NetScreen speeds up security

Security vendor NetScreen says it has launched the industry's first Gigabit-speed network security appliance that integrates a firewall and VPN into a dedicated hardware platform.

The company's NetScreen 1000 is targeted at high-bandwidth, high-capacity users such as e-businesses, ISPs and ASPs. The appliance supports gigabit wire-speed firewalls and 3Des IPSec VPN performance.

NetScreen has developed an application-specific integrated circuit (ASIC) chip that processes firewall policies and encryption algorithms at the hardware level, which is a significantly faster approach than deploying processing software.

The ASIC also frees up the main processor to handle the data flow.

The proprietary ASIC technology is tightly integrated with NetScreen's own operating system and uses a proprietary link between the ASIC chip and the processor to minimise the distance that the data must traverse over a PCI bus. By shifting data directly between the ASIC and the processor it has only to make two trips over a PCI bus, which is notorious for slowing data exchange rates. NetScreen said that this speeds up the processing by as much as 30 times that of software-based firewalls and ten times that of other hardware based firewalls.

The switching module includes data packet interfaces with Gigabit Ethernet ports for trusted and untrusted connections on a 6 Gbps switch fabric.

The auxiliary module has a management interface with an out of band management port, a console port and a high-availability interface for the website.

NetScreen 1000 is capable of 500,000 concurrent sessions on the firewall and 25,000 VPN tunnel connections. It allows for the creation of up to 100 virtual systems, each with its own policy management facility. NetScreen's configuration can be mirrored over to a redundant secondary box to maintain active sessions in the event of failure.

Pim Bilderbeek, director of networking research for IDC, said: "VPN's are one of the up and coming options for Wan management. They are cost effective and easier to manage than a leased line service but in the end you have to trade off for poorer security."