Eudemon 1000防火墙 产品概述 正文
华为Eudemon1000E-N下一代防火墙 - Huawei - Building A ...
6-1华为Eudemon1000E-N 下一代防火墙华为Eudemon1000E-N 下一代防火墙Eudemon1000E-N 下一代防火墙随着互联网技术的不断发展，智能手机、iPad 等终端被更多地应用到办公中，移动应用程序、Web2.0、社交网络应用于生产生活的方方面面。
网络边界变得模糊，信息安全问题日益复杂。
传统的安全网关通常只能通过IP 和端口进行安全防护，难以完全应对层出不穷的应用威胁和Web 威胁。
Eudemon1000E-N 系列是华为公司为解决运营商、企业、政府、数据中心等机构的网络安全问题自主研发的下一代防火墙产品。
它基于业界领先的软、硬件体系架构，通过对应用、用户、威胁、时间、位置的全面感知，将网络环境清晰的映射为业务环境。
在应用识别的基础上提供精准的管控能力，融合了IPS 攻击防护、AV 防病毒、URL 过滤，Web 内容过滤，反垃圾邮件和邮件过滤等行业领先的专业安全技术，支持IPv6防护及过渡技术，为用户提供强大、可扩展、持续的安全能力。
在运营商、政府、金融、电力、石油、教育、工业制造等行业得到广泛应用。
下一代防火墙，地址才能“应用（Application ）、时间（Time ）、用户多个维度解析企业的业务流量，并结合各种维度进行、行为识别等技术手段，准确识别超过6000个网络应用。
• 用户：通过Radius 、LDAP 、AD 等8种用户识别手段，将流量中的IP 地址与现实世界中的用户信息联系起来。
基于用户对网络流量进行管控。
• 威胁：支持超过5000+特征的攻击检测和防御。
支持Web 攻击识别和防护，如跨站脚本攻击、SQL注入攻击等。
可以识别和防范SYN flood 、UDP flood 等10+种DDoS 攻击，识别500多万种病毒。
采用基于云的URL 分类过滤，预定义的URL 分类库已超过8500万，阻止访问恶意网站带来的威胁。
• 位置：与全球位置信息结合，识别流量及威胁发起的位置信息；使用流量地图和威胁地图快速发现异常，进而制定对应的防护策略。
Eudemon系列防火墙
强大的 抗攻击 能力
支持多样的配 置和认证方式
Eudemon
电信级 可靠性
防火墙
丰富业务特性 优良的 支持多种 业务可 VPN和加密 扩充性 算法 高速 NAT ， 支持多种 接口和工 支持丰富 的ALG 作模式
20
基于改进的状态检测安全技术
包过滤防火墙：
早期防火墙就是简单的包过滤防火墙，只支持静态
强大的认证系统，可支持本地和Radius认证服务器认证。
和防火墙配套的日志系统管理也支持严格的用户认证，日志数据库加密存储。
14
Eudemon防火墙基本规格
E100
接口数量 自 带 2 个 10/100M 以太网口，另有 2 个扩展接口插槽 接口类型 10/100M以太网
E200
自 带 2 个 10/100M 以太网口。, 2个扩展接口插槽 10/100M 以太网， E1、ATM接口
RTSP、H.323、SIP、HTTP等应用进行状态检测。
支持端口到应用映射，隐藏内部知名端口。 支持丰富的NAT应用，利用NAT方式组网可进一步提高安全性。 11
Eudemon防火墙主要特点
高性能：
采用华为3Com专利技术，提供业界领先的ACL高速算法，性能与ACL数目无关。 高端防火墙采用了网络处理器，达到3G线速。
产品开发采用IPD和CMM流程，最大程度保证产品质量可靠。
路由备份功能。 支持双机状态热备。
高安全：
专门为防火墙设计的硬件结构。
具有自主知识产权的安全操作系统。 内置IDS功能，对网上几十种攻击进行检测和防范。具有与IDS联动功能，通 过与IDS配合防御不断出现的新的攻击方式。
华为Eudemon1000E
华为Eudemon1000EEudemon 10003 典型的网络攻击方式和对策无论防火墙报过滤规则配置的多么严密，总需要划定一个范围，在这个范围内，连接是被允许的。
如果攻击用户网络的连接混杂在这个许可的范围之内，就要靠攻击防范的相关功能将其识别出来并处理。
3.1 常见攻击方式和对策3.1.1 syn-floodsyn-flood攻击是一种常见的DoS攻击方式，主要被用来攻击开放了TCP端口的网络设备。
要了解syn-flood攻击的原理，需要先解释一下TCP的连接的建立过程。
TCP连接的建立过程称为三次握手，首先，客户端向服务器发起连接请求（SYN报文），服务器端在收到这个连接请求之后，会回应一个应答报文（SYN ACK），客户端收到这个SYN ACK报文之后，再发送第三个ACK报文，这个交互过程完成之后，服务器和客户机两端就认为这个TCP会话已经正常建立，可以开始使用这个会话上传送数据了。
服务器端在回应SYN ACK报文的时候实际上已经为这个连接的建立分配了足够的资源，如果没有接收到客户端返回的ACK报文，这部分资源会在一定时间之后释放，以便提供给其他连接请求使用。
syn-flood攻击就是利用了这个原理，攻击者伪造TCP的连接请求，向被攻击的设备正在监听的端口发送大量的连接请求（SYN）报文，被攻击的设备按照正常的处理过程，回应这个请求报文，同时为它分配了相应的资源。
但是攻击者本意并不需要连接建立成功，因此服务器根本不会接收到第三个ACK报文，现有分配的资源只能等待超时释放。
如果攻击者能够在超时时间到达之前发出足够的攻击报文，使被攻击的系统所预留所有资源（TCP缓存）都被耗尽。
那么被攻击的设备将无法再向正常的用户提供服务，攻击者也就达到了攻击的目的（拒绝服务）。
从被攻击设备的角度讲，没有很好的方法能够阻止这种攻击的发生。
在我们防火墙上可以通过配置Syn-flood防御功能来对服务器进行保护。
华为防火墙Eudemon1000E-X_硬件描述
硬件描述
文档版本 01 发布日期 2012-11-06
华为技术有限公司
版权所有 © 华为技术有限公司 2012。 保留一切权利。 非经本公司书面许可，任何单位和个人不得擅自摘抄、复制本文档内容的部分或全部，并不得以任何形式传播。
商标声明
3 DMIC 接口卡................................................................................................................................16
3.1 2×10GE 光口卡..............................................................................................................................................17 3.1.1 功能和特性.............................................................................................................................................17 3.1.2 面板.........................................................................................................................................................17 3.1.3 技术指标.................................................................................................................................................18
华为Eudemon1000双机配置
双机热备配置举例目录1双机热备配置举例1.1 配置主备备份方式下的双机热备1.2 配置负载分担方式上下行设备是路由器的双机热备1.3配置负载分担方式下业务接口工作在交换模式的双机热备1.4 配置主备备份方式下VRRP 和OSPF 结合的双机热备1.5 配置主备备份方式下OSPF 与NAT 结合的双机热备1双机热备配置举例通过配置双机热备功能，可以确保主用设备出现故障时能由备份设备平滑地接替工作。
配置主备备份方式下的双机热备Eudemon 作为安全设备部署在业务节点上，上下行设备均是交换机，实现主备备份的双机热备份组网。
配置负载分担方式上下行设备是路由器的双机热备Eudemon 作为安全设备部署在业务节点上，上下行设备均是路由器，实现负载分担的双机热备份组网。
配置负载分担方式下业务接口工作在交换模式的双机热备Eudemon 上下行设备均是路由器，主备设备的业务接口工作在交换模式下，在上下行路由器之间透传OSPF 协议，同时对业务流量提供安全过滤功能。
配置主备备份方式下VRRP和OSPF结合的双机热备主备设备与路由器运行OSPF协议，与交换机运行VRRP , 实现主备备份的双机热备份组网。
配置主备备份方式下OSPF与NAT结合的双机热备主备设备与路由器及下行设备GGSN设备运行OSPF协议，在设备上配置NAT功能，实现主备备份的双机热备份组网。
父主题：典型配置案例1.1配置主备备份方式下的双机热备Eudemon作为安全设备部署在业务节点上，上下行设备均是交换机，实现主备备份的双机热备份组网。
组网需求Eudemon作为安全设备被部署在业务节点上。
其中上下行设备均是交换机，Eudemon_A、Eudemon_B分别充当主用设备和备用设备。
网络规划如下：•内部网络通过路巾器与Eudemon_A、Eudemon_B 的GigabitEthernet 0/0/2接口相连，部署在Trust区域。
•外部网络通过路由器与Eudemon_A、Eudemon_B 的GigabitEthernet 0/0/1接口相连，部署在Untrust区域。
华为Eudemon1000E-G系列 AIl防火墙(盒式)产品说明书
华为Eudemon1000E-G系列AI防火墙（盒式）随着运营商业务不断的数字化、云服务化，网络在运营商运营中占据着重要的位置，出于各种目的，网络攻击者通过身份仿冒、网站挂马、恶意软件等多种方式进行网络渗透与攻击，影响运营商网络的正常使用。
采用防火墙部署网络边界是当前防护运营商网络安全的主要方式，但是防火墙通常只能基于签名实现威胁的分析和阻断，该方法对未知威胁无有效的处置方法，还会引起设备性能的降低。
这种单点、被动、事中防御的方式已经不能有效的解决未知威胁攻击，对于隐匿于加密流量中的威胁在不损坏用户隐私的情况下更是无法有效的识别。
华为Eudemon1000E-G系列AI防火墙，在提供NGFW能力的基础上，联动其他安全设备，主动防御网络威胁，增强边界检测能力，有效防御高级威胁，同时解决性能下降问题。
NP提供快速转发能力，防火墙性能显著提升。
产品图华为Eudemon1000E-G15/Eudemon 1000E-G25 AI防火墙华为Eudemon1000E-G35/Eudemon 1000E-G55 AI防火墙华为Eudemon1000E-G 系列AI 防火墙（盒式）卓越性能Eudemon1000E-G 系列AI 防火墙内置转发、加密、模式匹配三大协处理引擎，有效将小包转发性能，IPS 、AV 业务性能以及IPSec 业务性能提升2倍。
内置AI 芯片，具备8TOPS 16位浮点数算力，有效支撑高级威胁防御模型加速。
智能防御Eudemon1000E-G 系列AI 防火墙内置NGE 、CDE 和AIE 三大威胁防御引擎。
NGE 作为NGFW 检测引擎，提供IPS 、反病毒和URL 过滤等内容安全相关的功能，有效保证内网服务器和用户免受威胁的侵害。
CDE （Content-based Detection Engine ）可提供数据深度分析，暴露威胁的细节，快速检测恶意文件，有效提高威胁检出率。
产品亮点C&C 加密破解检测…华为Eudemon1000E-G 系列AI 防火墙（盒式）8-3AIE 作为APT 威胁检测引擎，针对暴力破解、C&C 异常流量、DGA 恶意域名和加密威胁流量进行检测，有效解决威胁快速变化、变种频繁、传统升级特征库检测响应慢以及加密攻击检测难度大等问题，构建“普惠式”AI ，帮助客户做到更全面的网络风险评估，有效应对攻击链上的网络威胁，真正实现攻击防御“智”能化。
Quidway防火墙 Eudemon1000E 开局指导书V1[1].0-20091025-B1
