Solution for Industrial & Internet of Things applications

Product

Barracuda NextGen Firewall F Solution for Industrial & Internet of Things applications

Content

About the Company . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

Barracuda NextGen Firewall FSC . . . . . . . . . . . . . . . . 4

Simple, Secure and Scalable: Connectivity for Internet of Things and

Industrial Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Easily scales to the tens of thousands of remote locations . . . . . . . 5

NextGen Firewall security levels . . . . . . . . . . . . . . . . . . . . . . . 5

Central Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Quickly deployed by untrained staff . . . . . . . . . . . . . . . . . . . . . 5

Secure Your Network’s Perimeter . . . . . . . . . . . . . . . . 6

A Barracuda NextGen Firewall FSC deployment provides several layers

of security to protect an organization’s IoT network . . . . . . . . . . . 6

Malware Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Intrusion Detection and Prevention . . . . . . . . . . . . . . . . . . . . . 6

Controlling Application Usage . . . . . . . . . . . . . . . . . . 7

Block unwanted applications, control acceptable traffic, and ensure

business continuity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Application Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Personalized Application Control . . . . . . . . . . . . . . . . . . . . . . . 7

Application-Based Provider Selection . . . . . . . . . . . . . . . . . . . . 7

Deep Application Context . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Maintain Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . 8

Barracuda 3G modem [M12] . . . . . . . . . . . . . . . . . . . . . . . . . 8

Central Management for the IoT . . . . . . . . . . . . . . . . 9

Scalable Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Lifecycle Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

Hardware Facts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11

Barracuda NextGen Firewall F Secure Connector 1 . . . . . . . . . . . .11

Barracuda NextGen Control Center C400 . . . . . . . . . . . . . . . . . .12

Barracuda NextGen Control Center C610 . . . . . . . . . . . . . . . . . .13

Virtual Appliances Facts . . . . . . . . . . . . . . . . . . . . . . . .14

Barracuda NextGen Firewall FSAC . . . . . . . . . . . . . . . . . . . . . .14

Barracuda NextGen Firewall Control Center . . . . . . . . . . . . . . . .14

Features & Capabilities . . . . . . . . . . . . . . . . . . . . . . . .15

Barracuda NextGen Firewall F Secure Connector (FSC) . . . . . . . . .15

Barracuda NextGen Control Center . . . . . . . . . . . . . . . . . . . . .19

Available Subscriptions . . . . . . . . . . . . . . . . . . . . . . . .21

Availability Matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21

Energize Updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21

Warranty Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21

Instant Replacement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21

Malware Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22

Advanced Threat Detection . . . . . . . . . . . . . . . . . . . . . . . . . .22

Premium Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23

Ordering Information . . . . . . . . . . . . . . . . . . . . . . . . . .24

Secure Connector 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24

Secure Access Concentrator . . . . . . . . . . . . . . . . . . . . . . . . . .24

Barracuda NextGen Control Center . . . . . . . . . . . . . . . . . . . . .25

Hardware Appliances . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25

Virtual Appliances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .25

Microsoft Azure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26

Amazon Web Services (AWS) . . . . . . . . . . . . . . . . . . . . . . . .26

Content Page

3About the Company

Barracuda Networks provides cloud-connected security and storage solutions that simplify IT . These powerful, easy-to-use, and affordable solutions are trusted by more than 150,000 organizations worldwide . Barracuda’s expansive product portfolio delivers protection against threats targeting email, web, and network intrusions, as well as products that improve application delivery, network access, message archiving, backup, and data protection, on-premises or in the cloud .

Barracuda’s high-value, subscription-based IT solutions provide end-to-end network and data security that helps customers address security threats, improve network performance, and protect and store their data .

Barracuda’s international headquarters are in the heart of northern California’s Silicon Valley .

Barracuda NextGen Firewall FSC

Simple, Secure and Scalable: Connectivity for Internet of Things and Industrial Applications

The Barracuda NextGen F-Series offers large-scale remote access capabilities . It enables the ever-growing number of IoT devices, point-of-sales, kiosks and micro networks to securely connect to the local datacenter or cloud-hosted applications .

Components for a FSC-Series deployment are:

Secure Connector (FSC) appliances (hardware only)

Secure Access Concentrator (FSAC) (virtual, Azure)

NextGen Control Center (hardware, virtual, Azure)

In a typical deployment scenario, one or multiple IoT endpoints are connected to the F-Series’ Secure Connector (FSC) appliances establishing a secure VPN tunnel to the Secure Access Concentrator (FSAC) . The Secure Access Concentrator acts as the connectivity hub, with each FSAC being able to handle connections from up to 2,500 Secure Connector endpoint appliances . The FSAC terminates VPN connections from the FSC appliances and enforces security policies with the full feature set of network firewall, IPS, Denial of Service protection, Application Control, URL Filtering, Virus Scanning, and even Advanced Threat Detection and sandboxing . Dozens of FSAC appliances can be deployed and managed from a single NextGen Control Center, effectively enabling secure remote connectivity for tens of thousands of remote locations and devices manageable from a single pane of glass .

Barracuda NextGen Firewall FSC Page

5

Easily scales to the tens of thousands of remote locationsThe encrypted connection between the FSC1 appliance and the Secure Access Connector is established with the Barracuda Networks proprietary enhanced IPsec protocol TINA, which is more resilient and provides greater performance than most competitive VPN solutions no loss to security .

Every Secure Access Connector can thus maintain an encrypted connection to thousands of remote SC1 appliances while literally dozens of Secure Access Connectors can be managed remotely by the Barracuda NextGen Control Center .

To deploy Barracuda NextGen Firewall FSC appliances to an even wider variety of use cases and remote locations, the FSC1 appliance comes with your choice of uplinks and automated failover in case one uplink fails . Besides the typical wired uplinks using DHCP or static IP, the integrated wireless Access Point functionality can be reversed to access the WAN via existing wireless networks . For even greater deployment flexibility, the FSC1 is available with an optional 3G modem .

