Product characteristics

Accurate access control and comprehensive ACTUAL-based protection

Traditional firewall access control is based on port and IP addresses, but the USG9500 provides more fine-grained controls like these:

ACTUAL-based: USG9500 series firewalls provide integrated control and protection based on the Application, Content, Time, User, Attack, and Location (ACTUAL) model and combine application-layer protection and identification. For example, the USG9500 can identify Oracle-specific traffic and implement selective intrusion prevention to increase efficiency and reduce false positives

Application-based: USG9500s can accurately identify more than 6,000 applications and services and adjust access control and service acceleration as needed. For example, USG9500s can identify an instant messaging application's voice and data services, then apply appropriate control policies to each service

User-based: The firewall supports 8 user authentication methods, including RADIUS, LDAP, and Active Directory (AD) authentication. It also provides synchronized user information from existing authentication systems, user-based access control, and QoS management

Location-based: The unit identifies application and attack traffic origins using IP address geolocation. It also detects network problems and uses differentiated user-defined access control for traffic from different locations

Practical features reduce TCO

The USG9500 provides comprehensive protection against rampant cyber-attacks and information theft: 

Versatility: A single USG9500 integrates VPNs, intrusion prevention, antivirus, Data Leak Prevention (DLP), and bandwidth and online behavior management for simple deployment and better efficiency

Intrusion Prevention System (IPS): Detect and prevent more than 5,000 vulnerabilities, such as cross-site scripting and SQL injection

Antivirus protection: A high-performance antivirus engine, with a virus signature database updated daily, detects and repels more than 5 million viruses and Trojan horses

DLP support: The USG9500 identifies more than 120 file types, even if their extensions are maliciously changed. In addition, it can restore and implement content filtering for more than 30 file types, including Word, Excel, PPT, PDF, and RAR files, to prevent critical information leaks

SSL decryption: USG9500s serve as proxies for application-layer protection, such as intrusion prevention, antivirus, DLP, and URL filtering for SSL-encrypted traffic

Anti-DDoS attacks: The firewall identifies and prevents 10 types of DDoS attacks, such as SYN and UDP flood attacks

Secure connections: USG9500s support VPN features, such as IPSec, SSL, L2TP, MPLS, and GRE VPN for secure and reliable connections

QoS management: USG9500s manage upper and lower traffic thresholds and supports application-specific, policy-based routing. It also preferentially marks and forwards traffic of specified URL categories, such as financial websites

Online behavior management: The USG9500 uses a cloud-based URL category database containing 85 million URLs to prevent threats. Additionally, it audits and controls online behaviors, such as social media posting and FTP uploads and downloads

Load balancing: In multiple egress scenarios, USG9500 firewalls provide server load balancing based on link quality, bandwidth, and data volume 

Linear performance overcomes bottlenecks

The USG9500 uses a hardware platform that is often used in core routers to provide modularized components. Each Line Protection Unit (LPU) has two Network Processors (NPs) to provide line rate forwarding. LPUs and Stream Processing Unites (SPUs) function separately. The SPU uses multi-core CPUs and multi-threaded architecture, and each CPU has an application acceleration engine. These hardware advantages, combined with Huawei’s optimized concurrent processing technology, increase CPU capacity to ensure high-speed, parallel processing of multiple services, such as NAT and VPN. Overall performance increases linearly with the number of SPUs, enabling customers to scale up performance at low cost.

The system’s unique architecture and hardware design delivers industry-leading performance; up to 144 Tbit/s, large-packet throughput, 1.44 billion concurrent sessions, and 4,096 virtual firewalls. Meets requirements of high-end customers, such as television and broadcast companies, government agencies, energy companies, and educational institutions.

Stable, reliable security gateway with full redundancy

To ensure service continuity on mission-critical, high-performance networks, the USG9500 supports active/standby and active/active redundancy, port aggregation, VPN redundancy, and SPU load balancing. The USG9500 also supports dual-MPU active/standby switch-over normally available in high-end routers, for high availability. Mean-Time-Between-Failures (MTBF) is up to 200,000 hours, and fail-over time is less than one second.

Comprehensive virtualization functions for cloud networks

Secure, high-speed network connections and rich virtualization features support cloud computing systems with dedicated resources, independently forwarding traffic, and separately managing configurations to meet the requirements of different customers. Resources can be easily assigned to different virtual systems as needed, with different security policies, log management, forwarding processes, and audit functions based on tenant requirements. Forwarding planes of virtual systems are separated to ensure data security of tenants and eliminate the impact of performance degradation of one virtual system affecting other virtual systems.