资料编码产品名称Quidway自研以太网交换机使用对象华为工程师、合作工程师产品版本编写部门软件服务部-解决方案部资料版本V100R002Quidway防火墙 Eudemon1000E 开局指导书拟制：孙崧铭日期：2009-09-20审核：日期：审核：日期：批准：日期：华为技术有限公司版权所有侵权必究修订记录日期修订版本描述作者2009-10-25 V1.0 完成孙崧铭目录第1章Quidway Eudemon 1000E产品概述 (1)1.1 系统介绍 (1)1.2 组网介绍 (2)1.3 系统结构介绍 (2)第2章Quidway Eudemon 1000E的特点 (3)2.1 产品系列 (3)2.2 产品优点 (4)2.3 安全域概念介绍 (5)2.3.1 防火墙的域 (5)2.3.2 域间概念 (6)2.3.3 本地域 (6)2.4 防火墙工作模式 (7)2.4.1 防火墙工作模式概述 (7)2.4.2 路由模式 (7)2.4.3 透明模式 (8)2.4.4 混合模式 (9)2.5 访问控制策略和报文过滤 (9)2.5.1 访问控制策略的异同 (9)2.5.2 ACL加速查找 (9)2.5.3 报文过滤规则的应用 (10)2.5.4 防火墙缺省动作 (11)2.6 双机热备 (11)2.6.1 VRRP的应用 (12)2.6.2 传统VRRP在E1000E备份实现的不足 (13)2.6.3 VGMP备份组 (15)2.6.4 HRP备份 (15)2.6.5 VRRP、VGMP和HRP之间的协议层次关系 (15)2.7 NAT介绍 (16)2.7.1 NAT的应用 (16)2.7.2 NAT与VRRP绑定 (17)第3章Quidway Eudemon 1000E数据准备 (18)3.1 初始连接配置 (18)3.1.1 通过Console接口搭建 (18)3.1.2 通过Telnet方式搭建 (21)3.1.3 通过WEB方式接入设备 (23)3.2 设备启动 (24)3.2.1 设备上电 (24)3.2.2 设备启动过程 (25)3.3 版本配套 (28)3.3.1 查看当前的软件版本 (28)3.4 软件版本升级 (28)3.5 配置规划 (30)3.5.1 网络拓扑图 (30)3.5.2 系统名 (31)3.5.3 当地时区 (31)3.5.4 远程维护登录帐号/口令和Super密码 (31)3.5.5 区域、接口和IP地址规划 (32)3.5.6 路由规划 (32)3.5.7 访问策略规划 (32)3.5.8 双机热备规划 (33)3.5.9 链路可达性规划 (33)3.5.10会话快速备份规划 (34)3.5.11 NAT规划 (34)3.5.12 NAT与VRRP绑定 (34)第4章Quidway Eudemon 1000E 配置 (35)4.1 时间日期和时区配置 (35)4.2 系统名配置 (35)4.3 远程维护登录帐号/口令和Super密码配置 (36)4.3.1 远程维护登录帐号/口令配置 (36)4.3.2 Super密码配置 (36)4.4 区域、接口和IP地址配置 (37)4.4.1 数据配置步骤 (37)4.4.2 测试验证 (38)4.5 路由配置 (38)4.5.1 缺省路由配置 (38)4.5.2 静态路由配置 (38)4.5.3 动态路由OSPF配置 (39)4.5.4 测试验证 (39)4.6 访问策略控制配置 (39)4.6.1 需求说明 (39)4.6.2 数据配置 (40)4.6.3 测试验证 (41)4.7 双机热备配置 (41)4.7.1 VRRP/VGMP配置 (41)4.7.2 HRP配置 (41)4.7.3 测试验证 (42)4.8 链路可达性配置 (42)4.8.1 配置方法 (42)4.8.2 测试验证 (42)4.9 会话快速备份配置 (43)4.10 NAT配置 (43)4.10.1 配置地址池与VRRP绑定 (43)4.10.2 配置内部服务器与VRRP绑定 (44)4.10.3 验证测试 (44)第5章Quidway Eudemon 1000E基本维护 (44)5.1 查看软件版本信息 (44)5.2 系统配置文件维护 (44)5.3 查看单板、电源、风扇运行状况 (45)5.4 查看CPU占用率 (45)5.5 查看内存占用率 (45)5.6 查看接口流量 (45)5.7 查看接口、链路状态 (46)5.8 查看日志缓冲区信息 (46)5.9 查看路由表信息 (46)5.10 查看ARP映射表 (46)5.11 查看会话表信息 (46)5.12 收集系统诊断信息 (46)关键词：Quidway，防火墙，Eudemon1000E，开局指导书摘要：本文结合业务与软件产品线工程师开局需要对华为Quidway局域网交换机数据准备给出指导，并对其常见配置进行描述。
华为Eudemon1000E-X系列防火墙产品说明书
HUAWEI TECHNOLOGIES CO., LTD.Burgeoning services such as high-speed Internet access, video, and media stream lead to the rocketing of network traffic and ever-increasing service requirements of large organizations, intranets, and data centers in the 10-Gigabit epoch. New applications emerge and occupy the fixed ports of traditional services, making traditional port-dependent firewalls inadequate to cope with such applications. For the sake of illegal profits, hacker attacks and malware are spreading at will. Under this background, false positive and false negative are frequently seen in traditional traffic-based attacks. IT administrators find it difficult to deal with so many problems; therefore, large organizations, intranets, and data centers have to be confronted with such predicaments:How to select a cost-effective product to deal with ever- •increasing service requirements at present and in the future?How to block abuse and provide sufficient bandwidths for mission-•critic applications in the case of so many new applications?How to deal with flooding worms, effectively protecting intranets •and securing office environments?With in-depth understanding of service and customer requirements, Huawei launches its Eudemon1000E-X series. This series employs the new 10-Gigabit multi-core hardware platform and constructs a more high-speed network with no delay for processing mass services. By integrating advanced Symantec intrusion prevention and anti-virus technologies, it delivers content security protection and builds a secure network; with Huawei industry-leading deep packet inspection (DPI) technology, it manages thousands of application programs subtly and provides an effective network. All in all, the Eudemon1000E-X series brings "continuous, cost-effective, and secure" network experiencefor large organizations, intranets, and data centers.Eudemon1000E-X3Eudemon1000E-X5Eudemon1000E-X6Highlights10-Gigabit Multi-Core Hardware PlatformProminent performance, realizing mass service processing ■Provides 15G firewall throughput, 200,000 new connections •per second, 4,000,000 concurrent connections, and 15,000 concurrent VPN tunnels.Supports high-capacity NAT.•High-density 10G interfaces, suiting different application ■scenariosDelivers 64 Gigabit+14 x 10-Gigabit high-density interfaces. •Super-long mean time between failures (MTBF), safeguarding ■service continuitySupplies redundant key components and mature link conversion. •Provides built-in bypass cards for both optical and electrical links. •Relies on a stable software platform for over 10 years' •commercial use, and more than 100,000 devices concurrently online in the world.1Refined Management over Thousands of Application Programs, Building an Efficient NetworkWide application identification, providing visibility into the ■applications running on your networkPossesses 150 application identification experts, and over 850 •identifiable categories.Massive Web site categories, constructing a green Internet ■access environmentEquips with 65 million Web sites and over 130 content •categories, blocking Trojan horse-embedded and phishing Web sites, isolating pornographic and gambling Web sites, and preventing employees against maloperations.Refined application management, creating an efficient ■working networkOffers multi-dimensional control measures specific to time, •application, user, bandwidth, and connection number, effectively providing bandwidths for mission-critic applications, improving bandwidth usage and working efficiency, and making P2P/IM//Web sites at your mercy.Professional Content Security Defense, Providing a Secure NetworkIndustry-leading anti-virus engine with 99% high identification ■accuracyBases on Symantec accumulative anti-virus technologies, •adopts the anti-virus engine with file-level content scanning, combines the globally leading emulation environment and virtual execution technology, provides a 99% identification ratio, and gains good reputation from the international assessment organization.Dedicated vulnerability patching, making transformation ■illuminatedMaintains and updates the huge signature database by the •traditional attack code-based defense mode due to the transformation of attack types, which imposes overload on the IPS engine and leads to low detection performance and high false negative and