NextGen Firewall security levelsWhile the device itself is not designed to perform advanced functions like Application Detection, IPS, antivirus or URL Filtering on the box itself, such actions can easily be performed centrally at the larger office or datacenter where the devices connect to the Secure Access Connector . Full next-generation protection is available as moderately priced options for unlimited users per Secure Access Connector gateway deployed . Advanced Threat Detection (ATD) via sandboxing and detonation in the cloud is also available .

Central ManagementManaging configurations of security appliances can be a complicated and time-consuming task . To ease administrators’ lives, the FSC uses a new template-based configuration . Templates can be created at the various organizational levels supported by the NextGen Control Center . Once a template is changed, all FSC1 appliances linked to this template are automatically updated within seconds .

Deploying to many locations often results in a complex routing setup . Each remote network needs to be properly defined and routed from the datacenter . The FSC can also take care of these tasks by assigning defined subnets automatically to FSC1 appliances and keeping track of required routing paths . And - of course - you can manage all F-Series deployments in the same NextGen Control Center .

Quickly deployed by untrained staffTo make the installation and setup process as efficient as possible, the SC1 appliances can be shipped directly to the intended remote location without the need for specialized IT personnel to be present on-site . The central IT department can quickly create a configuration file via the Barracuda NextGen Control Center, send it to the site (e .g ., via email), and have the configuration file copied by drag-and-drop onto the FSC1 appliance . After rebooting the FSC1, the configuration file is processed and the setup process concluded – your FSC1 is ready to go!

Secure Your Network’s Perimeter

A Barracuda NextGen Firewall FSC deployment provides several layers of security to protect an organization’s IoT network

FSC1’s connected viaF3G or WAN

FSC1’s connected via3G or WAN

FSC1’s connected via3G or WAN

FSC1

FSC1

FSC1

NetworkFSACHosted in HQ

FSACHosted in Datacenter

FSACHosted in

Microsoft Azure

Data

Inte

rnet

of T

hing

s

MalwareProtection

Energize Updates

Advanced Threat Detection Network

Malware ProtectionThe optional Malware Protection shields your internal network from malicious content by scanning web / email content and file transfers via two fully integrated antivirus engines . Malware Protection is based on regular signature updates as well as advanced heuristics to detect malware or other potentially unwanted programs even before signatures are available .

The Malware Protection covers viruses, worms, trojans, malicious java applets, and programs using known exploits on, for example, PDFs, pictures and office documents, macro viruses, even when using stealth or morphing techniques for obfuscation .

More details are available on page 16 .

Intrusion Detection and PreventionThe built-in Intrusion Detection and Prevention System (IDS/IPS) strongly enhances network security by providing complete and comprehensive real-time network protection for your operating systems, applications, and databases against a broad range of threats and attacks .

By providing advanced attack and threat protection features such as stream segmentation and packet anomaly protection, TCP split handshake protection, IP and RPC defragmentation, FTP evasion protection, as well as URL and HTML decoding, the Secure Access Concentrator (SAC) can identify and block advanced evasion attempts and obfuscation techniques used by attackers to

circumvent and trick traditional intrusion prevention systems .

As part of Barracuda’s Energize Updates subscription, automatic signature updates are delivered on a regular schedule or on an emergency basis to ensure that the SAC is constantly up-to-date . If the firewall unit is centrally managed, the pattern updates are conveniently distributed by the Barracuda NextGen Control Center .


Controlling Application Usage Page

7

Block unwanted applications, control acceptable traffic, and ensure business continuityMobile devices, online applications, social networks, and streaming media have caused an enormous increase in non-business network data traffic, pushing bandwidth capacities to their limits and causing degradation in performance of business-critical applications .A Barracuda NextGen Firewall FSC deployment gives administrators granular control over applications, allowing them to define rules for forwarding data traffic using the best respective transmission channels based on type of application, user, content, time of day, and geographical location .

Application ControlThe Barracuda NextGen Firewall family provides powerful and extremely reliable detection and classification of thousands of applications and sub-applications by combining Deep Packet Inspection (DPI) and behavioral traffic analysis – no matter if the protocols are using advanced obfuscation, port hopping techniques, or encryption . It allows the creation of dynamic application policies and facilitates the establishment and enforcement of acceptable access and use policies for users and groups by application, application category, location, and time of day . Barracuda NextGen Firewalls combine application control with seamless integration of authentication schemes like Active Directory, RADIUS, or LDAP/S . As a result, administrators are always on top of what users are doing to on the organization’s network . Barracuda NextGen Firewalls feature advanced application-based routing path selection and Quality of Service (QoS) capabilities . These provide additional business value and security by significantly improving network quality and availability, and by reducing direct line cost due to saved bandwidth .

For rich reporting and drill-down capabilities, Barracuda NextGen Firewalls come with real-time and historical application visibility that shows application traffic on the corporate network, thus providing a basis for deciding which connections should be given bandwidth prioritization, which is crucial to QoS optimization for business-critical applications . Furthermore, it lets admins adjust and refine corporate application use policies .


Personalized Application ControlOn top of thousands of applications that are delivered out of the box and constantly updated, Barracuda NextGen Firewalls provide a way to easily create user-defined application definitions for best-in-class application control customized and tailored to an organization’s specific needs .

Application-Based Provider SelectionThe combination of next-generation security and adaptive WAN routing lets Barracuda NextGen Firewalls dynamically assign available bandwidth for several links not only based on protocol, user, location, and content, but also based on applications, application categories, and web filter categories . This keeps expensive, highly available lines free for business and mission-critical applications, while significantly reducing response times and freeing up additional bandwidth .

