The Fortinet Secured Network 08 10 2015 Copyright

The Fortinet Secured Network Матенко Александр, 08. 10. 2015 © Copyright Fortinet Inc. All rights reserved.

Complete Network Security Solution MANAGEMENT Единая точка управления и отчетности PLATFORM USERS ENDPOINTS Защита устройств ACCESS Безопасный доступ Cloud SEGMENTATION NETWORK Политики и зоны Балансировка, DDo. S APPLICATION Почта, Malware, etc DATA SECURITY THREAT INTELLIGENCE 3

SECURITY OPERATING CENTER User ID Mgmt. Central Log & report Central Device mgmt. DATA CENTER File Analysis Cloud based Mgmt. DB Security Forti. Cloud Forti. Authenticator Forti. Analyzer Forti. Manager Network Tester 3 G/4 G WAN Forti. Sand. Box Site-tosite VPN Secure Wi. Fi Access Network Tap Forti. Wi. Fi Forti. Tap Security gateway Forti. WAN App Servers Forti. DB Forti. Tester Forti. Extender Mail Security Gateway Mail Servers Forti. Mail Link Load Balancer Secure Web Caching server Forti. Gate LAN REMOTE Forti. Cache L 2 Switching Remote VPN Endpoint Security Forti. Switch Wi. Fi Access Forti. AP IP Cam. Recorder Forti. Recorder IP PBX Forti. Voice/ Forti. Gate. Voice Forti. Token Forti. Client DB Servers 2 Factor OTP Token MOBILE Forti. Camera Forti. Fone Web App. Firewall Failopen Device Forti. Bridge L 7 D/DOS Mitigator Forti. Web Load Balancer Forti. ADC Web Servers Forti. DDo. S 4

Forti. Gate Product Range Multi Core CPU So. C 1 Gbps NP CP 10 Gbps CPU NP CP CPU 10 Gbps - 50 Gbps Multi Core Chassis System CPU 50 Gbps - 1 Tbps H/W Dependent DCFW/CCFW Personality, Performance and Scalability 3000 Series ISFW 5000 Series 1000 Series 30 -90 Series 100 -200 Series 300 -900 Series NGFW/ NGIPS VM Series CFW/V MFW UTM Forti. Guard Security Services Software & Services Product Range Entry Level Mid Range Forti. OS Operating System High End Forti. Care Support Services Virtual Appliances 5

Inside Forti. OS ATP OSS Support AAA Central Mgmt. Integrations Configuration Visibility Log & Report Diagnostics Management Anti-Malware IPS Application Control Web Filtering Email Filtering Firewall VPN DLP User & Device Identity SSL inspection Security Functions Wireless Controller Switch Controller Endpoint Manager Token Server Vulnerability Scanner Extensions Virtual Systems : : : : : Virtual Domains : : : : : Routing Qo. S NAT/CGN L 2/Switching IPv 6 Wan Optimization WAN Link / Server LB High Availability Network Functions Network Services NAT/Route Transparent Sniffer Operating Modes LAN Wi. Fi WAN Network Interface Physical Appliance (+ASICS) Hypervisor Cloud Platform * Features may varied by models 6

Forti. Gate 300 D 1 2 • 1 • 2 • 3 3 2 x GE RJ 45 Management Ports 4 x GE RJ 45 Ports 4 x GE SFP Slots Hardware Performance Firewall Throughput (1518/512/64) 8/8/8 Gbps IPS Throughput 2. 8 Gbps 1. 4 Gbps Firewall Latency 3 μs Antivirus Throughput (Proxy Based) Concurrent Sessions 6 Mil Virtual Domains (Default / Max) 10 / 10 New Sessions/Sec 200, 000 Max Number of Forti. APs (Total/Tunnel) Firewall Policies ( System/VDOM) 10, 000 Max Number of Forti. Tokens 1, 000 IPSec VPN Throughput 7 Gbps Client-to-Gateway IPSec VPN Tunnels 10, 000 SSL-VPN Throughput 350 Mbps Concurrent SSL-VPN Users (Recommended Max) 512 / 256 500 7

Forti. Gate 5000 -Series Bundles §Chassis-based platforms offer maximum performance, reliability, and scalability for highspeed service provider, large enterprise or telecommunications carrier networks. §Fastest chassis-based firewall in the industry §Flexibility enables protection of complex, multitenant cloud-based security-as-a-service and infrastructure-as-a-service environments. FG-5060 -Base FG-5060 -Full FG 5144 C-Base FG 5144 C-Full Firewall Throughput 160 Gbps 400 Gbps 160 Gbps 960 Gbps Concurrent Sessions 46 Million 115 Million 46 Million 276 Million 1. 13 Million 2. 82 Million 1. 13 Million 6. 78 Million 36 Gbps 90 Gbps 36 Gbps 216 Gbps New Sessions/Sec IPS (HTTP) * Based on sum of individual Security Blades, not as a controller-based system. 8