false positive ratios. The Eudemon1000E-X is backed by advanced Symantec vulnerability defense technology and delivers virtual patches for vulnerabilities (not attack code), disabling various attacks from transforming.Real-time update by a professional team, realizing zero-day ■attack defenseSupplies the honeynet system deployed globally together •with a professional team of over 300 experts to keep tracking the latest, hottest, and most dangerous system and software vulnerabilities, and to defend against zero-day attacks quickly.One-Key Configuration, Freeing You from Complicated Policy OptimizationGUI, a farewell to CLI■Delivers the Web page–based configuration and management, •visualized and simple.Professional configuration wizard, simplifying policy configuration ■Provides a professional configuration wizard for each independent •service.One-key enabling of IPS and anti-virus, reducing maintenance ■workloadBuilds the IPS/anti-virus rule base, with a 99% detection •ratio, which can be directly enabled without commissioning. Therefore, administrators are freed from time-consuming, strenuous, and complicated policy optimization, and quick deployment comes true, that is, plug and play.Application ScenariosNetwork Isolation and VPN InterconnectionCustomer challenges■Because user networks reside in different network areas, •problems such as unclear borders, improper access control management, and disordered mutual access may occur. When branches and mobile employees communicate with the headquarters, data may be intercepted or tampered.Solution strengths ■Delivers 15G processing performance, avoiding the bottleneck •of border deployment.Divides security zones on demand, clearly planning network •borders.Provides the flexible packet filtering policies, accurately •controlling mutual access.Comes with 15,000 concurrent VPN tunnels, 7G VPN •encryption and decryption capabilities, ensuring mass secure interconnection and securing data communication.2External Threat PreventionCustomer challenges■Coming along with the abundant Internet resources are •threats such as DDoS attacks, malicious intrusions, and viruses.Solution strengths■Supplies 200,000 new connections per second and 4,000,000•concurrent connections, easily coping with millions of DDoS attack packets per second.Empowered by advanced IPS and anti-virus technologies •of Symantec as well as vulnerability-based and abundant signature database, ensuring near-zero false positives and negatives, and a detection ratio of higher than 99%; providespowerful security defense against diversified security threats.Office networkOnline Behavior ManagementCustomer challenges■None-work-related Internet surfing, P2P download, online •games, and stock transaction waste bandwidths for business, reduce productivity, and increase the risks of potential malicious code and hacker attacks.Solution strengths■Provides over 850 identifiable application categories, providing•visibility into the applications running on your network.Equips with 65 million Web sites, blocking Trojan horse- •embedded and phishing Web sites, isolating pornographic and gambling Web sites, and preventing employees against maloperations.Offers multi-dimensional control measures specific to the •time, application, user, and bandwidth, effectively providing bandwidths for mission-critic applications, improving working efficiency, and making P2P/IM//Web sites at your mercy.P2POffice networkProduct Specifications456Copyright © Huawei Technologies Co., Ltd. 2011. All rights reserved.General DisclaimerThe information in this document may contain predictive statements including, without limitation, statements regarding the future financial and operating results, future product portfolio, new technology, etc. There are a number of factorsthat could cause actual results and developments to differ materially from those expressed or implied in the predictive statements. Therefore, such informationis provided for reference purpose only and constitutes neither an offer nor an acceptance. Huawei may change the information at any time without notice.HUAWEI TECHNOLOGIES CO., LTD.Huawei Industrial BaseBantian LonggangShenzhen 518129, P.R. ChinaTel: +86-755-28780808 Version No.: M3-110019999-20110805-C-1.0。
Eudemon 1000防火墙 产品概述 正文
目录第1章产品简介 ....................................................................................................................... 1-1第2章产品特点 ....................................................................................................................... 2-12.1 高性能处理......................................................................................................................... 2-12.2 增强的报文过滤.................................................................................................................. 2-12.3 NAT应用............................................................................................................................ 2-22.4 多安全区域支持.................................................................................................................. 2-32.5 多种功能模式 ..................................................................................................................... 2-32.6 强大的攻击防范能力 .......................................................................................................... 2-42.7 IDS联动............................................................................................................................. 2-52.8 防火墙双机热备份.............................................................................................................. 2-52.9 完备的流量监控.................................................................................................................. 2-62.10 丰富灵活的维护管理 ........................................................................................................ 