Deep Application ContextThe deep application context analysis allows for a more thorough inspection of the application data stream by continually evaluating the actual intention of applications and the respective users . By this means, administrators can gain detailed insight into what a specific application was used for, or if a user was trying to circumvent the corporate application usage policy .

Controlling Application Usage

Application Control

Barracuda NextGen Firewall S - SAC

ISP Z

ISP Y

ISP XMaintenance

App

ERPApp

StatisticsApp

MaintenanceApp

ERPApp

OtherApps

use Y use X or Z

Application Usage & RiskReport.pdf

Maintain Connectivity

Barracuda 3G modem [M12]The 3G modem provides support for wireless third generation broadband communication using 3G/UMTS/HSDPA/HSUPA technologies thus providing bandwidths of up to 7 .2 Mbps . Especially for remote sites the 3G modem is a cost effective, rapidly deployable and ultra-reliable WAN backup solution which can protect businesses and organisations against outages caused by accidental cable or fiber link cuts during construction, moves or maintenance work .

Who can benefit from the Barracuda 3G modem?

• Enterprises looking for a cost effective secondary link in order to quickly increase total overall bandwidth and to reduce traffic volume on the primary link

• Enterprises relying on high quality WAN backup and WAN connectivity for business critical traffic

• Branch offices and remote sites looking for a cost effective alternative to earth bound uplinks

• Branch offices and remote sites looking to bridge the gap until cable connections become available

• Branch offices and remote sites residing in areas without a good selection of affordable or reliable Internet uplinks

• Construction sites, retail, rapid deployments and portable businesses requiring quick access to Internet connectivity

Note: Barracuda Networks cannot guarantee signal reception . In case your server rooms are located in a basement or in a place with insufficient signal reception make sure that the signal quality is sufficient, especially prior to purchasing large quantities . The SIM card is not included and has to be obtained independently through a mobile phone provider .

Image shows (from left to right) appliance FSC1, 3G modem, and the antenna

Central Management for the IoT

To centralize management across an IoT network and organization networks, the Barracuda NextGen Control Center lets administrators manage and configure security, content, traffic management, and network access policies from a single interface . Template-based configuration and globally available security objects enable efficient configuration across thousands of locations .

The Barracuda NextGen Control Center helps significantly reduce the cost associated with security management while providing extra functionality both centrally and locally at the managed gateway . Software patches and version upgrades are centrally controlled from within the management console, and deployment can be applied to all managed devices .

FSC1 connected via3G or WAN



BarracudaNextGen Control Center

FSC1

FSC1

FSC1

Network

FSACHosted in HQ

FSACHosted in data center

FSACHosted in

Microsoft Azure

Data

Con�guration Sync

Hosted on-premises orin Microsoft Azure

Inte

rnet

of T

hing

s

Highly customizable administrative roles can be defined to delegate administrative capabilities for specific departments or locations .

Scalable DeploymentManaging the security issues in a widely distributed enterprise network can be painful and extremely time consuming . Managing a system may take only 15 minutes per day . But having 20 systems in place results in five hours per day – just to manage the existing system .

With the NextGen Control Center, managing multiple FSACs takes the same amount of time as managing one .

• Create pre-configured templates for easy rollout .• Have all information of the enterprise security

deployment available in real time .• Create reports for either one or all F-Series compounds .

Lifecycle ManagementThe scalable Barracuda NextGen Firewall FSC deployment offers companies sustainable investment protection . Energize Updates automatically provide the latest firmware and threat definitions to keep the appliance up-to-date . With a maintained Instant Replacement subscription, organizations receive a new appliance with the latest specs every four years .


Central Management for the IoT Page

10

Model Comparison

Standard Edition Enterprise Edition Global Edition

C400hardware

model

VC400virtual

environments

VCC400public cloud

offerings

C610hardware model

VC 610virtual

environments

VCC610public cloud

offerings

VC820virtual

environments

HARDWARE

Form Factor 1U Full Size

vmware,Hyper-V,

Cytrix Xen Server,KVM

Microsoft Azureand

Amazon Web Service

2U Full Size

vmware,Hyper-V,


Microsoft Azureand

Amazon Web Service

vmware,Hyper-V,


Dimensions (Height x Width x Depth) [in] 16 .0 x 16 .7 x 1 .7 17 .4 x 25 .5 x 3 .5

Dimensions (Height x Width x Depth) [mm] 406 x 425 x 44 442 x 648 x 89

Weight [lbs] 13 .1 39 .7

Weight [kg] 5 .9 18

Copper Ethernet NICs 2x1 GbE 2x1 GbE

Mass Storage Type HDD

Specifications depend on selected hardware / compute instance

HDD

Specifications depend on selected hardware / compute instance

Mass Storage Size [GB] 2 x 250 or better 4 x 500 or better

Power Supply Single, internal Dual, internal

Max . power draw @ 120V [Amps .] 1 .8 4 .1

Max . power draw @ 230V [Amps .] 0 .9 2 .1

Features

Max . no . of Managed Gateways [Recommended]

Not limited [20]

Not limited [20]

Not limited [20]

Not limited [200]

Not limited [hardware-dependent]

Manageable Configuration Groupings 1 1 1 Not limited Not limited Not limited Not limited

Multi-Administrator Support l l l l l l l

Role-based Administration l l l l l l l

Revision Control System l l l l l l l

Central Statistics l l l l l l l

Central Syslog Host / Relay l l l l l l l

Firewall Audit Information Collector / Viewer l l l l l l l

Barracuda Access Monitor l l l l l l l

Barracuda Earth l l l l

PKI Service l l l l

High Availability Optional Optional Optional Optional Optional OptionalHA license included

Multi-tenancyYes

(via configuration groupings)Yes, support for 5 tenants

Additional Tenant for Multi-tenancy Optional

Hardware Facts

Barracuda NextGen Firewall F Secure Connector 1

LANWANConsole USBOTGPWRRSTDC 5V

Interface

Copper Ethernet NICs 2x1 GbE

USB 2 .0 1

Micro-USB OTG 1

Performance [as of firmware release 7.0.x]

