# QUANTUM 28000 SECURITY GATEWAY

AI ML powered Threat Prevention Protect networks and users from zero-days, phishing, DNS, and ransomware attacks.

Named a Leader in the For Enterprise Firewalls Q4 20 awarded the Frost & Sullivan Company of the Year.

## Unified Management and Ops Efficiency
Increase protection and reduce TCO with a consolidated security architecture.

### Industry Recognition
Named a Leader for the 2 Gartner Magic Quadrant Firewalls.

### AI Deep Learning powered threat prevention to secure enterprise data centers
Check Point Quantum 28000 Next Generation Firewalls enable enterprises to deploy the industry's leading threat prevention capabilities at all points of their infrastructure, scaling security according to their changing business needs. This enables enterprises to prevent and block even the most advanced attacks before they can disrupt business, greatly increasing the efficiency of their security operations.

## PERFORMANCE HIGHLIGHTS

| Firewall | Next Gen Firewall | Threat Prevention |
| --- | --- | --- |
| 145 Gbps | 51.5 Gbps | 30 Gbps |

---

## SPOTLIGHT

### 28000 SECURITY GATEWAY
1. RJ45 and USB Type-C console ports
2. Lights-out Management port
3. 2x USB 3.0 ports
4. Sync 10/100/1000 Base-T port
5. ESD ground point
6. 2x 480GB SSD RAID1
7. Management 10/100/1000 Base-T port
8. Eight network card expansion slots
   3x redundant power supplies (back view not shown)
   4x field replaceable fans (back view not shown)

### AI Deep Learning Threat Prevention
If you're ready to move from 10 to 25, 40 or 100 GbE, so is the 28000 Next Generation Security Gateway. The 28000 Security Gateway lets you connect your 10 GbE server uplinks to your core network.

|  | NGFW | NGTP | SNBT |
| --- | --- | --- | --- |
| Firewall, VPN, Mobile Access | √ | √ | √ |
| Content Awareness | √ | √ | √ |
| Application Control | √ | √ | √ |
| Intrusion Prevention System | √ | √ | √ |
| URL Filtering |  | √ | √ |
| Antivirus and Anti-Bot |  | √ | √ |
| DNS Security |  | √ | √ |
| Threat Emulation(sandboxing) |  |  | √ |
| Threat Extraction(CDR) |  |  | √ |
| Zero Phishing |  |  | √ |

### Next Generation Firewall, Next Generation Threat Prevention and SandBlast packages
Security protects you when you're connected. SD-WAN ensures you're always connected, and the connection offers the best user experience for the lowest cost. Quantum SD-WAN in Quantum firewalls keeps you secure and connected.

|  | 1 GbE copper | 1 GbE fiber | 10 GbE | 100/40/25* GbE | Memory | Redundant Power | Redundant Storage | LOM |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Base model | 2 | 0 | 4 | 0 | 64 GB | ● | ○ | ○ |
| Plus model | 10 | 0 | 12 | 2 | 96 GB | ● | ● | ● |
| Max capacity | 66 | 32 | 32 | 8 | 128 GB | ● | ● | ● |

### IoT Security
Quantum IoT Protect now provides autonomous threat prevention. Quantum Firewalls discover IoT assets, feed those to the IoT Cloud Service to automatically map IoT devices to profiles and then apply a zero-trust policy on the firewalls to prevent IoT threats in 5 minutes.

### Integrated SD-WAN
**optional accessory**
Remote Management and Monitoring A Lights-Out-Management [LOM] card provides out-of-band management to remotely diagnose, start, restart, and manage the appliance from a remote location.

---

## SPECIFICATIONS

### Enterprise Test Conditions

| Threat Prevention1(Gbps) | 30 |
| --- | --- |
| NGFW2(Gbps) | 51.5 |
| IPS(Gbps) | 52.2 |
| Firewall(Gbps) | 145 |

### RFC 3511, 2544, 2647, 1242 Performance (Lab)

| Firewall 1518B UDP (Gbps) | 316.5 |
| --- | --- |
| VPN AES-128 (Gbps) | 49 |
| Connections/sec | 615,000 |
| Concurrent connections$ ^{3}$ | 10/20/32M$ ^{3}$ |

1. Includes Firewall, Application Control, URL Filtering, IPS, Antivirus, Anti-Bot and SandBlast Zero-Day Protection with logging enabled. 2. Includes Firewall, Application Control and IPS with logging enabled. 3. Performance measured with Base/Plus/maximum memory.

