Dynamic routing support per virtual system,Scalable Policy Management,SMC/PV-1 brings simplicity and scalable policy management on virtualized environments.Virtual systems are provisioned from Dashboard,Delegation/Separation of Duties,Software or Appliance Deployment,Simple and quick deployment,VSX Competitive Landscape,NEW!,NEW!,VSX-1 Summary,Comprehensive Virtualized Security,Scalable Virtualized Architecture,Everything you need in a virtual security gateway solution.,Consolidation of Hundreds of Security Gateways,10150 HAVS,VSX-1 3070,VSX-1 9070,VSX-1 9090,510 VS,10150 VS,VSX,用户收益,重叠的,IP,地址范围支持,Customer A,10.0.0.0,Internet,Customer B,10.0.0.0,Customer C,10.0.0.0,单独的,VSX,网关可以支持保护拥有重叠,IP,地址范围的网络；每一个网络由一个单独的虚拟系统保护,Switch,桥接模式的虚拟系统,“,桥接模式的虚拟系统,”,透明地提供了安全服务,为基础构架添加一个安全层,促进了核心处的安全性,桥接模式的,VS,与传统的,VS,的相同模型相对应,每个桥接模式的,VS,保持一个专有的桥接表,与体系结构协议集成,支持所有,xSTP,协议、,PVST+,和管理协议,(VTP),路由核心,Vlan 200,Vlan 210,Vlan 240,Vlan 320,802.1q,802.1q,虚拟网络环境,动态路由,虚拟网络环境扩展了对动态路由协议的支持,单播路由,RIPv1/2,、,OSPFv2,和,BGP-4,多播路由,IGMPv2,、,PIM-DM,和,PIM-SM,每个虚拟设备保持对所有路由协议的支持,协议便于以下之间的连接：,虚拟设备到虚拟设备,虚拟设备到外部路由器,802.1q,802.1q,虚拟交换机,虚拟路由器,OSPF,OSPF,PIM-SM,市场营销,IGMPv2,BGP-4,OSPF,VPN-1 VSX NGX,集群,VSX,提供了从一个,VSX,集群成员到另一个,VSX,集群成员无缝的连接和路由故障恢复,状态和路由同步,恢复故障模块,向现有集群中添加成员,/,从现有集群中删除成员,升级集群成员,单个虚拟系统故障恢复,更多集群成员,VSX,集群现在支持多达,12,个成员,每个成员的接口配置,主要好处,在弹性和可扩展性上增强粒度控制,VSX,应用场景,1,大型企业,Floor L-2 Access Switches,Finance Networks,Main Building,Hybrid networks,R&D Networks,aggregation Switches,802.1q connectivity matrix,Routed Core,802.1q Trunks,Vlan IP interface Inter Vlan connectivity,VSX,应用场景,2,动态路由环境,Application,Networks,Main Building,Hybrid networks,R&D-Labs and,Development,Networks,Intranet,SAP,Gatekeepers,Development Servers,Finance,Purchasing,IP Telephony,Lab 1,Lab 2,QA,Business Development,802.1q,802.1q,802.1q,Internet,Perimeter Security,VSX Cluster,Virtual System,Virtual System In Bridge mode,Virtual Switch,Virtual Router,802.1q,802.1q,OSPF connectivity,Core-Virtual Router,VS Specific IGP connectivity,BGP neighbor updates by the core devices/reflector,Selective redistribution into OSPF,案例：为学校提供“清洁宽带接入,”,客户问题,Check Point,强大的管理解决方案,互联网已成为一个重要的教育工具,内容过滤对保护学生至关重要,学校通常没有本地,IT,管理人员,学校涉及庞大的用户基础和大量的地点,政府机构重视可预见的开支预算,提供,“,清洁管道”连接，如同一个管理服务,建立云中,URL,过滤服务的,VSX,保护,-2,个州,-200,个地区,-1,200,所学校,-120,000,个用户,对比综述,Check Point,华为,Juniper,华三,虚拟防火墙的安全独立性,支持,部分支持,部分支持,部分支持,桥模式运行,支持,支持,支持,支持,路由模式运行,支持,支持,支持,支持,混合模式运行（桥,/,路由）,支持,不支持,不支持,不支持,虚拟交换机,支持,不支持,不支持,不支持,虚拟路由器,支持,支持,支持,支持,虚拟链路,支持,不支持,不支持,不支持,高可用性（,AA/HA,）,支持,支持,支持,支持,资源控制,支持,不支持,不支持,不支持,对比综述,Check Point VSX,支持各虚拟防火墙之间完备的安全独立性，每个虚拟防火墙进程都有完全独立运行上下文，具有独立路由转发表、状态检测表、用户数据库、安全规则库等防火墙关键组件；,Check Point VSX,支持灵活的运营模式，可以在桥模式、路由模式或者混合模式下运行，其他品牌无法实现；,Check Point VSX,完善的虚拟网络组件，实现灵活的组网方案，包括虚拟交换机、虚拟路由器和虚拟链路；而其他品牌无法支持虚拟交换机和虚拟链路；,Check Point VSX,支持,AA/HA,高可用性，其,AA,负载均衡模式，最多可支持,8,台防火墙同时运行，且性能线性增长。其他品牌防火墙最多支持,4,台设备以负载均衡方式运行，如果再增加设备，则会造成性能下降；,Check Point VSX,支持资源控制功能，可以为每一个虚拟防火墙预定义可使用的最大,CPU,资源，即便某一个虚拟防火墙遭受攻击，也不会造成该虚拟防火墙占用系统资源过大，因此整个,VSX,的崩溃。其他品牌防火墙则不具有对,CPU,的资源控制能力；,Q&A?,