Firewall throughput (UDP) [Mbps] 300

WiFi AP mode throughput (UDP) [Mbps] 80

WiFi client mode throughput (UDP) [Mbps] 30

VPN throughput [AES-128, SHA, Mbps] 30

Memory

RAM [GB] 1

Mass storage

Type Micro SD

Size [GB] 16

Size, weight, dimensions

Weight appliance [lbs] 0 .35

Weight appliance [kg] 0 .16

Appliance size: width x depth x height [in] 5 .2 x 3 .73 x 1 .11

Appliance size: width x depth x height [mm] 132 x 94 .7 x 28 .3

Weight carton with appliance [lbs] 1 .43

Weight carton with appliance [kg] 0 .65

Carton size: width x depth x height [in] 10 .05 x 8 .66 x 1 .17

Carton size: width x depth x height [mm] 255 x 220 x 55

Form factor Pocket Size

Hardware

Display -

Cooling Fanless

Environmental

Noise emission [db/A] N/A

Operating temperature [°F] +30 to +105

Operating temperature [°C] 0 to +40

Storage temperature [°F] -5 to +160

Storage temperature [°C] -20 to +70

Operating humidity (non-condensing) 5% to 95%

MTBF [system]

MTBF [yrs .] > 5

Power & efficiency

Power supply Single, external

Power supply type External brick

Power type [AC/DC] AC

Input rating [Volts] 100-240

Input frequency [Hz] 50-60

Output voltage 5V DC, 1A

Wattage / max . power draw [W] 5

Certifications & compliance

CE emissions Yes

CE electrical safety Yes

FCC emissions Yes

Packaging content

Appliance Yes

Straight network cable Yes

USB Type A to MicroUSB cable Yes

External power brick Yes

Quick start guide Yes

2x Barracuda wall mount bracket Yes

Hardware Facts Page

12

Barracuda NextGen Control Center C400

PORT1 PORT2NextGen Control Center C400

Interface


USB 2 .0 4

Serial / console 1 [DB9] / 1 [RJ45]

Memory

RAM [GB] 2

Mass storage

Type HDD

Size [GB] 2x 250



Weight appliance [kg] 5 .9


Appliance size: width x depth x height [mm] 406 x 425 x 44





Form factor 1U Rack Mount

Hardware

Display -

Cooling Fan

Environmental







MTBF [system]

MTBF [yrs .] > 5

Power & efficiency

Power supply Single

Power supply type internal




Auto sense Yes

Max . power draw @ 120V [Amps .] 1 .8



CE emissions Yes


FCC emissions Yes

ROHS compliant Yes

Packaging content

Appliance Yes

Direct power to wall outlet Yes

USB flash drive for recovery & installation Yes


2x Barracuda L-shape rack mount bracket Yes

Hardware Facts Page

13

Barracuda NextGen Control Center C610

NextGen Control Center C610

Interface


USB 2 .0 2

Serial / console 1 [DB9]

Memory

RAM [GB] 4

Mass storage

Type HDD

Size [GB] 4x 500

Redundant Disk Array (RAID) RAID 5



Weight appliance [kg] 18


Appliance size: width x depth x height [mm] 442 x 648 x 89





Form factor 2U Rack Mount

Hardware

Display -

Cooling Fan

Environmental







MTBF [system]

MTBF [yrs .] > 5

Power & efficiency

Power supply Dual

Power supply type internal




Auto sense Yes




CE emissions Yes


FCC emissions Yes

ROHS compliant Yes

Packaging content

Appliance Yes

Direct power to wall outlet Yes

USB flash drive for recovery & installation Yes


2x Barracuda L-shape rack mount bracket Yes

Virtual Appliances Facts

FSAC and NextGen Control Center Deployments

As organizations have adopted virtualization for their server infrastructures, there has been a corresponding trend to extend the benefits of virtualization to the security layer . The Barracuda NextGen Firewall FSC deployment fits perfectly into this ongoing virtualization process . It is ideally suited for organizations that are deploying virtual environments - be it for scalability, fast rollout, or cost reasons . Beyond its powerful network firewall, IPS, and VPN technologies, the Barracuda NextGen Firewall FSC deployment integrates via Advanced Threat Detection a comprehensive set of next-generation firewall technologies, including Application Control, availability and traffic flow optimization across the wide area network, web filtering, antivirus enforcement as well as protection against zero-hour/day threats, advanced malware, etc .

Beyond its powerful network firewall, IPS, and VPN technologies, Barracuda NextGen Firewall F Vx integrates a comprehensive set of next-generation firewall technologies, including Application Control, availability, and traffic flow optimization across the wide area network, web filtering, antivirus, anti-spam, and network access control enforcement .

Note: For more details on Barracuda Virtual Appliances, please visit barracuda .com/solutions/virtual .

All virtual editions are available for:

Barracuda NextGen Firewall FSACFor more details, please click here . . .

