WIXLIB

DATASHEETTHUNDER CFWHigh-Performance Versatile FirewallSupported PlatformsThe A10 Thunder Convergent Firewall (CFW) is a standalone security product, built onA10 Networks Advanced Core Operating System (ACOS ) platform. Thunder CFW isthe first converged security solution for service providers, cloud providers and largeenterprises that includes:Thunder CFWphysical appliance A powerful Secure Web Gateway that combines URL filtering, A10’s SSL Insighttechnology, and explicit proxy to increase security efficacy by decrypting SSLtraffic at high speed and restricting access to undesirable websites.Thunder SPEphysical appliance A high-performance Data Center Firewall with an integrated Layer 4 firewall, DDoSprotection, and server load balancing. By uniting application delivery control andsecurity on a single platform, Thunder CFW lowers hardware and operating costs.APPvThundervirtual appliance A scalable Gi/SGi Firewall with integrated DDoS protection and Carrier GradeNetworking (CGN) for mobile carriers. The Gi/SGi Firewall protects mobileinfrastructure with advanced policy enforcement. High-speed site-to-site IPsec VPN that enables enterprises and service providersto encrypt data at a massive scale and in the cloud.aGalaxyCentralized ManagementOverviewA10 Networks Thunder ConvergentFirewall (CFW) is a high-performance,all-inclusive and flexible securitysolution featuring a Secure WebGateway, Data Center Firewall, Gi/SGiFirewall and site-to-site IPsec VPNfor enterprises and service providers.Thunder CFW uncovers threats in SSLtraffic and blocks access to maliciouswebsites at the enterprise perimeter.It also protects high-value assets inthe data center from network andDistributed Denial of Service (DDoS)attacks. A10 Thunder CFW offers theperformance and the versatility youneed to safeguard your applications,your users and your infrastructure.With its data center efficient design and compact form factor, Thunder CFW providesan integrated security and application networking solution that minimizes rack space,power consumption and cooling costs.Thunder CFW also leverages the A10 Harmony architecture to provide open andstandards-based programmability, which offers rapid integration with management andorchestration systems, consistent policy enforcement and telemetry. The A10 NetworksaGalaxy Centralized Management System delivers everything that organizations need toconfigure, monitor and troubleshoot all A10 Thunder solutions, including Thunder CFW.Features and BenefitsWhether you are an enterprise, service provider or mobile carrier, A10 Thunder CFWoffers the performance and the versatility you need to safeguard your applications, yourusers and your infrastructure.Secure Web GatewayDecrypt SSL once and inspect multiple times: Thunder CFW enables security devicesto inspect encrypted traffic, eliminating the SSL blind spot in corporate defenses.Leveraging SSL Insight technology, Thunder CFW decrypts SSL traffic and forwards itto third-party security devices for inspection. With the Thunder CFW, organizations canmake their security infrastructure effective again.Prevent data exfiltration and enforce compliance: Thunder CFW allows seamlessintegration with third-party Data Loss Prevention (DLP) solutions via the industry standardICAP. Thunder CFW can send decrypted traffic to DLP servers for inspection before1