Forti. OS Software Evolution New Key functionalities 2005 2009/Q 1 2009/Q 3 2010/Q 1 2011/Q 3 V 2. 8 V 3. 0 V 4. 1 V 4. 2 V 4. 3 • • SSL VPN • IM/P 2 P mgmt • • • Wireless ctrl • IPv 6 UTM • SQL Logging • New GUI • Network VM • Token Server • ICAP Antispam 2012/Q 4 New Key functionalities 2007 2014/Q 2 V 5. 0 V 5. 2 • • Forti. View • Deep Flow AV • Software performance optimization Client reputation • Sandbox integration • Endpoint control • Device based policy DLP WAN Opt. SSL Proxy App Control 9

Forti. AP Family 802. 11 ac FAP-320 C 3 x 3: 3 FAP-321 C Dual Radio Dual Band Resiliency and Versatility FAP-320 B 802. 11 ac 2 x 2: 2 Performance 802. 11 ac FAP-222 C FAP-221/223 C FAP-224 D FAP-222 B FAP-221/223 B FAP-28 C Single Radio 1 x 1: 1 Value 802. 11 ac FAP-25 D FAP-24 D FAP-21 D FAP-210 B FAP-14 C FAP-11 C Remote FAP-112 D FAP-112 B Outdoor Indoor 10

Forti. AP 221/223 C • 1 x GE RJ 45 Interface Hardware Performance Target Environment Indoor Number of Antenna 221 C : 4 Internal 223 C : 4 External Number of Radio Tx / RX Stream (802. 11 n) 2 Simultaneous SSIDs Max Transmission Power Po. E Support 8(7 for client access, 1 for monitoring) 17 d. Bm (50 m. W) 802. 3 af 2 x 2 MIMO with Dual Spatial streams, 1167 Mbps Total 11

Forti. AP 222 C • 1 x GE RJ 45 Interface Hardware Performance Target Environment Outdoor Number of Antenna 4 External Number of Radio Tx / RX Stream (802. 11 n) 2 Simultaneous SSIDs Max Transmission Power Po. E Support 16 (14 for client access, 2 for monitoring) 26 d. Bm (398 m. W) 802. 3 at & proprietary 2 x 2 MIMO with 2 spatial streams, 1167 Mbps Total 12

Overview Forti. Switch Access level Gigabit Switches with ease of use and low cost of ownership FSW-28 C FSW-80 -POE FSW-124 B-POE FSW-224 B-POE FSW-324 -POE § Outstanding price, performance, and scalability to organizations with diverse operational needs. Primary Benefits: ✓ High Port Density ✓ Integrated Power Over Ethernet ✓ Connect Access Points, Peripherals, Cameras, Phones ✓ Create an integrated, secure network FSW-348 B FSW-448 B 13

Overview Forti. Client Comprehensive end-point protection & security enforcement Multifunctional Host Security • Flexibility in deployment • Fully integrated features, reduce needs for multiple client solutions End Point Control • Enforce compliance and security policies on mobile hosts Centralized Logging and Reporting • Via Forti. Gate for enterprise requirements 14

Overview Forti. Token Oath Compliant Time Based Hardware One Time Password Token Supports Strong Authentication • • IPSEC VPN SSL VPN Administrative Login Captive Web Portal 802. 1 x Authentication Web Application Access SSO Authentication Platforms • Forti. Gate (FOS 4. 3 and later) • Forti. Authenticator (FAC 1. 4 and later) Secure Seed Delivery Options • Online Via Forti. Guard • Encrypted file on CD (FTK-200 S) • In-house Seed Provisioning Tool (special order) 15

Overview Forti. Analyzer Logging, reporting and analysis from multiple Fortinet devices Aggregated Logging • Singular View of all Fortinet Devices • Built-in Content Archiving • Malicious File Quarantine Centralized Reporting • Predefined Summary & Device Reports • Hundreds of Customizable Charts & Graphs Analysis & Event Correlation • Vulnerability Assessment • Network & Log Analysis Scalable Solution • Hardware and VM Versions Available • Collector/Analyzer Modes for Large Deployments • High Performance Logs/Sec Processing • Support for Internal or External SQL Databases 16

Overview Forti. Manager Tools that effectively manage any size Fortinet security infrastructure, from a few to thousands of appliances Administrative Domains (ADOMs) Locally Hosted Security Content • Enables the primary ‘admin’ to create Virtual Management Domains containing devices for other administrators to monitor and manage • Allows administrators better control over security content updates and provides improved response time for rating databases. • Run a local copy of AV, IPS, URL, A/S signature databases. * Hierarchical Objects & Policy Management • Create Global Objects and Policies • Assign to ADOM or groups of ADOMS • Create device configuration templates to quickly configure a new Fortinet appliance Web Portal SDK • JSON-based API allows MSSPs to offer administrative web portals to customers * Capabilities varied by Models 17