FSAC400 FSAC610 FSAC820Capacity

Number of Protected IPs unlimited unlimited unlimited

Allowed Cores 2 4 8

Max . number of VPN connections 500 1,200 2,500

Available Subscriptions

Malware Protection Optional Optional Optional

Advanced Threat Detection Optional Optional Optional

Barracuda NextGen Firewall Control CenterFor more details, please click here . . .

http://barracuda.com/solutions/virtual

Features & Capabilities

Barracuda NextGen Firewall F Secure Connector (FSC)Firewall

Stateful packet forwarding (per rule) l

Transparent proxy (TCP; per rule) l

Inline graphical packet analyzer l

NAT (src, dst, nets), PAT l

Policy-based NAT (per rule) l

Protocol support (IPv4, IPv6 1) l

Gigabit performance l

Object oriented rule set l

Virtual rule sets l

Virtual rule test environment l

Real-time connection status l

Historical access caches l

Event-triggered notification l

Load balancing for protected servers l

Multipath load balancing l

Firewall-to-firewall compression (stream & packet compression) l

Dynamic rules with timer-triggered deactivation ( per rule) l

Bridging mode / routing mode (mixed) l

Virtual IP (proxyARP) support l

Transparent IP to user mapping l

User authentication x .509, Microsoft® NTLM, RADIUS, RSA SecurID, LDAP/LDAPS, Microsoft® Active Directory®, TACACS+, local

RPC protocol support (ONC-RPC, DCE-RPC) l

VoIP support (H .323, SIP, SCCP (skinny)) l

Standby mode Active-Passive

Network notification on failover l

Key-based authentication l

Encrypted HA communication l

Transparent failover without session loss l

Application Control

Deep Packet Inspection l

Application Behavior Analysis l

More than 1,400 applications and protocols supported (Skype, BitTorrent, etc .) l

Social Media Application Support (Facebook, Google+, etc .) l

Media Streaming Application Support (YouTube, Netflix, etc .) l

Proxy and Anonymizer Detection (Hide Me, Cyberghost, etc .) l

Application Objects based on Category, Risk, Properties and Popularity l

Predefined Categories such as Business, Conferencing, Instant Messaging, Media Streaming, etc . l

Inspection of SSL-encrypted traffic l

Filtering of SSL-encrypted traffic l

Creation of Customized Applications l

Deep Application Context l

Google SafeSearch enforcement l

1 IPv6 firewall forwarding traffic, IPS, and Application Control .

Features & Capabilities Page

16

Barracuda NextGen Firewall F Secure Connector (FSC)Application Control (continued)

YouTube for Schools support l

Application-Based Link Selection l

Bandwidth and QoS Assignment l

Application Logging l

Application Blocking l

Application Monitor and Drill-Down Function l

Reporting l

Intrusion Prevention System

Inline Intrusion Prevention l

Generic pattern filter l

Active ARP handling l

SYN / DoS / DDoS attack protection l

Reverse routing path check l

ICMP flood ping protection l, by size and rate limit

Malformed packet check l

TCP split handshake protection l

TCP stream segmentation check l

URL obfuscation check l

FTP evasion check l

RPC defragmentation check l

HTML decoding l

HTML decompression l

SMB & NetBios Evasion Protection l

Regular online pattern updates l

IPS exception (whitelisting) l

IPS exceptions based onSource / Destination l

Port & Port Range l

Signature / CVE l

Malware Protection

Single-Pass Mode l

Proxy Mode l

Configurable archive recursion depth l

Quarantine functionality for proxy l

Configurable unknown archive policy l

Configurable maximum archive size l

Archiver package support l

Office file-types support l

Proactive detection of new threats l

Advanced heuristics detection techniques l

Number of signatures Hundreds of thousands

Frequency of signature updates Multiple updates per day

Dynamic, on-demand analysis of malware programs (sandbox) l



17

Barracuda NextGen Firewall F Secure Connector (FSC)Advanced Threat Detection

Supported file typesMicrosoft Office files l

Microsoft executables (exe, msi, dll) l

Adobe PDF documents l

Android APK files l

ZIP archives l

RAR archives l

Supported protocolsHTTP / HTTPS l

FTP l

SMTP / SMTPS l

Dynamic analysis of documents with embedded exploits (PDF, Office, etc .) l

Detailed forensics for both malware binaries and web threats (exploits) l

High-resolution malware analysis (monitoring, execution from the inside) l

Support for multiple operating systems (Windows, Android, etc .) l

Flexible malware analysis in the cloud l

Barracuda Web Filter

Blacklists/Whitelists (per rule) l

Filter categories 95

Temporal constraints l

User-specific / group-specific restrictions l

Cached online category database l

Local update interval N/A

Online update interval continuously

Customizable block pages l

Routing, Networking

HA capable with transparent session failover l

GbE Ethernet support l

802 .1q VLAN support l

xDSL support (PPPoE, PPTP (multi-link)) l

DHCP client support l

Link monitoring (DHCP, xDSL, ISDN) l

Policy routing support l

Ethernet channel bonding l

Multiple networks on interface, IP aliases l

Multiple provider / WAN link support l

Configurable MTU size (per route) l

Jumbo Frames (up to 9,000 bytes) l

IPinIP and GRE tunnels l

PPTP l

BGP l

Dynamic VPN routing l

Dynamic routing (BGP, OSPF, RIP) l



18

Barracuda NextGen Firewall F Secure Connector (FSC)Traffic Management

Maximum overall bandwidth per interface All management via VPN tunnel

On-the-fly reprioritization via firewall status GUI l

Ingress shaping per interface l

Central User Authentication

Supported services Firewall

Authentication methods MS Active Directory

VPN

Encryption support AES-128/256, 3DES/ DES, CAST, Blowfish, Null

Strong user authentication l

Replay protection l

Redundant VPN gateways l

System Management

Central management l

Local management l

Comprehensive GUI-based configuration management l

Command-line interface (CLI) available l

SSH-based access l

Multiple administrators l

Role-based administrators l

Real-time accounting and visualization l

Easy roll-out and recovery l

USB installation and recovery l

Full life-cycle management l

In-band management l

Dedicated management interface l

Serial interfaces l

Central management interface l

All management via VPN tunnel l

Logging/Monitoring/Accounting

System health, activity monitoring l

Human readable log files l

Statistics l

Active event notification Email/SNMP trap

Real-time accounting and reporting l

Syslog streaming (fully GUI configurable) l

DNS

Multi-domain support l

Mail Security

Supported protocols SMTP, SMTP with StartTLS, SMTPS

SSL Interception l

DNS blacklist l

Antivirus for email optional

Advanced Threat Detection for email optional



19

Barracuda NextGen Control CenterStandard

Edition(C400 / VC400)