2-72.11 多种广域网接口................................................................................................................ 2-72.12 AAA认证.......................................................................................................................... 2-72.13 安全保障的VPN应用....................................................................................................... 2-82.14 QoS质量保证................................................................................................................... 2-82.15 日志管理........................................................................................................................... 2-92.16 可靠的产品设计.............................................................................................................. 2-10第3章系统结构 ....................................................................................................................... 3-13.1 产品外观............................................................................................................................. 3-13.2 系统配置............................................................................................................................. 3-23.3 系统对外接口 ..................................................................................................................... 3-33.4 支持的接口模块.................................................................................................................. 3-4第4章组网应用 ....................................................................................................................... 4-14.1 攻击防范............................................................................................................................. 4-14.2 双机热备份应用.................................................................................................................. 4-14.3 集成路由功能 ..................................................................................................................... 4-24.4 IPSec保护的VPN应用 ..................................................................................................... 4-34.5流量监控应用..................................................................................................................... 4-44.6 NAT应用............................................................................................................................ 4-4第5章系统特性列表及性能指标.............................................................................................. 5-15.1 Quidway Eudemon1000功能特性列表.............................................................................. 5-15.2 Quidway Eudemon1000整机性能指标.............................................................................. 5-3第6章选购指南 ....................................................................................................................... 6-16.1 主机选购............................................................................................................................. 6-16.1.1 主机选购时需要考虑的因素..................................................................................... 6-16.1.2 主机选购一览表....................................................................................................... 6-16.2 接口模块选购 ..................................................................................................................... 6-26.3 电缆/光缆选购 .................................................................................................................... 6-36.3.1 外部成套电缆选购 ................................................................................................... 6-36.3.2 外部成套光缆选购 ................................................................................................... 6-4第1章产品简介随着Internet的迅速发展，越来越多的企业开始借助于网络服务加速自身的发展，那么如何在一个开放的网络环境中“守护”自己的企业内部网成为人们关注的话题。
华为HiSecEngine Eudemon1000E-F系列AI防火墙产品简介说明书
HiSecEngine Eudemon1000E-F Series AI FirewallsOverviewThe Eudemon1000E-F is a new series firewall developed by Huawei to meet the needs of carriers, enterprises, and next-generation data centers. It combines industry-leading security technologies such as access control, intrusion prevention (IPS), antivirus (AV), URL filtering, anti-spam, and data loss prevention with rich security, robust processing and carrier-class reliability. Inheriting the Eudemon series' outstanding firewall, VPN, and routing features, it helps you build a fast, efficient, and secure network.Product HighlightsComprehensive and Integrated Protection⚫Integrates the traditional firewall, VPN, intrusion prevention, antivirus, data leak prevention, bandwidth management, URL filtering, and online behavior management functions all in one device.⚫Implements refined bandwidth management based on applications and websites, preferentially forwards key services, and ensures bandwidth for key services.⚫Comes with an antivirus content-based detection engine (CDE) powered by intelligence technologies that helps detect unknown threats, and provides in-depth data analysis to gain insight into threat activities and quickly detect malicious files, effectively improving the threatdetection rate.Easy Security Management⚫Rapidly deploys security policies using scenario-specific templates.⚫Complies with the minimum permission control principle and automatically generates policy tuning suggestions based on network traffic and application risks.⚫Analyzes the policy matching ratio and discovers redundant and invalid policies to remove policies and simplify policy management.⚫Supports Huawei SecoManager to achieve a unified configuration, management and maintenance of all devices.High Performance⚫Uses the network processing platform, improving forwarding performance significantly.⚫Enables pattern matching and accelerates encryption/decryption, improving the performance for processing IPS, antivirus, and IPSec services. High Port Density⚫The device has multiple types of interfaces, such as 100G,40G, 10G, and 1G interfaces. Services can be flexibly expanded without extra interface cards.Note: The interface types supported by different models vary. For details, see the specification table.DeploymentExternal Threat Prevention⚫Coming along with the abundant Internet resources are threats such as DDoS attacks, maliciousintrusions, and viruses.