Quantum 28600 Hyperscale

Security Gateway for Maestro

Top Security Effectiveness
Leader with 99.7% malware block rate in
Miercom NGFW Security Benchmark (2023)

AI ML powered Threat Prevention
Protect networks and users from zero-days,
phishing, DNS, and ransomware attacks

Hyperscale Network Security
On-demand expansion and resilient access
to mission-critical applications

Unified Management and Ops Efficiency
Increase protection and reduce TCO with a
consolidated security architecture

Industry Recognition

Named a Leader for the 23rd time in the
Gartner® Magic Quadrant™ for Network
Firewalls
Named a Leader in the Forrester Wave™
Enterprise Firewalls Q4 2022
Awarded the Frost & Sullivan Firewall
Company of the Year
!
!

Scalable, resilient AI Deep Learning powered threat prevention

The Maestro hyperscale network security solution
orchestrates multiple Quantum firewalls as one
unified system, with seamless and near limitless
scaling. Bring scale, agility and elasticity of the
cloud on premises with efficient N+1 clustering
based on Check Point HyperSync technology.

Maestro Hyperscale Orchestrators distribute
internal and external network traffic equally across
multiple 28600 firewalls managed as a single group
with a common security feature set and policy. With
Maestro, businesses of all sizes can have cloud
scale and agility with datacenter resiliency — all
while maximizing cost efficiency.

!

PERFORMANCE HIGHLIGHTS
Firewall Next Gen Firewall

HIGH PERFORMANCE, SCALABLE SECURITY

28600 Hyperscale Security Gateway

1. Sync 10/100/1000 Base-T port
2. RJ45 console port
3. 2x 100 GbE QSFP28 ports
4. Lights-out Management port 4. USB Type-C console port
5. Management 10/100/1000 Base-T port

Hyperscale Security System

7. 2x USB 3.0 ports 8. Redundant hot-swap power supplies

With Maestro, you can start with two gateways and then can
grow to up to 52 gateways. For example, when you start with
30 Gbps using two 28600HS gateways you can finish with a 1.5
Tbps security solution that supports over 500 million
concurrent connections. Simply by using Check Point Maestro.

Hyperscale Orchestrator Connections

When a Security Group is created, an IP address is created for
a Single Management Object connection to the security
management server. Easily create and assign IP addresses to
the internal and external network interfaces. These uplinks
are the visible components of the Maestro security solution.

When we add a gateway to the system, it gets all the
configurations, the policy, even the software version, updated
and aligned with the existing deployment, ready to go within 6
minutes.

Maestro Traffic Distribution

HyperSync tracks the Active/Standby/Backup state of group
members. Sync traffic is limited to only the Active and Standby
members handling the connection.

Fully Operational within Minutes

Cost-Efficient N+1 Deployments

Now businesses of all sizes can enjoy cloud-level resiliency
and telco-grade technology using the efficient Maestro N+1
clustering design.

SPECIFICATIONS

Performance

Enterprise Test Conditions

RFC 3511, 2544, 2647, 1242 Performance (Lab)

Firewall 1518B UDP (Gbps) 193

VPN AES-128 (Gbps) 44

Connections/sec 590,000

Concurrent connections 49M

1. Includes Firewall, Application Control, URL Filtering, IPS, Antivirus, Anti-Bot and SandBlast Zero-Day Protection

with logging enabled. 2. Includes Firewall, Application Control and IPS with logging enabled.

Additional Features

• 2x 100 GbE QSFP28 ports

Highlights

• 2x CPUs, 36 physical cores, 72 virtual cores

• 2x AC power supplies

• 1x 480 GB storage

• 192 GB memory

• Virtual Systems: up to 250

Content Security

First Time Prevention Capabilities

• CPU-level, OS-level and static file analysis

• File disarm and reconstruction via Threat Extraction

• Average emulation time for unknown files that require full
sandbox evaluation is under 100 seconds

• Maximal file size for Emulation is 100 MB

• Emulation OS Support: Windows XP, 7, 8.1, 10

Applications

• Use 10,000+ pre-defined or customize your own applications

• Accept, prevent, schedule, and apply traffic-shaping

Data Loss Prevention

• Classify 700+ pre-defined data types

• End user and data owner incident handling

Dynamic User-based Policy

• Integrates with Microsoft AD, LDAP, RADIUS, Cisco pxGrid,
Terminal Servers and with 3 parties via a Web API

• Enforce consistent policy for local and remote users on Windows,
macOS, Linux, Android and Apple iOS platforms

Network

• Total physical and virtual (VLAN) interfaces per appliance: 1024/4096 (single gateway/with virtual systems)

Network Connectivity

• 802.3ad passive and active link aggregation

• Layer 2 (transparent) and Layer 3 (routing) mode

High Availability

• Active/Active L2, Active/Passive L2 and L3

• Session failover for routing change, device and link failure

IPv6

• NAT66

• CoreXL, SecureXL

Unicast and Multicast Routing (see SK98226)

• OSPFv2, BGP, RIP

• Static routes, Multicast routes

• Policy-based routing

• PIM-SM, PIM-DM, IGMP v2, and v3

Maestro

Maximums

• Up to 8 Security Groups

• Up to 31 gateways in a Security Group

• Up to 28 gateways in a Security Group (dual site deployment, 14
from each site)

Physical

Power Requirements

• Single Power Supply rating: 850W

• Power input: 100 to 240V (47-63Hz), 40~-72VDC

• Power consumption avg/max: AC341W/676W

• Maximum thermal output AC: 2306 BTU/hr.

Dimensions

• Enclosure: 1RU

• Dimensions (WxDxH): 17.4 x 24 x 1.73 in. (442 x 610 x 44mm)

• Weight: 28.7 lbs. (13 kg)

Environmental Conditions

• Operating: 0° to 40°C, humidity 5% to 95%

• Storage: –20° to 70°C, humidity 5% to 95% at 60°C

Certifications

• Safety: UL, CB, CE, TUV GS

• Emissions: FCC, CE, VCCI, RCM/C-Tick

• Environmental: RoHS, WEEE, REACH¹, ISO14001

ORDERING QUANTUM 28600HS MAESTRO SOLUTIONS

SECURITY GATEWAY APPLIANCES FOR SCALE-UP

28600HS security gateway for Maestro, SNBT subscription for the first year.
Each appliance includes 2x 1GbE copper on-board, 2x 100GbE QSFP28 ports, 2x AC PSUs, 1x 480GB SSD, 192 GB RAM, telescopic rails, plus 2x 100 G DAC cables (3m, 3m).

SECURITY GATEWAY ACCESSORIES

MAESTRO HYPERSCALE ORCHESTRATOR

MHO-175 TRANSCEIVERS

• In the R81.20 software release and later, the MHO-140 1/10G interfaces support 25G transceivers, ** It is recommended to use the CPAC-TR-40SR-QSFP-100m
  when using the splitters CPAC-TR-40SPLIT-QSFP-3M or CPAC-TR-40SPLIT-QSFP-6M

ORDERING MAESTRO SOLUTIONS (continued)

All-inclusive Security

Each gateway requires a license for the enabled security feature. The first-year purchase includes the SNBT package. Security subscription renewals, NGFW, NGTP
and SNBT are available for subsequent years.