Enterprise Edition

(C610 / VC610)

Global Edition(VC820)

Public Cloud Edition

Azure AWSConfiguration Management

Tenants 1 1 5 2 2

Configuration groups 1 1 No limit No limit No limit No limit

Maximum managed gateways [recommended]No limit

[20]No limit

[200]No limit

[1000+ depending on HW]No limit

[200]No limit

[200]

Configuration templates (repositories) l l l l l

Shared configuration data l l l l l

Operating system parameters l l l l l

Networking/routing parameters l l l l l

FW/VPN policies, application gateway parameters l l l l l

Flat file data storage l l l l l

Database characteristics (transaction orientation, locking, etc .) l l l l l

Backup and restore functionality l l l l l

Gateway configuration archive for speed install l l l l l

Configuration update monitoring l l l l l

Full RCS versioning l l l l l

VPN graphical tunnel interface l l l l l

Dynamic mesh site-to-site VPN support l l l l l

Barracuda Network Access Client policy management l l l l l

Multi-release management - l l l l

Multi-platform management l l l l l

Status Monitoring

Gateway health state l l l l l

Launch pad functionality l l l l l

Customizable layout l l l l l

Barracuda Earth support - l l l l

Trust Center

Gateway x .509 certificate CA l l l l l

Gateway SSH key management l l l l l

VPN server for management tunnels to gateways l l l l l

Virtual IP addresses for gateways (ProxyARP) l l l l l

Dynamic gateway IP address support l l l l l

License Center

License timestamp server l l l l l

License status display l l l l l

Central event message list l l l l l

Event forwarding (SNMP, mail) l l l l l

Event log l l l l l

Barracuda Activation

Central activation of managed units l l l l l

Central license retrieval for managed units l l l l l

Central license extension for managed units l l l l l

Offline (unit) activation for managed units l l l l l

Offline (unit) license retrieval for managed units l l l l l

Offline (unit) license extension for managed units l l l l l

1 Note that “Configuration Groups“ (named “cluster“ in the firmware) refers to an administratively bundled group of Barracuda NextGen Firewall appliances and not to a load sharing cluster .


20

Barracuda NextGen Control CenterStandard

Edition(C400 / VC400)

Enterprise Edition

(C610 / VC610)

Global Edition(VC820)

Public Cloud Edition

Azure AWSBarracuda Activation (continued)

Activation properties per cluster - l l l l

Activation properties per range - - l - -

Full automatic activation l l l l l

Manual activation l l l l l

Activation of Vx units with license token l l l l l

Activation of HA unit l l l l l

Central Session Tracking

Session display l l l l l

Session termination l l l l l

Central Software Update

Real-time version display l l l l l

Kernel and OS updates l l l l l

Barracuda NextGen Firewall FSC updates l l l l l

Update log viewer l l l l l

Secure Remote Exec. Environment (SSHv2)

Job scheduling l l l l l

Script management l l l l l

Execution log viewer l l l l l

Administration Model

Fully GUI-based access(NextGen Admin management tool) l l l l l

Strong authentication & AES encryption l l l l l

Role-based administration l l l l l

Configurable roles l l l l l

Adjustable view on configuration tree l l l l l

Configurable administrative domains - l l l l

Multiple domains per administrator - l l l l

Configurable access on OS level l l l l l

Configurable access notification l l l l l

Reporting and Accounting

Historical reports on gateway activity l l l l l

Customer-based gateway activity reports l l l l l

Policy distribution l l l l l

Control Center resource utilization l l l l l

Gateway-resource utilization l l l l l

Central log host l l l l l

Streaming/relaying to external log host l l l l l

Additional Functions

NTP4 time server for gateways l l l l l

Integrated DNS server l l l l l

High availability Optional Optional HA license included - -

SIEM syslog interface l l l l l

Public Key Infrastructure - l l l l

Revision Control System l l l l l

Access Monitor l l l - -

1 Note that “Configuration Groups“ (named “cluster“ in the firmware) refers to an administratively bundled group of Barracuda NextGen Firewall appliances and not to a load sharing cluster .

Available Subscriptions

Availability MatrixBarracuda NextGen Firewall FSC1 FSAC400 FSAC610 FSAC610 FSAC820Energize Updates Mandatory

Warranty Extension Optional

Instant Replacement Optional

Malware Protection Optional

Advanced Threat Detection Optional

Premium Support Optional

Energize UpdatesBarracuda Energize Updates help you secure your investment in the ever-changing IT world . Benefit from security updates to patch or repair any security vulnerabilities, keep your Barracuda Networks product up-to-date and fully functional at all times, and get access to our award-winning support .

Note: Available as 1, 3, and 5 year subscriptions . Purchasing at least 1 year of Energize Updates is required with every Barracuda NextGen Firewall .

Energize Updates includes:

• Basic support, i .e ., email support 24/7, and phone support Monday through Friday from 9:00 am to 5:00 pm

• Firmware maintenance, which includes new firmware updates with feature enhancements and bug fixes

• Barracuda Early Release Firmware program (optional)• Unlimited number of client-to-site VPN connections• Security updates to patch or repair

any security vulnerabilities• URL filter based on Barracuda Web Filter online

URL categorization in single-pass (i .e ., used directly in the firewall engine) and in proxy mode

• Regular updates for Application Control database• IPS signature and pattern updates .

Warranty ExtensionProvides an extended warranty and ships a replacement unit on the next business day (best effort) with standard mail upon notification of a failed unit .

Note: Must be purchased within 60 days of hardware purchase and is a continuous subscription from date of activation . Available as 1 and 3 year subscriptions with a maximum coverage of 5 years .