⚫The capabilities of supporting large numbers of concurrent connections and new connections persecond help to combat the numerous DDoS attacks.Empowered by advanced IPS and antivirustechnologies as well as vulnerability-based andreal-time updated signature database, theEudemon1000E-F series implements near-zerofalse positives and negatives and a detection ratio of higher than 99%; defends against diversifiedthreats from the Internet, and ensures the security of the intranet . Network Isolation and VPN Interconnection⚫Network areas are not clearly divided, access control is insufficient, and the data transmittedbetween mobile employees or branches and theheadquarters is likely to be intercepted or tampered with.⚫Delivers high throughput to avoid bottleneck at network borders, supports security zones to clearly divide networks, offers flexible packet filteringpolicies to accurately control communication, and encapsulates and checks packets of VPN users to ensure the security of data communication.HackerMalwareInternetEudemonDatacenterBranchInternetHeadquartersUserIPSec VPNSSL VPNEudemonHardwareSoftware FeaturesFeature DescriptionIntegrated protection Integrates firewall, VPN, intrusion prevention, antivirus, data leak prevention, bandwidth management, anti-DDoS, URL filtering, and anti-spam functions. Provides a global configuration view, and manages policies in a unified manner.Application identification and control Identifies over 6000 applications and supports the access control granularity down to application functions. The firewall combines application identification with intrusion detection, antivirus, and data filtering, improving detection performance and accuracy.Intrusion prevention and web protection Accurately detects and defends against vulnerability-specific attacks based on up-to-date threat information. The firewall can defend against web-specific attacks, including SQL injection and XSS attacks.Antivirus Supports intelligent antivirus engine that helps detect hundreds of millions of virus variants.Bandwidth management Manages per-user and per-IP bandwidth in addition to identifying service applications to ensure the network access experience of key services and users. Control methods include limiting the maximum bandwidth, ensuring the minimumbandwidth, and changing application forwarding priorities.Eudemon1000E-F15/F25Eudemon1000E-F35/F55/F85Eudemon1000E-F125Eudemon1000E-F205Feature DescriptionURL filtering Supports remote query for URL categories. The URL category database contains over 140 million URL categories. URL category query servers are deployed globally to offer high-speed, low-latency category query services and meet the regulatory requirements of different countries and regions. URL category filtering can implement URL access control for users or groups based on information such as users or groups, time ranges, and security zones, accurately managing users' online behaviors.Intelligent uplink selection Supports service-specific PBR and intelligent uplink selection based on multiple load balancing algorithms (for example, based on bandwidth ratio and link health status) in multi-egress scenarios.VPN encryption Supports multiple highly available VPN features, such as IPSec VPN, SSL VPN, and GRE, as well as multiple encryption algorithms, such as DES, 3DES, AES, and SHA.Anti-DDoS Defends against more than 10+types of common DDoS attacks, including SYN flood and UDP flood attacks.Security virtualization Supports virtualization of multiple types of security services, including firewall, intrusion prevention, antivirus, and VPN. Users can separately conduct personal management on the same physical device.Security policy management Controls traffic based on the 5-tuples, security zone, application, and time range, and implements integrated content security detection.Uses predefined templates for common attack defense scenarios to rapidly deploy security policies, reducing learning costs.Diversified reports Provides visualized and multi-dimensional report display by user, application, content, time, traffic, threat, and URL.Routing Supports multiple types of routing protocols and features, such as RIP, OSPF, BGP, IS-IS, RIPng, OSPFv3, BGP4+, and IPv6 IS-IS.Deployment and reliability Supports transparent, routing, and hybrid working modes and high availability (HA), including the Active/Active and Active/Standby modes.SpecificationPerformance and Capability Eudemon1000E-F15Eudemon1000E-F25 IPv4 Firewall Throughput1(1518/512/64-byte, UDP)15/15/15 Gbit/s25/25/25 Gbit/s IPv6 Firewall Throughput1(1518/512/84-byte, UDP)15/15/15 Gbit/s25/2525 Gbit/s Firewall Throughput(Packet per Second)22.5 Mpps37.5 M pps Firewall Latency (64-byte, UDP)18 µs18 µsFW + SA* Throughput28Gbps12Gbps NGFW Throughput36Gbps10Gbps NGFW Throughput(Enterprise Mix)4 4.6Gbps 4.6Gbps Threat Protection Throughput (Enterprise Mix)54Gbps4Gbps Concurrent Sessions (HTTP1.1)110,000,00010,000,000 New Sessions/Second (HTTP1.1)1250,000250,000 IPSec VPN Throughput1 (AES-256 + SHA256, 1420-byte)10 Gbit/s15 Gbit/s Maximum IPSec VPN Tunnels (GW to GW)15,00015,000 Maximum IPSec VPN Tunnels (Client to GW)15,00015,000SSL VPN Throughput6 1 Gbit/s 1.5 Gbit/s Concurrent SSL VPN Users (Default/Maximum)100/2000100/2000 Security Policies (Maximum)40,00040,000 Virtual Firewalls 10001000URL Filtering: Categories More than 130URL Filtering: URLs Can access a database of over 120 million URLs in the cloudAutomated Threat Feed and IPS Signature Updates Yes, an industry-leading security center from Huawei (/sec/web/index.do)Centralized Management Centralized configuration, logging, monitoring, and reporting is performed by Huawei SecoManagerVLANs (Max)4094VLANIF Interfaces (Max)1000High Availability Configurations Active/Active, Active/StandbyPerformance and CapabilityNote:1. Performance is tested under ideal conditions based on RFC2544, 3511. The actual result may vary with deployment environments.2. SA performance is measured using 100 KB HTTP files.3. NGFW throughput is measured with Firewall, SA, and IPS enabled; the performance is measured using 100 KB HTTP files.4. NGFW throughput is measured with Firewall, SA, and IPS enabled; the performance is measured using the Enterprise Mix Traffic Model.5. The threat protection throughput is measured with Firewall, SA, IPS,and AV enabled; the performance is measured using the Enterprise Mix Traffic Model.6. SSL VPN throughput is measured using TLS v1.2 with AES128-SHA.