Downloads |
The Cisco® XR 12000 Series virtual firewall application builds on the secure virtualization, continuous system operation, and multiservice scale provided by the Cisco XR 12000 Series. The Cisco XR 12000 virtual firewall application uses the advanced hardware processing capabilities of the Cisco XR 12000 Multiservice Blade (MSB) to provide a flexible, scalable, and feature-rich implementation (Figure 1). The transparent integration of virtual firewall into the Cisco XR 12000 Series Routers facilitates the deployment of advanced services that require a combination of Layer 2 and Layer 3 functions (quality of service [QoS], security, VPN interconnect, and so on).
The Cisco network-based virtual firewall service solution helps service providers to deliver cost-effective, scalable, integrated security services for enterprise customers using Cisco platforms. With the centrally managed Cisco network-based security services solution, service providers can expand their service portfolio with secure on-net and off-net remote access, remote site-to-site services, and firewall capabilities. Service providers can use this Cisco solution to evolve network foundations for enabling additional value-added services, maintaining long-term competitive advantages, increasing return on investment (ROI), and reducing operating expenses.
Figure 1. Cisco XR 12000 MSB
Primary Features and Benefits
Table 1. Features of Cisco XR 12000 Virtual Firewall
• Security integrated into network infrastructure: The Cisco XR 12000 MSB firewall inspects traffic flows and prevents unauthorized access to protected resources of the enterprise (networks, servers, and so on). The intelligent network integration allows the MSB firewall to provide greater investment protection, a lower total cost of ownership, and a reduced footprint where power and rack space are at a premium. The broad range of Cisco XR 12000 Series interfaces and services (including Session Border Control and IPsec VPN) can be used within the same platform. The innovative Router Service Packet Path (RSPP) scheme and the VRF-aware service infrastructure (VASI) enable transparent insertion of services to interfaces and on inter-VRF traffic, similar to any other inline features such as quality of service. This scheme enables smooth integration of the vFW to the broad services set of the Cisco XR 12000.
• High performance and scalability: The MSB virtual firewall provides performance of 150,000 connections per second, 8 Gbps of throughput, and 2 million concurrent bidirectional connections per MSB. This superior performance helps organizations meet future growing requirements without requiring a system overhaul. A single MSB firewall can support up to 250 security contexts. Multiple MSBs can be installed to scale the number of vFWs supported.
• Robust stateful inspection and application-layer security: The virtual firewall is based on the MSB hardware and provides enhanced security features and offers rich stateful inspection firewall services, with efficient inspection, filtering, and fixup of protocols such as HTTP, Real-Time Streaming Protocol (RTSP), Domain Name System (DNS), FTP, and Internet Control Message Protocol (ICMP). The firewall application creates a connection table entry for a session flow based on the source and destination addresses, randomized TCP sequence numbers, port numbers, and additional TCP flags, and applies security policy to these connections.
• Service virtualization to reduce cost and complexity of management: The MSB service virtualization allows service providers and large enterprises to implement separate policies for different customers or functional areas, such as multiple demilitarized zones (DMZs), over the same physical infrastructure. Virtualization helps reduce the cost and complexity of managing multiple devices and makes it easier to add or delete security contexts as the number of subscribers grows. A single MSB can be partitioned into a maximum of 250 virtual firewalls (security contexts) and provides the option to limit the resources on a per-context basis. The combination of virtual partition and RBAC enables simplified workflow by delegation of functional responsibility.
Virtual Firewall Deployment Scenario Examples
Figure 2. Virtual Firewall at the Point of Presence
Figure 3. Virtual Firewall at the Peering Point
Figure 4. Virtual Firewall as a Shared Services Router
Ordering Information
Table 2. Ordering Information
Service and Support
For More Information