### Additional Features

• 2x CPUs, 36 physical cores, 72 virtual cores (total)

### Highlights

• 1x 480GB SSD, (2x in Plus package)
• 3x AC power supplies (DC option)
• 64, 96 and 128 GB memory options
• Lights-Out-Management card (optional in Base package)
• Virtual Systems (base/ PLUS /max mem): 125/250/250

### Network Expansion Slot Options
(7 of 8 slots open)
### First Time Prevention Capabilities

• 4x 10GBase-F SFP+ port card, up to 32 ports
• 2x 100/ 40/ 25G QSFP28 port double-slot - width card, up to 8 ports
• Emulation OS Support: Windows XP, 7, 8.1, 10

### Applications

• Use 10,000+ pre-defined or customize your own applications

### Data Loss Prevention

• Classify 700+ pre-defined data types
• File disarm and reconstruction via Threat Extraction

### Dynamic User-based Policy

• Integrates with Microsoft AD, LDAP, RADIUS, Cisco pxGrid, Terminal Servers and with 3 parties via a Web API
• Enforce consistent policy for local and remote users on Windows, macOS, Linux, Android and Apple iOS platforms

### Network Connectivity

• Integrated SD-WAN network optimization and resilience
• Total physical and virtual (VLAN) interfaces per appliance: 1024/4096 (single gateway/with virtual systems)
• Layer 2 (transparent) and Layer 3 (routing) mode

### High Availability

• Active/Active L2, Active/Passive L2 and L3
• ClusterXL or VRRP

### IPv6

• NAT66, NAT64, NAT46
• CoreXL, SecureXL, HA with VRRPv3

### Unicast and Multicast Routing (see SK98226)

• OSPFv2 and v3, BGP, RIP
• Static routes, Multicast routes
• Policy-based routing
• PIM- SM, PIM- SSM, PIM- DM, IGMP v2, and v3

### Physical

## Power Requirements

• Operating: 0° to 40°C, humidity 5% to 95%
• Power input: 100 to 240V (47-63Hz), 40~-72VDC

$$
0 ^ {\circ}
$$

• Storage:  – 20° to 70°C, humidity 5% to 95% at 60°C

$$
4 0 ^ {\circ} \mathrm {C}
$$

• Enclosure: 3RU
• Weight: 46.3 lbs. (21 kg)

### Certifications

• Emissions: FCC, CE, VCCI, RCM/C-Tick

$$
- 2 0 ^ {\circ}
$$

$$
7 0 ^ {\circ} \mathrm {C}
$$

1 1
• Environmental: RoHS, WEEE, REACH, ISO14001

---

## ORDERING QUANTUM 28000 SECURITY GATEWAYS

1. SECURITY APPLIANCE

| SECURITY APPLIANCE1 | SKU |
| --- | --- |
| 28000 Base configuration:2x1GbE copper ports,4x10GbE SFP+ ports,4xSR transceivers,64GB RAM,1xSSD,3xAC PSUs,telescopic rails,SandBlast(SNBT)Security Subscription Package for 1 Year | CPAP-SG28000-SNBT |
| 28000 Plus configuration:10x1GbE copper ports,12x10GbE SFP+ ports,12xSR transceivers,2x100GbEQSFP28ports,2x40GSR transceivers,96GB RAM,2x480GB SSD,3xAC PSUs,Lights-Out Management(LOM),telescopic rails,5Virtual Systems,SandBlast(SNBT)Security Subscription Package for 1 Year | CPAP-SG28000-PLUS-SNBT |
| Quantum IoT Network Protection for 1 year for 28000 appliances | CPSB-IOTP-28000-1Y |
| Quantum IoT Network Protection for 1 year for 28000 PLUS appliances | CPSB-IOTP-28000-PLUS-1Y |
| Quantum SD-WAN subscription for 1 year for 28000 appliances | CPSB-SDWAN-28000-1Y |
| Quantum SD-WAN subscription for 1 year for 28000 PLUS appliances | CPSB-SDWAN-28000-PLUS-1Y |

The Base package includes 2 virtual systems (VS) - one management VS and one production/data VS. These are not additive or counted when adding additional VS licenses. Plus includes 5 VS licenses which are additive when adding additional VS licenses. 1 Renewal NGFW, NGTP and SandBlast (SNBT) packages are available.