*SA: Service Awareness.Hardware Specification Eudemon1000E-F15Eudemon1000E-F25 Dimensions (H x W x D) mm43.6 x 442 x 420Form Factor/Height1UFixed Interface8*GE COMBO + 4*GE(RJ45) + 4*GE(SFP)+ 6*10GE(SFP+)USB Port 1 x USB 3.0 portsWeight (Empty Configuration) 6.3 kgLocal Storage Optional, 1 * 2.5 inch 240G SSD storage, or 1 * 2.5 inch 1TB HDD storage Maximum Power Consumption222WAC Power Supply AC:100V to 240V, 50/60Hz DC: -48V to 60VPower Supplies Dual AC or dual DC power suppliesOperating Environment (Temperature/Humidity)Temperature: 0°C to 45°C (without optional HDD);5°C to 40°C (with optional HDD)Humidity: 5% to 95% (without optional HDD), non-condensing; 5% to 95% (with optional HDD), non-condensingNon-operating Environment Temperature: –40°C to +70°CHumidity: 5% to 95% (without optional HDD), non-condensing; 5% to 95% (with optional HDD), non-condensingOperating Altitude (Maximum)5,000 meters (without optional HDD); 3,000 meters (with optional HDD) Non-operating Altitude (Maximum)5,000 meters (without optional HDD); 3,000 meters (with optional HDD) Noise Maximum value < 72 DbaHardware SpecificationSpecificationPerformance and Capability Eudemon1000E-F35Eudemon1000E-F55Eudemon1000E-F85IPv4 Firewall Throughput1(1518/512/64-byte, UDP)35/35/35 Gbit/s50/50/40 Gbit/s80/80/40 Gbit/s IPv6 Firewall Throughput1(1518/512/84-byte, UDP)35/35/25 Gbit/s50/50/25 Gbit/s80/80/25 Gbit/s Firewall Throughput(Packet per Second)52.5 Mpps60 Mpps60 M pps Firewall Latency (64-byte, UDP)18 µs18 µs18 µsFW + SA* Throughput218Gbps25Gbps25Gbps NGFW Throughput312Gbps18Gbps18Gbps NGFW Throughput (Enterprise Mix)48Gbps8Gbps8Gbps Threat Protection Throughput (Enterprise Mix)57Gbps7Gbps7Gbps Concurrent Sessions (HTTP1.1)120,000,00020,000,00025,000,000 New Sessions/Second (HTTP1.1)1500,000500,000750,000 IPSec VPN Throughput1 (AES-256 + SHA256, 1420-byte)20 Gbit/s30 Gbit/s30Gbit/s Maximum IPSec VPN Tunnels (GW to GW)200002000020000 Maximum IPSec VPN Tunnels (Client to GW)200002000020000 SSL VPN Throughput6 3 Gbit/s 3 Gbit/s 5 Gbit/s Concurrent SSL VPN Users (Default/Maximum)50005000100/5000 Security Policies (Maximum)60,00060,00060000 Virtual Firewalls 100010001000 URL Filtering: Categories More than 130URL Filtering: URLs Can access a database of over 120 million URLs in the cloudAutomated Threat Feed and IPS Signature Updates Yes, an industry-leading security center from Huawei (/sec/web/index.do)Centralized Management Centralized configuration, logging, monitoring, and reporting is performed by Huawei SecoManagerVLANs (Max)4094VLANIF Interfaces (Max)1000High Availability Configurations Active/Active, Active/Standby Performance and CapabilityHardware SpecificationEudemon1000E-F35Eudemon1000E-F55Eudemon1000E-F85Dimensions (H x W x D) mm43.6 x 442 x 420Form Factor/Height1UFixed Interface 8*GE COMBO + 4*GE(RJ45)+ 10*10GE(SFP+)USB Port 1 x USB 3.0 portsWeight (Empty Configuration)7.3 kgLocal Storage Optional, 1 * 2.5 inch 240G SSD storage, or 1 * 2.5 inch 1TB HDD storage Maximum Power Consumption242WAC Power Supply AC:100V to 240V, 50/60Hz DC: -48V to 60VPower SuppliesDual AC or dual DC power suppliesOperating Environment (Temperature/Humidity)Temperature: 0°C to 45°C (without optional HDD); 5°C to 40°C (with optional HDD)Humidity: 5% to 95% (without optional HDD), non-condensing; 5% to 95% (with optional HDD), non-condensingNon-operating Environment Temperature: –40°C to +70°CHumidity: 5% to 95% (without optional HDD), non-condensing; 5% to 95% (with optional HDD), non-condensingOperating Altitude (Maximum)5,000 meters (without optional HDD); 3,000 meters (with optional HDD)Non-operating Altitude (Maximum)5,000 meters (without optional HDD); 3,000 meters (with optional HDD)Noise Maximum value < 72 DbaHardware SpecificationNote :1. Performance is tested under ideal conditions based on RFC2544, 3511. The actual result may vary with deployment environments.2. SA performance is measured using 100 KB HTTP files.3. NGFW throughput is measured with Firewall, SA, and IPS enabled; the performance is measured using 100 KB HTTP files.4. NGFW throughput is measured with Firewall, SA, and IPS enabled; the performance is measured using the Enterprise Mix Traffic Model.5. The threat protection throughput is measured with Firewall, SA, IPS, and AV enabled; the performance is measured using the Enterprise Mix Traffic Model.6. SSL VPN throughput is measured using TLS v1.2 with AES128-SHA.