Instant ReplacementOne hundred percent uptime is important in corporate environments, but sometimes equipment can fail . In the rare case that a Barracuda Networks product fails, Barracuda ships a replacement unit on the same or next business day . And by means of the Hardware Refresh Program, we ensure that customers benefit from the latest hardware improvements and firmware capabilities:

• Enhanced support providing phone and email support 24/7

• Hard-disk replacement on models that have swappable RAID drives

• Free hardware refresh after four years of continuous IR coverage .

Note: Must be purchased within 60 days of hardware purchase and is a continuous subscription from date of activation . Available as 1, 3, and 5 year subscriptions .

Available Subscriptions Page

22

Malware ProtectionThe Malware Protection subscription provides gateway-based protection against malware, viruses, spyware, and other unwanted programs inside SMTP/S, HTTP/S, and FTP traffic . Using Malware Protection in proxy mode adds POP3 traffic .

Compatibility and Licensing: Available as 1, 3, and 5 year subscriptions . In High Availability (HA) environments, each unit needs to be licensed separately .

Key Benefits:

• Configurable archive recursion depth• Quarantine functionality for proxy• Configurable unknown archive policy• Configurable maximum archive size• Archiver package support• Office file-types support• Proactive detection of new threats• Advanced heuristics detection techniques• Hundreds of thousands of signatures

Advanced Threat DetectionPrevent malicious files—even unknown ones—from entering the organization . Avoid network breaches, identify zero-day malware exploits, targeted attacks, advanced persistent threats and other advanced malware that routinely bypass traditional signature based IPS and antivirus engines before they do harm to your network .

Environment and Number of Files Inspected Per Month

Virtual Appliances # of files inspectedFSAC400 540,000

FSAC610 648,000

FSAC820 750,000

Compatibility and Licensing: Available as 1, 3, and 5 year subscriptions . Requires a valid Malware Protection subscription . In case the monthly file capacity is reached, the system stops forwarding files to the ATD cloud for the rest of the current month .

Key Benefits:

• Prevent malicious files—even unknown ones—from entering the organization and avoid network breaches .

• Identify zero-day malware exploits, targeted attacks, advanced persistent threats and other advanced malware that routinely bypass traditional signature-based IPS and antivirus engines .

• Granular control over PDFs, EXEs/MSIs/DLLs, Android APKs, Microsoft Office files, and compressed files and archives

• Full interoperability with the integrated SSL Inspection files can be extracted and checked in order to detect advanced malware in the encrypted stream .

• Cloud-based emulation – resource intensive file emulation is offloaded to the Barracuda Cloud .

• Learning local cryptographic hash database for emulation optimization

• Multiple and simultaneous OS environments for emulated files

• Automatic email notifications in case malware activity has been identified can help minimize the admin’s reaction time in order to mitigate the network breach .

• Available for hardware and virtual appliances as well as for Microsoft Azure and Amazon AWS Cloud on BYOL licencing model .

Available Subscriptions Page

23

Premium SupportPremium Support ensures that an organization’s network is running at its peak performance by providing the highest level of 24/7 technical support for mission-critical environments . A dedicated Premium Support Account Manager and a team of technical engineers provide fast solutions to high-priority support issues, thereby ensuring that Barracuda Networks equipment maintains continuous uptime:

• Dedicated phone and email support 24/7• Priority response time to resolve mission-critical issues• Priority Level Agreement (PLAs) to guarantee that

issues are handled, resolved, and closed quickly• Dedicated Support Account Manager who is

familiar with the customer’s environment• Proactive ticket monitoring and reporting to

provide comprehensive information and control

Ordering Information

Calculation of co-terminus subscriptions: To allow customers to consolidate their maintenance and subscription offerings to a single end or renewal date, daily rates for all subscription types are offered . These daily rates should be used to extend expiring subscriptions to coincide with the dates of subscriptions expiring in the future . Barracuda Networks will credit early termination of subscriptions using these daily rates .

Barracuda NextGen Firewall F Secure Connector 1 EMEA / International North America

Barracuda NextGen Firewall Model FSC1 BNGIFSC1a BNGFSC1a

Instant Replacement (1Y, 3Y, 5Y) BNGIFSC1a-h1,3,5 BNGFSC1a-h1,3,5

Warranty Extension (1Y, 3Y) BNGIFSC1a-we1,3 BNGFSC1a-we1,3

Premium Support (1Y, 3Y, 5Y) BNGIFSC1a-p1,3,5 BNGFSC1a-p1,3,5

Energize Updates (1Y, 3Y, 5Y) BNGIFSC1p-e1,3,5 BNGFSC1p-e1,3,5

Barracuda NextGen Firewall FSC1 Pool License BNGIFSC1p BNGFSC1p

Barracuda 3G modem [USB] BNGIM12a BNGM12a

Instant Replacement for Barracuda 3G modem [USB] (1Y, 3Y, 5Y) BNGIM12a-h1,3,5 BNGM12a-h1,3,5

Barracuda NextGen Firewall F Secure Access Concentrator EMEA / International North America

FSA

C400 Barracuda NextGen Firewall FSAC400 BNCIVFAC400a BNCVFAC400a

Energize Updates (1Y, 3Y, 5Y) BNCIVFAC400a-e<duration> BNCVFAC400a-e<duration>

Malware Protection (1Y, 3Y, 5Y) BNCIVFAC400a-m<duration> BNCVFAC400a-m<duration>

Advanced Threat Detection (1Y, 3Y, 5Y) 1 BNCIVFAC400a-a<duration> BNCVFAC400a-a<duration>

Advanced Threat and Malware Protection Bundle (1Y, 3Y, 5Y) BNCIVFAC400a-am<duration> BNCVFAC400a-am<duration>

Premium Support (1Y, 3Y, 5Y) BNCIVFAC400a-p<duration> BNCVFAC400a-p<duration>

FSA






Premium Support (1Y, 3Y, 5Y) BNCIVFAC610a-p<duration> BNCVFAC610a-p<duration>

FSA






Premium Support (1Y, 3Y, 5Y) BNCIVFAC820a-p<duration> BNCVFAC820a-p<duration>1 Requires a valid Malware Protection subscription .

