USG6300 Next-Generation Enterprise Firewall Barebone USG6370

• Fine-grained, application-layer protection and service acceleration optimize security while maintaining resilient throughput in GE networks
• Multiple functions in a single device, simplifying management and slashing TCO
• Flexible bandwidth management optimizes critical services, improves user experience, and cuts costs
• Dedicated hardware and software design and high-performance security protection ensure smooth operations
• Continually updated statistical methods identify and isolate suspicious threats to stay ahead of malicious attacks; dynamically defends against new threat signatures and synchronizes with devices in the network

Integrated protection: The USG6300implements access control and protection byApplication, Content, Time, User, Attack, orlocation (ACTUAL).It integrates applicationlayer defense and application identification.For example, the USG6300 can identifyOracle traffic and implement intrusionprevention specially for Oracle traffic to increase efficiency and reduce false positive rate.

web applications) and their functions, and then implements access control and service acceleration.Forexample, the USG6300 can identify the voice and data services of an instant message and apply differentcontrol policies for the services.

• User-specific: The USG6300 supports eight user authentication methods, such as RADIUS, LDAP, andAD authentication and synchronizes user information from the existing user authentication system.TheUSG6300 implements access control, QoS management, and in-depth protection by user.

• Location-specific: Based on the mappings between IP addresses and geographical locations, theUSG6300 identifies the locations from which application traffic and attack traffic originates and promptlydetects network exceptions.Then the USG6300 implements differentiated access control for locations,which can be user-defined for IP addresses.As more information assets are accessible from the Internet, network attacks and information have beenindustrialized, requiring wider ranges of protections form next-generation firewalls.The USG6300 providesoverall protection:

• Multi-purpose: The USG6300 integrates the traditional firewall, VPN, intrusion prevention, antivirus, dataleak prevention, bandwidth management, and online behavior management functions all in one device,simplifying device deployment and improving management efficiency.

• IPS: The USG6300 can detect and defend against over 5000 vulnerabilities.It can identify and defendagainst web application attacks, such as cross-site scripting and SQL injection attacks.

• Antivirus: The high-performance antivirus engine of the USG6300 can defend against over five millionviruses and Trojan horse.The virus signature database is updated daily.

• Data leak prevention: The USG6300 identifies and filters the files and content to be transferred. It canidentify more than 120 file types to prevent virus attacks that are launched by modifying file nameextensions.It can restore and implement content filtering for over 30 types of files, such as word, excel,PPT, PDF, and RAR files to prevent leaks of critical enterprise information.
• SSL decryption: The USG6300 serves as a proxy and implements application-layer protection for SSLencrypted traffic, such as IPS, AV, data leak prevention, and URL filtering.

Accurate Access Control
Overall Protection
Traditional firewalls Next-generation firewalls
• Anti-DDoS: The USG6300 can identify and defend against over 5 million viruses and over 10 types ofDDoS attacks, such as SYN flood and UDP flood attacks.
• Online behavior management: The USG6300 implements cloud-based URL category filtering to preventthreats caused by users' access to malicious websites and control users' online behaviors, such asposting.The USG6300 has a predefined URL category database that contains over 85 million URLs.Inaddition, the USG6300 audits users' network access records, such as posting and FTP operations.
• Secure interconnection: The USG6300 supports various VPN features, such as IPSec, SSL, L2TP, MPLS,and GRE VPN to ensure high-availability and secure interconnection between enterprise headquartersand branch offices.

• QoS management: The USG6300 flexibly controls upper and lower traffic thresholds and implementspolicy-based routing and QoS marking by application.It supports QoS marking for URL categories.Forexample, the packets for accessing financial websites are assigned a higher priority.
• Load balancing: The USG6300 supports server load balancing.In a multi-egress scenario, the USG6300can implement load balancing with the egresses for applications according to link quality, bandwidth,and weights.
• Virtualization: The USG6300 supports virtualization of multiple security services, such as firewall, intrusionprevention, antivirus, and VPN services and implements independent management for different users onthe same physical device.
• Prevent Advanced Persistent Threat (APT) attacks using a reputation system.

Simple Security Management

Next-generation firewalls provide a wider range of protections and more accurate access control than
traditional firewalls.As a result, the configuration of the next-generation firewalls is complex, imposing
higher requirements on the experience and skills of administrators.To reduce administration complexity, the
USG6300 provides the smart policy feature, which has the following functions:

• Rapid deployment policy: The built-in scenario policy template allows administrators to rapidly deploy
common protection policies without heavily relying on their experience and skills.For example, to use
the network storage, the administrator can use only the"network disk" policy template to set up a series
of policies.The policies allow users to download applications of the network disk category and perform
virus detection but prevents them from uploading files.

traffic and application risks in compliance with the minimum privilege principle.The function is helpful
when an enterprise needs to transform a large number of port-based firewall policies to applicationbased next-generation firewall policies.

High Protection Performance
The performance of the UTM that has the application-layer protection function enabled is deteriorated and
cannot meet current application-layer protection requirements.In contrast, the next-generation firewalls can
retain high-performance when providing multiple-level protection.

• Unified signature description language: Application, IPS, and antivirus signatures are described in a
unified language so that the USG6300 can match traffic with these signatures concurrently to improve
the traffic processing efficiency.

• Integrated architecture: Unlike the serial processing of UTM security functions, the security services of
the USG6300 are parallel. Therefore, the USG6300 can have multiple security services enabled and still
retain high performance.