*SA: Service Awareness.SpecificationPerformance and Capability Eudemon1000E-F125Eudemon1000E-F205 IPv4 Firewall Throughput1(1518/512/64-byte, UDP)160/160/80 Gbit/s240/240/120 Gbit/s IPv6 Firewall Throughput1(1518/512/84-byte, UDP)160/120/50 Gbit/s240/200/75 Gbit/s Firewall Throughput(Packet per Second)120 M pps180 M pps Firewall Latency (64-byte, UDP)35 µs35 µsFW + SA* Throughput250Gbps75Gbps NGFW Throughput336Gbps54Gbps NGFW Throughput(Enterprise Mix)416Gbps24Gbps Threat Protection Throughput (Enterprise Mix)514Gbps21Gbps Concurrent Sessions (HTTP1.1)150,000,00075,000,000New Sessions/Second (HTTP1.1)11,500,0002,250,000 IPSec VPN Throughput1 (AES-256 + SHA256, 1420-byte)45Gbit/s65Git/s Maximum IPSec VPN Tunnels (GW to GW)4000060000 Maximum IPSec VPN Tunnels (Client to GW)4000060000SSL VPN Throughput610 Gbit/s12 Gbit/s Concurrent SSL VPN Users (Default/Maximum)100/10000100/15000 Security Policies (Maximum)6000060000Virtual Firewalls 10001000URL Filtering: Categories More than 130URL Filtering: URLs Can access a database of over 120 million URLs in the cloudAutomated Threat Feed and IPS Signature Updates Yes, an industry-leading security center from Huawei (/sec/web/index.do)Centralized Management Centralized configuration, logging, monitoring, and reporting is performed by Huawei SecoManagerVLANs (Max)4094VLANIF Interfaces (Max)1000High Availability Configurations Active/Active, Active/StandbyPerformance and CapabilityNote:1. Performance is tested under ideal conditions based on RFC2544, 3511. The actual result may vary with deployment environments.2. SA performance is measured using 100 KB HTTP files.3. NGFW throughput is measured with Firewall, SA, and IPS enabled; the performance is measured using 100 KB HTTP files.4. NGFW throughput is measured with Firewall, SA, and IPS enabled; the performance is measured using the Enterprise Mix Traffic Model.5. The threat protection throughput is measured with Firewall, SA, IPS, and AV enabled; the performance is measured using the Enterprise Mix Traffic Model.6. SSL VPN throughput is measured using TLS v1.2 with AES128-SHA.*SA: Service Awareness.Hardware Specification Eudemon1000E-F125Eudemon1000E-F205 Dimensions (H x W x D) mm43.6 x 442 x 600Form Factor/Height1UFixed Interface 2*100GE(QSFP28) + 2*40G(QSFP+)+8*25(ZSFP+) + 20*GE(SFP+)14*100GE(QSFP28) +16*25GE(ZSFP+) + 8*GE(SFP+)2USB Port 1 x USB 3.0 portsWeight (Empty Configuration) 6.3 kgLocal Storage Optional, 1 * 2.5 inch 240G SSD storage, or 1 * 2.5 inch 1TB HDD storage Maximum Power Consumption222WAC Power Supply AC:100V to 240V, 50/60Hz DC: -48V to 60VPower Supplies Dual AC or dual DC power suppliesOperating Environment (Temperature/Humidity)Temperature: 0°C to 45°C (without optional HDD);5°C to 40°C (with optional HDD)Humidity: 5% to 95% (without optional HDD), non-condensing; 5% to 95% (with optional HDD), non-condensingNon-operating Environment Temperature: –40°C to +70°CHumidity: 5% to 95% (without optional HDD), non-condensing; 5% to 95% (with optional HDD), non-condensingOperating Altitude (Maximum)5,000 meters (without optional HDD); 3,000 meters (with optional HDD) Non-operating Altitude (Maximum)5,000 meters (without optional HDD); 3,000 meters (with optional HDD) Noise Maximum value < 72 DbaHardware SpecificationNote:1. Some 100GE interfaces and 25GE interfaces of Eudemon1000E-F125 are mutually exclusive.2. Some 100GE interfaces and 25GE interfaces of Eudemon1000E-F205 are mutually exclusive.Order InformationProductEudemon1000E-F15-AC Eudemon1000E-F15 AC Host (8*GE COMBO + 4*GE RJ45 + 4*GE SFP + 6*10GE SFP+, 1 AC power supply) Eudemon1000E-F15-DC Eudemon1000E-F15 DC Host (8*GE COMBO + 4*GE RJ45 + 4*GE SFP + 6*10GE SFP+, 1 DC power supply) Eudemon1000E-F25-AC Eudemon1000E-F25 AC Host (8*GE COMBO + 4*GE RJ45 + 4*GE SFP + 6*10GE SFP+, 1 AC power supply) Eudemon1000E-F25-DC Eudemon1000E-F25 DC Host (8*GE COMBO + 4*GE RJ45 + 4*GE SFP + 6*10GE SFP+, 1 DC power supply) Eudemon1000E-F35-AC Eudemon1000E-F35 AC Host (8*GE COMBO + 4*GE RJ45 + 4*GE SFP + 10*10GE SFP+, 2 AC power supply) Eudemon1000E-F35-DC Eudemon1000E-F35 DC Host (8*GE COMBO + 4*GE RJ45 + 4*GE SFP + 10*10GE SFP+, 2 DC power supply) Eudemon1000E-F55-AC Eudemon1000E-F55 AC Host (8*GE COMBO + 4*GE RJ45 + 4*GE SFP + 10*10GE SFP+, 2 AC power supply) Eudemon1000E-F55-DC Eudemon1000E-F55 DC Host (8*GE COMBO + 4*GE RJ45 + 4*GE SFP + 10*10GE SFP+, 2 DC power supply) Eudemon1000E-F85-AC Eudemon1000E-F85 AC Host (8*GE COMBO + 4*GE RJ45 + 4*GE SFP + 10*10GE SFP+, 2 AC power supply) Eudemon1000E-F85-DC Eudemon1000E-F85 DC Host (8*GE COMBO + 4*GE RJ45 + 4*GE SFP + 10*10GE SFP+, 2 DC power supply) Eudemon1000E-F125-AC Eudemon1000E-F125 AC Host (2*QSFP28 + 2*QSFP+ + 8*ZSFP+ + 20*SFP+, 2 AC power supplies) Eudemon1000E-F125-DC Eudemon1000E-F125 DC Host (2*QSFP28 + 2*QSFP+ + 8*ZSFP+ + 20*SFP+, 2 DC power supplies) Eudemon1000E-F205-AC Eudemon1000E-F205 AC Host (4*QSFP28 + 16*ZSFP+ + 8*SFP+, 2 AC power supplies)Eudemon1000E-F205-DC Eudemon1000E-F205 DC Host (4*QSFP28 + 16*ZSFP+ + 8*SFP+, 2 DC power supplies)SSL VPN LicenseLIC-E1KF-SSLVPN-100Quantity of SSL VPN Concurrent Users(100 Users)LIC-E1KF-SSLVPN-200Quantity of SSL VPN Concurrent Users(200 Users)LIC-E1KF-SSLVPN-500Quantity of SSL VPN Concurrent Users(500 Users)LIC-E1KF-SSLVPN-1000Quantity of SSL VPN Concurrent Users(1000 Users)LIC-E1KF-SSLVPN-2000Quantity of SSL VPN Concurrent Users(2000 Users)LIC-E1KF-SSLVPN-5000Quantity of SSL VPN Concurrent Users(5000 Users)VSYS LicenseLIC-E1KF--VSYS-10Quantity of Virtual Firewall (10 Vsys)LIC-E1KF--VSYS-20Quantity of Virtual Firewall (20 Vsys)LIC-E1KF--VSYS-50Quantity of Virtual Firewall (50 Vsys)LIC-E1KF--VSYS-100Quantity of Virtual Firewall (100 Vsys)LIC-E1KF--VSYS-200Quantity of Virtual Firewall (200 Vsys)LIC-E1KF--VSYS-500Quantity of Virtual Firewall (500 Vsys)LIC-E1KF--VSYS-1000Quantity of Virtual Firewall (1000 Vsys)Threat Protection LicenseLIC-E1KE-Fxx-IPS-1YIPS Update Service Subscribe 12 MonthsLIC-E1KE-Fxx-IPS-3YIPS Update Service Subscribe 36 MonthsLIC-E1KE-Fxx-AV-1YAV Update Service Subscribe 12 MonthsLIC-E1KE-Fxx-AV-3YAV Update Service Subscribe 36 MonthsLIC-E1KE-Fxx-URL-1YURL Remote Query Service Subscribe 12MonthsLIC-E1KE-Fxx-URL-3YURL Remote Query Service Subscribe 36MonthsLIC-E1KE-Fxx-TP-1Y-OVSThreat Protection Subscription 12 MonthsLIC-E1KE-Fxx-TP-3Y-OVSThreat Protection Subscription 36 MonthsLIC-E1KE-F-CONTENTContent Security Group FunctionAbout This PublicationThis publication is for reference only and shall not constitute any commitments or guarantees. All trademarks, pictures, logos, and brands mentioned in this document are the property of Huawei Technologies Co., Ltd. or a third party.For more information, visit /en/products/enterprise-networking/security. Copyright©2021 Huawei Technologies Co., Ltd. All rights reserved.Huawei Technologies Co., Ltd.Address: Huawei Industrial Base Bantian, Longgang Shenzhen 518129, People's Republic of ChinaWebsite: Tel: 4008302118Page 7。