Overview Forti. Monitor Unified event correlation and risk management for modern networks Unified Risk Management Solution • Log collection with enterprise performance • Correlation automatically determines priority threats • Assess your network’s Key Risk Indicators • Manage host assets critical to your network • Schedule regular vulnerability scans • Visualize your holistic security with dashboards and reports 18

Overview Forti. Sandbox Advanced Threat Protection solution designed to identify and thwart the highly targeted and tailored attacks Advanced Threat Protection • Multi-layered filtering with Code Emulator, AV engine, Cloud query and Virtual OS sandbox • Handles multiple file types, includes files that are encrypted or obfuscated • Examine files from various protocols, included those that uses SSL encryption 4 Latest AV Signature Update Flexible Operation Modes • Receives file sample using integration with Forti. Gate/Forti. Mail, sniffer mode and manual file uploads • Capture files from remote locations using deployed Forti. Gates 3 Malicious Analysis output ? Monitoring and Reporting • Detailed analysis reports and real-time monitoring and alerting 1 File Submission 2 Centralized File Analysis 19

Overview Forti. DDo. S Hardware Accelerated DDo. S Intent Based Defense Rate Based Detection • High performance protection using ASIC Self Learning Baseline • Ease Maintenance • Maintain appropriate protection dynamically ISP 1 Web Hosting Center Forti. DDo. S Signature Free Defense • Hardware based protection Inline Full Transparent Mode • No MAC address changes Granular Protection • Multiple thresholds to detect subtle changes and provide rapid mitigation Firewall ISP 2 Legitimate Traffic Malicious Traffic 20

Introducing Forti. Mail Advanced anti-spam and antivirus filtering solution, with extensive quarantine and archiving capabilities. Specialized messaging security system • Advanced, bi-directional filtering prevents spread of spam, viruses, phishing, worms, and spyware Mail Servers Flexible deployment options • Transparent, Gateway, and Server modes that adapts to organizational needs and budget Forti. Mail Identity based encryption • Secure, encrypted communication Email archiving • On-box archiving facilitates policy and regulatory compliance requirements 21

Introducing Forti. Web application firewall to protect, balance, and accelerate web applications. Web Application Firewall • • • Aids in PCI DSS 6. 6 compliance Protection against OWASP Top 10 Application layer DDo. S protection Auto Learn security profiles Geo IP data analysis and security Web Application Servers Web Vulnerability Scanner • Scans, analyzes and detects web application vulnerabilities Forti. Web Application Delivery • Assures availability and accelerates performance of critical web applications SQL Injection, XSS… 22

Introducing Forti. DB Database Activity Monitoring and Vulnerability Assessment solution Database Activity Monitoring (DAM) • Real-time monitoring of key users and critical transactions • User Activity Base lining • Block database attacks in real time Forti. DB Vulnerability Assessment • Sensitive data discovery in databases • Vulnerability scanning with remediation advice Policy Driven Controls • Automated process of establishing IT controls Database Audit and Compliance Database Servers • For compliance and forensics analysis purpose Deployment options: Sniffer, Native Audit and Agents 23

Introducing Forti. Tester Network performance tester that aids in infrastructure optimization and configuration validation § Affordable appliance that provides low TCO § Ability to run 8 types of network performance tests § Connections (TCP) § throughput (TCP) § PPS (UDP) § CPS (HTTP/HTTPS) § RPS (HTTP/HTTPS) § CAPWAP throughput § Ease-to-use web-based UI § History Viewer § Case Profiles 24

Virtual Appliance Platforms VMware Virtual Appliance Citrix Open Source Amazon v. Sphere v 4. x v. Sphere v 5. x v. Sphere v 6. 0 Xen Server v 5. 6 SP 2 Xen Server v 6. 0 Xen KVM AWS Forti. Gate-VM* ✔ ✔ ✔ ✔ Forti. Manager-VM ✔ ✔ ✔ ✔ Forti. Analyzer-VM ✔ ✔ ✔ ✔ Forti. Web-VM ✔ ✔ ✔ ✔ Forti. Mail-VM ✔ ✔ ✔ ✔ Forti. Authenticator-VM ✔ ✔ ✔ ✔ ✔ Forti. ADC-VM Forti. Cache-VM Microsoft Hyper-V 2008 R 2 Hyper-V 2012 Azure ✔ ✔ ✔ ✔ ✔ ✔ ** ** Forti. Voice-VM ✔ ✔ ✔ Forti. Recorder-VM ✔ ✔ ✔ Forti. Sandbox-VM 5. 1, 5. 5 * Also as Forti. Gate-VMX for VMWare NSX ** Also available as pay-as-you-go licensing option 25