| INTERFACE CARDS AND TRANSCEIVERS |  |
| --- | --- |
| 8 Port 10/100/1000 Base-T RJ45 interface card | CPAC-8-1C-C |
| 4 Port 1000Base-F SFP interface card; requires additional 1000Base SFP transceivers | CPAC-4-1F-C |
| SFP transceiver module for 1000 BASE fiber ports - long range (1000BASE-LX), SM Fiber, LC | CPAC-TR-1LX-C |
| SFP transceiver module for 1000 BASE fiber ports - short range (1000BASE-SX), MM Fiber, LC | CPAC-TR-1SX-C |
| SFP transceiver to 1000 BASE-T RJ45 (Copper), CU, RJ45 | CPAC-TR-1T-C |
| 4 Port 100Base-F SFP+ interface card | CPAC-4-10F-C |
| SFP+ transceiver module for 10GbE fiber ports - long range (10GBASE-LR), SM Fiber, LC | CPAC-TR-10LR-C |
| SFP+ transceiver module for 10GbE fiber ports - short range (10GBASE-SR), MM Fiber, LC | CPAC-TR-10SR-C |
| SFP+ transceiver module for 10GbE fiber ports - for links up to 40km (10GBASE-ER), SM Fiber, LC | CPAC-TR-10ER-C |
| SFP+ transceiver 10GBASE-T RJ45 (Copper) - for links up to 30m over CAT6a/CAT7, CU, RJ45 | CPAC-TR-10T-C |
| SFP+ Direct Attach Cable 10GBASE-CR (DAC), 1 meter | CPAC-DAC-10G-1M |
| SFP+ Direct Attach Cable 10GBASE-CR (DAC), 3 meter | CPAC-DAC-10G-3M |
| 2 Port 10/25/40/100G QSFP28 Dual Width interface card | CPAC-2-40/100F-C |
| SFP+ transceiver module for 10GbE fiber ports - long range (10GBASE-LR), SM Fiber, LC with QSFP28 Adapter | CPAC-TR-10LR-ADP |
| SFP+ transceiver module for 10GbE fiber ports - short range (10GBASE-SR) MM Fiber, LC with QSFP28 Adapter | CPAC-TR-10SR-ADP |
| SFP+ transceiver module for 10GbE fiber ports - for links up to 40km (10GBASE-ER) SM Fiber, LC with QSFP28 Adapter | CPAC-TR-10ER-ADP |
| SFP+ transceiver 10GBASE-T RJ45 (Copper) - for links up to 30m over CAT6a/CAT7 with QSFP28 Adapter | CPAC-TR-10T-ADP |
| SFP28 transceiver module for 25GbE fiber ports - short range (25GBASE-SR) MM Fiber, LC with QSFP28 Adapter | CPAC-TR-255R-ADP |
| SFP28 transceiver module for 25G fiber ports - long range (25GBASE-LR) SM Fiber, LC with QSFP28 Adapter | CPAC-TR-25LR-ADP |
| QSFP+ transceiver for 40GbE fiber Ports - short range (40GBASE-SR4), MM Fiber, MPO-12 | CPAC-TR-40SR-QSFP-100m |
| QSFP+ transceiver module for 40GbE fiber ports - short range (40GBASE-eSR4), MM Fiber, MPO-12 | CPAC-TR-40SR-QSFP-300m |
| QSFP Bi-directional transceiver for 40GbE fiber ports - short range (40GBASE-SR-BD), MM Fiber, LC | CPAC-TR-40SR-QSFP-BiDi |
| QSFP+ transceiver module for 40GbE fiber ports for links up to 75m (40GBASE-SWDM4) MM Fiber, LS | CPAC-TR-40SWDM4 |
| QSFP+ transceiver module for 40GbE fiber ports - long range (40GBASE-LR4), SM Fiber, LC | CPAC-TR-40LR-QSFP-10Km |
| QSFP+ transceiver module for 40GbE fiber ports - for links up to 40km (40GBASE-ER4), SM Fiber, LC | CPAC-TR-40ER4 |
| QSFP28 transceiver module for 100G fiber ports - short range (100GBASE-SR4) | CPAC-TR-100SR |
| QSFP28 transceiver module for 100G fiber ports - long range (100GBASE-LR4) | CPAC-TR-100LR |

© 2024 Check Point Software Technologies Ltd. All rights reserved.