- 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
- 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
- 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。
目录第1章产品简介 ....................................................................................................................... 1-1第2章产品特点 ....................................................................................................................... 2-12.1 高性能处理......................................................................................................................... 2-12.2 增强的报文过滤.................................................................................................................. 2-12.3 NAT应用............................................................................................................................ 2-22.4 多安全区域支持.................................................................................................................. 2-32.5 多种功能模式 ..................................................................................................................... 2-32.6 强大的攻击防范能力 .......................................................................................................... 2-42.7 IDS联动............................................................................................................................. 2-52.8 防火墙双机热备份.............................................................................................................. 2-52.9 完备的流量监控.................................................................................................................. 2-62.10 丰富灵活的维护管理 ........................................................................................................ 2-72.11 多种广域网接口................................................................................................................ 2-72.12 AAA认证.......................................................................................................................... 2-72.13 安全保障的VPN应用....................................................................................................... 2-82.14 QoS质量保证................................................................................................................... 2-82.15 日志管理........................................................................................................................... 2-92.16 可靠的产品设计.............................................................................................................. 2-10第3章系统结构 ....................................................................................................................... 3-13.1 产品外观............................................................................................................................. 3-13.2 系统配置............................................................................................................................. 3-23.3 系统对外接口 ..................................................................................................................... 3-33.4 支持的接口模块.................................................................................................................. 3-4第4章组网应用 ....................................................................................................................... 4-14.1 攻击防范............................................................................................................................. 4-14.2 双机热备份应用.................................................................................................................. 4-14.3 集成路由功能 ..................................................................................................................... 4-24.4 IPSec保护的VPN应用 ..................................................................................................... 4-34.5流量监控应用..................................................................................................................... 4-44.6 NAT应用............................................................................................................................ 4-4第5章系统特性列表及性能指标.............................................................................................. 5-15.1 Quidway Eudemon1000功能特性列表.............................................................................. 5-15.2 Quidway Eudemon1000整机性能指标.............................................................................. 5-3第6章选购指南 ....................................................................................................................... 6-16.1 主机选购............................................................................................................................. 6-16.1.1 主机选购时需要考虑的因素..................................................................................... 6-16.1.2 主机选购一览表....................................................................................................... 6-16.2 接口模块选购 ..................................................................................................................... 6-26.3 电缆/光缆选购 .................................................................................................................... 6-36.3.1 外部成套电缆选购 ................................................................................................... 6-36.3.2 外部成套光缆选购 ................................................................................................... 6-4第1章产品简介随着Internet的迅速发展，越来越多的企业开始借助于网络服务加速自身的发展，那么如何在一个开放的网络环境中“守护”自己的企业内部网成为人们关注的话题。