Ordering Information Page

25

Barracuda NextGen Control Center

Hardware Appliances

NextGen Control Center C400 EMEA / International North AmericaBarracuda NextGen Control Center C400 - Standard Edition BNCIC400a BNCC400a

Energize Updates (1Y, 3Y, 5Y) BNCIC400a-e1,3,5 BNCC400a-e1,3,5

Instant Replacement (1Y, 3Y, 5Y) BNCIC400a-h1,3,5 BNCC400a-h1,3,5

Extended Warranty (1Y, 3Y) BNCIC400a-we1,3 BNCC400a-we1,3

Premium Support (1Y, 3Y, 5Y) BNCIC400a-p1,3,5 BNCC400a-p1,3,5

Barracuda NextGen Control Center Cold Spare C400 BNCIC400a-c BNCC400a-c

NextGen Control Center C610 EMEA / International North AmericaBarracuda NextGen Control Center C610 - Enterprise Edition BNCIC610a BNCC610a

Energize Updates (1Y, 3Y, 5Y) BNCIC610a-e1,3,5 BNCC610a-e1,3,5

Instant Replacement (1Y, 3Y, 5Y) BNCIC610a-h1,3,5 BNCC610a-h1,3,5

Extended Warranty (1Y, 3Y) BNCIC610a-we1,3 BNCC610a-we1,3

Premium Support (1Y, 3Y, 5Y) BNCIC610a-p1,3,5 BNCC610a-p1,3,5

Barracuda NextGen Control Center Cold Spare C610 BNCIC400a-c BNCC400a-c

Virtual Appliances

NextGen Control Center VC400 EMEA / International North AmericaBarracuda NextGen Control Center VC400 - Standard Edition BNCIVC400a BNCVC400a

Energize Updates (1Y, 3Y, 5Y) BNCIVC400a-e1,3,5 BNCVC400a-e1,3,5

Premium Support (1Y, 3Y, 5Y) BNCIVC400a-p1,3,5 BNCVC400a-p1,3,5

NextGen Control Center VC610 EMEA / International North AmericaBarracuda NextGen Control Center VC610 - Enterprise Edition BNCIVC610a BNCVC610a

Energize Updates (1Y, 3Y, 5Y) BNCIVC610a-e1,3,5 BNCVC610a-e1,3,5

Premium Support (1Y, 3Y, 5Y) BNCIVC610a-p1,3,5 BNCVC610a-p1,3,5

NextGen Control Center VC820 EMEA / International North AmericaBarracuda NextGen Control Center VC820 - Global Edition BCCIVC820a BCCVC820a

Energize Updates (1Y, 3Y, 5Y) BCCIVC820a-e1,3,5 BCCVC820a-e1,3,5

Premium Support (1Y, 3Y, 5Y) BCCIVC820a-p1,3,5 BCCVC820a-p1,3,5

Additional Tenant (Range) for Barracuda NextGen Control Center VC820 (monthly)

BNCI-b1 BNC-b1

Ordering Information Page

26

Microsoft Azure

NextGen Control Center VCC400 EMEA / International North AmericaBarracuda NextGen Control Center VCC400 - Standard Edition BNCICAZ400a BNCCAZ400a

Energize Updates (1Y, 3Y, 5Y) BNCICAZ400a-e1,3,5 BNCCAZ400a-e1,3,5

Premium Support (1Y, 3Y, 5Y) BNCICAZ400a-p1,3,5 BNCCAZ400a-p1,3,5

NextGen Control Center VCC610 EMEA / International North AmericaBarracuda NextGen Control Center VCC610 - Enterprise Edition BNCICAZ610a BNCCAZ610a

Energize Updates (1Y, 3Y, 5Y) BNCICAZ610a-e1,3,5 BNCCAZ610a-e1,3,5

Premium Support (1Y, 3Y, 5Y) BNCICAZ610a-p1,3,5 BNCCAZ610a-p1,3,5

Amazon Web Services (AWS)

NextGen Control Center VCC400 EMEA / International North AmericaBarracuda NextGen Control Center VCC400 - Standard Edition BNCICAW400a BNCCAW400a

Energize Updates (1Y, 3Y, 5Y) BNCICAW400a-e1,3,5 BNCCAW400a-e1,3,5

Premium Support (1Y, 3Y, 5Y) BNCICAW400a-p1,3,5 BNCCAW400a-p1,3,5

NextGen Control Center VCC610 EMEA / International North AmericaBarracuda NextGen Control Center VCC610 - Enterprise Edition BNCICAW610a BNCCAW610a

Energize Updates (1Y, 3Y, 5Y) BNCICAW610a-e1,3,5 BNCCAW610a-e1,3,5

Premium Support (1Y, 3Y, 5Y) BNCICAW610a-p1,3,5 BNCCAW610a-p1,3,5

© BARRACUDA NETWORKS, INC. SPECIFICATIONS SUBJECT TO CHANGE WITHOUT NOTICE. ALL OTHER BRANDS AND NAMES ARE THE PROPERTY OF THEIR RESPECTIVE OWNERS. ALL LOGOS, BRAND NAMES, CAMPAIGN STATEMENTS, AND PRODUCT IMAGES CONTAINED HEREIN ARE COPYRIGHT AND MAY NOT BE USED AND/OR REPRODUCED, IN WHOLE OR IN PART, WITHOUT EXPRESS WRITTEN PERMISSION BY BARRACUDA NETWORKS MARKETING.

Version 1 .2Applies for firmware 7 .0 .xBarracuda Networks, Inc .

barracuda .com

Solution for Industrial & Internet of Things applications

Documents

Transcript of Solution for Industrial & Internet of Things applications