---

### WELCOME TO THE FUTURE OF CYBER SECURITY

| QSFP28 Bi-directional transceiver for 100GbE fiber Ports - short range (100GBase-SR1.2 BiDi), MM Fiber, LC | CPAC-TR-100SR-BiDi |
| --- | --- |
| QSFP28 transceiver module for 100GbE fiber ports - for links up to 75m (100GBASE-SWDM4), MM Fiber, LC | CPAC-TR-100SWDM4 |
| QSFP28 transceiver module for 100GbE fiber ports - for links up to 2km (100GBASE-CWDM4), SM Fiber, LC | CPAC-TR-100CWDM4 |
| QSFP28 transceiver module for 100GbE fiber ports, - for links up to 40km (100GBASE-ER4), SM Fiber, LC | CPAC-TR-100ERL4 |
| SPF+ Direct Attach Cable(DAC),10GBase-CU,1m | CPAC-DAC-10G-1M |
| SPF+ Direct Attach Cable(DAC),10GBase-CU,3m | CPAC-DAC-10G-3M |
| QSPF+ Direct Attach Cable(DAC),25GBase-CU,1m | CPAC-DAC-25G-1M |
| QSPF+ Direct Attach Cable(DAC),25GBase-CU,3m | CPAC-DAC-25G-3M |
| QSPF+ Direct Attach Cable(DAC),40GBase-CR4,1m | CPAC-DAC-40G-1M |
| QSPF+ Direct Attach Cable(DAC),40GBase-CR4,3m | CPAC-DAC-40G-3M |
| QSPF+ Direct Attach Cable(DAC),100GBase-CR4,1m | CPAC-DAC-100G-1M |
| QSPF+ Direct Attach Cable(DAC),100GBase-CR4,3m | CPAC-DAC-100G-3M |
| QSPF+ Direct Attach Cable(DAC),100GBase-CR4,5m | CPAC-DAC-100G-5M |

### FAIL-OPEN NETWORK INTERFACE CARDS

| FAIL-OPEN NETWORK INTERFACE CARDS |  |
| --- | --- |
| 4 Port 1GE copper Bypass(Fail-Open)Network interface card(10/100/1000 Base-T) | CPAC-4-1C-BP-C |
| 2 Port 10GE Short-range Fiber Bypass(Fail-Open)Network interface card(10GBase-SR) | CPAC-2-10FSR-BP-C |

### MEMORY

| MEMORY | SKU |
| --- | --- |
| Memory upgrade kit from 64GB to 96G or 96GB to 128GB for 28000 Security Gateways | CPAC-RAM32GB-28000 |
| Memory upgrade kit from 64GB to 128GB for 28000 Security Gateways | CPAC-RAM64GB-28000 |

### SPARES AND MISCELLANEOUS

| SPARES AND MISCELLANEOUS | SKU |
| --- | --- |
| 480GB SSD for 16000/28000 Security Gateways | CPAC-SSD-480G-C |
| AC power supply for 16600HS,26000,28000,28600HS Security Gateways | CPAC-PSU-AC-26000/28000 |
| Dual DC power supplies for 16000,26000 and 28000 Security Gateways | CPAC-PSU-DC-Dual-16000/26000/28000 |
| DC power supply for 16000 and 28000 Security Gateways | CPAC-PSU-DC-16000/28000 |
| Replacement Lights-Out Management Module | CPAC-NLOM-C |
| Replacement Fan | CPAC-FAN-26000/28000 |
| Slide rails for 28000 Security Gateways(22”-32”) | CPAC-RAIL-L |
| Telescopic slide rails for 28000 Security Gateways(24”-36”) | CPAC-RAIL-EXT-L |

---

### WELCOME TO THE FUTURE OF CYBER SECURITY

## All-inclusive Security

|  | NGFW | NGTP | SNBT(SandBlast) |
| --- | --- | --- | --- |
|  | Basic access control plus IPS | Prevent known threats | Prevent known and zero-day attacks |
| Firewall | √ | √ | √ |
| VPN(IPsec) | √ | √ | √ |
| Mobile Access | √ | √ | √ |
| Identity Awareness | √ | √ | √ |
| Application Control | √ | √ | √ |
| Content Awareness | √ | √ | √ |
| IPS | √ | √ | √ |
| URL Filtering |  | √ | √ |
| Anti-Bot |  | √ | √ |
| Anti-Virus |  | √ | √ |
| Anti-Spam |  | √ | √ |
| DNS Security |  | √ | √ |
| SandBlast Threat Emulation |  |  | √ |
| SandBlast Threat Extraction |  |  | √ |
| Zero Phishing |  |  | √ |
| IoT Network Protection | optional | optional | optional |
| SD-WAN Network Optimization | optional | optional | optional |

The first-year purchase includes the SNBT package. Security subscription renewals, NGFW, NGTP and SNBT are available for subsequent years. Optional security capabilities can be ordered a-la-carte or separately.