# Quantum 28600 Hyperscale
# Security Gateway for Maestro
**Top Security Effectiveness**
**Leader with 99.7% malware block rate in**
**Miercom NGFW Security Benchmark (2023)**
**AI ML powered Threat Prevention**
**Protect networks and users from zero-days,**
**phishing, DNS, and ransomware attacks**
**Hyperscale Network Security**
**On-demand expansion and resilient access**
**to mission-critical applications**
**Unified Management and Ops Efficiency**
**Increase protection and reduce TCO with a**
**consolidated security architecture**
## Industry Recognition
**Named a Leader for the 23rd time in the**
**Gartner® Magic Quadrant™ for Network**
**Firewalls**
**Named a Leader in the Forrester Wave™**
**Enterprise Firewalls Q4 2022**
**Awarded the Frost & Sullivan Firewall**
**Company of the Year**
!
!
## Scalable, resilient AI Deep Learning powered threat prevention
The Maestro hyperscale network security solution
orchestrates multiple Quantum firewalls as one
unified system, with seamless and near limitless
scaling. Bring scale, agility and elasticity of the
cloud on premises with efficient N+1 clustering
based on Check Point HyperSync technology.
Maestro Hyperscale Orchestrators distribute
internal and external network traffic equally across
multiple 28600 firewalls managed as a single group
with a common security feature set and policy. With
Maestro, businesses of all sizes can have cloud
scale and agility with datacenter resiliency — all
while maximizing cost efficiency.
!
PERFORMANCE HIGHLIGHTS
Firewall Next Gen Firewall
| Firewall | Next Gen Firewall | Threat Prevention |
| --- | --- | --- |
| 145 Gbps | 51.5 Gbps | 30 Gbps |
---
## HIGH PERFORMANCE, SCALABLE SECURITY
## 28600 Hyperscale Security Gateway
1. Sync 10/100/1000 Base-T port
2. RJ45 console port
3. 2x 100 GbE QSFP28 ports
5. Lights-out Management port
4. USB Type-C console port
6. Management 10/100/1000 Base-T port
## Hyperscale Security System
7. 2x USB 3.0 ports
8. Redundant hot-swap power supplies
With Maestro, you can start with two gateways and then can
grow to up to 52 gateways. For example, when you start with
30 Gbps using two 28600HS gateways you can finish with a 1.5
Tbps security solution that supports over 500 million
concurrent connections. Simply by using Check Point Maestro.
## Hyperscale Orchestrator Connections
When a Security Group is created, an IP address is created for
a Single Management Object connection to the security
management server. Easily create and assign IP addresses to
the internal and external network interfaces. These uplinks
are the visible components of the Maestro security solution.
When we add a gateway to the system, it gets all the
configurations, the policy, even the software version, updated
and aligned with the existing deployment, ready to go within 6
minutes.
## Maestro Traffic Distribution
HyperSync tracks the Active/Standby/Backup state of group
members. Sync traffic is limited to only the Active and Standby
members handling the connection.
## Fully Operational within Minutes
## Cost-Efficient N+1 Deployments
Now businesses of all sizes can enjoy cloud-level resiliency
and telco-grade technology using the efficient Maestro N+1
clustering design.
---
## SPECIFICATIONS
## Performance
## Enterprise Test Conditions
| Threat Prevention (Gbps) 1 | 30 |
| --- | --- |
| NGFW (Gbps) 2 | 51.5 |
| IPS (Gbps) | 52.5 |
| Firewall (Gbps) | 145 |
## RFC 3511, 2544, 2647, 1242 Performance (Lab)
Firewall 1518B UDP (Gbps) 193
VPN AES-128 (Gbps) 44
Connections/sec 590,000
Concurrent connections 49M
1. Includes Firewall, Application Control, URL Filtering, IPS, Antivirus, Anti-Bot and SandBlast Zero-Day Protection
with logging enabled. 2. Includes Firewall, Application Control and IPS with logging enabled.
## Additional Features
• 2x 100 GbE QSFP28 ports
## Highlights
• 2x CPUs, 36 physical cores, 72 virtual cores
• 2x AC power supplies
• 1x 480 GB storage
• 192 GB memory
• Virtual Systems: up to 250
## Content Security
## First Time Prevention Capabilities
• CPU-level, OS-level and static file analysis
• File disarm and reconstruction via Threat Extraction
• Average emulation time for unknown files that require full
sandbox evaluation is under 100 seconds
• Maximal file size for Emulation is 100 MB
• Emulation OS Support: Windows XP, 7, 8.1, 10
## Applications
• Use 10,000+ pre-defined or customize your own applications
• Accept, prevent, schedule, and apply traffic-shaping
## Data Loss Prevention
• Classify 700+ pre-defined data types
• End user and data owner incident handling
## Dynamic User-based Policy
• Integrates with Microsoft AD, LDAP, RADIUS, Cisco pxGrid,
Terminal Servers and with 3 parties via a Web API
• Enforce consistent policy for local and remote users on Windows,
macOS, Linux, Android and Apple iOS platforms
## Network
• Total physical and virtual (VLAN) interfaces per appliance:
1024/4096 (single gateway/with virtual systems)
## Network Connectivity
• 802.3ad passive and active link aggregation
• Layer 2 (transparent) and Layer 3 (routing) mode
## High Availability
• Active/Active L2, Active/Passive L2 and L3
• Session failover for routing change, device and link failure
## IPv6
• NAT66
• CoreXL, SecureXL
## Unicast and Multicast Routing (see SK98226)
• OSPFv2, BGP, RIP
• Static routes, Multicast routes
• Policy-based routing
• PIM-SM, PIM-DM, IGMP v2, and v3
## Maestro
## Maximums
• Up to 8 Security Groups
• Up to 31 gateways in a Security Group
• Up to 28 gateways in a Security Group (dual site deployment, 14
from each site)
## Physical
## Power Requirements
• Single Power Supply rating: 850W
• Power input: 100 to 240V (47-63Hz), 40~-72VDC
• Power consumption avg/max: AC341W/676W
• Maximum thermal output AC: 2306 BTU/hr.