forwarding intercepted traffic to a client or a server. According toinspection results from DLP servers, Thunder CFW enforces a policyby either permitting or denying traffic to prevent data leaks andharmful infection.Gi/SGi FirewallAchieve massive scale and multiple functionality in a singlecompact appliance: The Thunder CFW, with an integrated Gi/SGiFirewall, delivers the performance that mobile carriers require toGain superior URL classification coverage: Thunder CFW providesan optional URL filtering service that maximizes employeeproductivity and mitigates web-based threats. Thunder CFW canmonitor or block access to malicious websites, including malware,spam and phishing sites. The A10 URL Classification Service,scale and protect their networks. With the ability to support largesession capacity and high connections-per-second rates, theThunder CFW will meet both current and future traffic requirements.Thunder CFW enables mobile carriers to efficiently safeguard theirinfrastructure, including the Gateway GPRS Support Node (GGSN)powered by Webroot, categorizes over 460 million domains andand P-Gateway in the Evolved Packet Core (EPC).13 billion URLs into 83 categories, enabling organizations to blockThe Thunder CFW includes integrated Carrier Grade NATdesirable sites and shield their users from online threats.Extend the life of security infrastructure: Thunder CFW, withintegrated load balancing, enables organizations to maximizeuptime and increase the capacity of their security infrastructure.It also unburdens firewalls and other security devices fromcomputationally intensive tasks like SSL decryption and ICAPsupport, enabling those devices to do what they do best – detectand stop attacks.functionality to allow mobile carriers to preserve their investmentin IPv4-based infrastructure. Also included are various IPv6transition technologies, such as NAT64/DNS64, to assist inproviding a smooth transition to IPv6 networking and seamlesssubscriber access to resources regardless of the type of IPversion used. Integrated application layer gateways (ALGs) ensurethat applications remain addressable and operate transparentlythrough address translation. By including IPv4 preservation andIPv6 migration support in the multi-functional Thunder CFW,Data Center FirewallAchieve unprecedented firewall performance: Powered by A10’sAdvanced Core Operating System (ACOS), Thunder CFW provideshigh performance in a compact appliance, allowing organizationsto stop emerging threats at scale. Combining a Shared MemoryArchitecture and Flexible Traffic Accelerator (FTA) technology, theData Center Firewall offers ultra-high throughput and unmatchedconnection rates, eliminating traditional performance bottleneckswhile protecting data center assets.Lower OPEX and CAPEX: Consolidating multiple services onone platform reduces the number of appliances that need to bepurchased and cuts power, space and cooling costs. Thunder CFW’sData Center Firewall takes unification further by converging notjust security but also networking and application delivery features,empowering organizations to eliminate single-purpose devices fromtheir data centers and reduce hardware and operating costs.Protect multi-tenant environments: Thunder CFW leverages theA10 Harmony architecture to deliver completely programmablesecurity for the data center. A10 Harmony unifies policy control,offers unprecedented telemetry and provides 100% RESTful APIcoverage. Thunder CFW also supports multi-tenancy features likeApplication Delivery Partitions (ADPs) for segmentation.operational tasks are greatly simplified.To protect mobile infrastructure, the Thunder CFW Gi/SGi Firewallprovides granular control over network resources, allowing mobilecarriers to block network attacks and unauthorized access. It deliversa stateful firewall with a rich set of features to protect subscribers,along with shielding the LTE data and control plane services frommultiple types of threats. The Thunder CFW can also secure its ownresources, such as Network Address Translation (NAT) pools, toensure that its operational functions are not compromised.Site-to-Site IPsec VPNEncrypt data at unparalleled speeds: Thunder CFW enablesenterprises and service providers to build out large-scale VPNdeployments. By supporting thousands of VPN tunnels perThunder CFW platform and a broad array of encryption algorithmsand data integrity methods, organizations can deploy ThunderCFW alongside their existing VPN equipment or build out new VPNnetworks with Thunder CFW appliances.Consolidate IPsec VPN, firewall and application delivery: ThunderCFW combines Data Center Firewall, Gi/SGi Firewall and IPsec VPNon a single platform. Whether used with the Data Center Firewallto support secure interconnectivity between data centers or tosupport high-speed VPN connections in the cloud, Thunder CFWprovides a comprehensive networking and security platform thatreduces customers’ data center footprint and operating costs.A10 Thunder CFW Data Center Firewall hasachieved the ICSA Labs Firewall CorporateCertification.2The A10 Thunder CFW IPsec solution has achievedthe IPsec IKEv2 certification from ICSA Labs. ICSALabs testing and certification ensures that A10Thunder CFW performs as intended and providesinteroperable, cryptographically-based securityservices for IP layer environments.

Architecture and Key Components2 Gi/SGi FWMobile Service ProviderData Center3 DC FWWeb Appv4v6DC FW & ADCDNSRouterEPC with GGSN and PGWCGN & Gi/SGi FW1Enterprise PerimeterIPsec VPNSecure WebGatewayInternetOther Apps4 IPsec VPNWeb AppICAP (AV/DLP)IPsec VPNInternalNetworkIPSATPDNSNGFWSSLi & SWGDC FW & ADCSSLi & SWGOther AppsFigure 1: Thunder CFW use casesFlexibility to Deploy ADC and CGNThunder CFW supports multi-tenancy and isolation of configurationcomponents including administration with Application DeliveryPartitions (ADPs) using L3V (Layer 3 Visualization). L3V partitionsenables flexible deployment of independent services like applicationcomplement our industry-standard CLI and Web GUI, our RESTfulAPI with 100% coverage offers rapid integration with third-partymanagement consoles to efficiently operate one or more ThunderCFW appliances. For larger deployments, our aGalaxy CentralizedManagement System ensures that routine tasks can be performeddelivery controller (ADC) and carrier grade networking (CGN) onat scale, across multiple appliances, regardless of physical location.a single appliance to accelerate faster time to market of loadThunder CFW supports granular role-based access control, enablingbalancing and networking services.you to create users and groups and grant read-only or read/writeprivileges for specific partitions or management interfaces. ToManagementComprehensive and scalable management: Thunder CFWdevices feature an array of options to simplify and automatemanagement tasks that reduce administrative costs and ensurescale load-balancing capacity, A10 Networks aVCS Virtual ChassisSystem allows multiple appliances to operate as one, with a singlemanagement point for all appliances in the virtual chassis.that complex tasks can be done accurately the first time. ToThunder CFW’s integrated Web applicationfirewall has achieved WAF certificationfrom ICSA Labs. ICSA Labs testing andcertification ensures that Thunder CFWperforms as intended to secure applicationservices from exploitation and attack.3