## Dimensions
• Enclosure: 1RU
• Dimensions (WxDxH): 17.4 x 24 x 1.73 in. (442 x 610 x 44mm)
• Weight: 28.7 lbs. (13 kg)
## Environmental Conditions
• Operating: 0° to 40°C, humidity 5% to 95%
• Storage: –20° to 70°C, humidity 5% to 95% at 60°C
## Certifications
• Safety: UL, CB, CE, TUV GS
• Emissions: FCC, CE, VCCI, RCM/C-Tick
• Environmental: RoHS, WEEE, REACH¹, ISO14001
---
## ORDERING QUANTUM 28600HS MAESTRO SOLUTIONS
| MAESTRO HYPERSCALE SOLUTION PACKAGES | SKU |
| --- | --- |
| Maestro Solution with 2x 28600HS gateways and 1x Orchestrator (MHO-175), includes 5 Virtual Systems plus SandBlast(SNBT) Security Subscription Package for 1 Year. | CPAP-SG28602-HS-MHS-MHO175-SNBT |
| Maestro Solution with 3x 28600HS Security Gateways and 1x Orchestrator(MHO-175),includes 5 Virtual Systems plus SandBlast(SNBT)Security Subscription Package for 1Year. | CPAP-SG28603-HS-MHS-MHO175-SNBT |
## SECURITY GATEWAY APPLIANCES FOR SCALE-UP
28600HS security gateway for Maestro, SNBT subscription for the first year.
Each appliance includes 2x 1GbE copper on-board, 2x 100GbE QSFP28 ports, 2x AC PSUs, 1x 480GB SSD, 192 GB RAM, telescopic rails, plus 2x 100 G DAC cables (3m, 3m).
## SECURITY GATEWAY ACCESSORIES
| 100G QSFP28 Direct Attach Copper(DAC) cable,3 meters | CPAC-DAC-100G-3M |
| --- | --- |
| 40G QSFP+Direct Attach Copper(DAC) cable,3 meters | CPAC-DAC-40G-3M |
| Replacement 16GB RAM memory module for 28600 and 16600 Security Gateway | CPAC-RAM16GB-16/28K-HS |
| Replacement AC power supply for 16600HS,26000,28000,28600HS Security Gateways | CPAC-PSU-AC-26000/28000 |
| Dual DC power supplies for 16000,26000,28000 Security Gateways | CPAC-PSU-DC-Dual-16000/26000/28000 |
| DC power supply for 16000,26000,28000 Security Gateways | CPAC-PSU-DC-16000/26000/28000 |
| Lights-Out Management Module | CPAC-NLOM-C |
| Extended slide rails for 28600 Security Gateways[24"-36"] | CPAC-RAIL-EXT-L |
## MAESTRO HYPERSCALE ORCHESTRATOR
| MAESTRO HYPERSCALE ORCHESTRATOR ACCESSORIES | SKU |
| --- | --- |
| Fan replacement for Maestro Hyperscale Orchestrator 175 | CPAC-FAN-MH0175 |
| AC power supply unit replacement for Maestro Hyperscale Orchestrator 140 and 175 | CPAC-PSU-AC-MH0140/175 |
| Rail kit for Maestro Hyperscale Orchestrators 140 and 175 | CPAC-RAIL-MH0140/175 |
## MHO-175 TRANSCEIVERS
| MHU-173 TRANSCIVERS | SKU |
| --- | --- |
| 100G CWDM4, LC connector, 2Km/ single mode fiber | CPAC-TR-100CWDM4 |
| 100G SWDM4, LC connector, 75m/OM3 fiber | CPAC-TR-100SWDM4 |
| QSFP28 transceiver module for 100G fiber ports - short range [100GBase-SR4] | CPAC-TR-100SR |
| QSFP28 transceiver module for 100G fiber ports - long range [100GBase-LR4] | CPAC-TR-100LR |
| QSFP+ transceiver for 40G fiber Ports - short range [40GBase-SR] OM3 fiber 100m, OM4 fiber 150m | CPAC-TR-40SR-QSFP-100m |
| QSFP+ transceiver module for 40G fiber ports - short range [40GBase-SR] | CPAC-TR-40SR-QSFP-300m |
| QSFP+ transceiver module for 40G fiber ports - long range [40GBase-LR] | CPAC-TR-40LR-QSFP-10Km |
| Bi-directional QSFP transceiver for 40G fiber Ports - short range [40GBase-SR-BD] | CPAC-TR-40SR-QSFP-BIDI |
| QSFP+ splitter for 40G fiber ports for Maestro [MHO140 and MHO175] - 3 meters | CPAC-TR-40SPLIT-QSFP-3M |
| QSFP+ splitter for 40G fiber ports for Maestro [MHO140 and MHO175] - 6 meters | CPAC-TR-40SPLIT-QSFP-6M |
| SFP28 transceiver module for 100G fiber ports - short range [25GBase-SR SFP28] | CPAC-TR-25SR-C |
| SFP28 transceiver module for 100G fiber ports - long range [25GBase-LR SFP28] | CPAC-TR-25LR-C |
| SFP+ transceiver module for 10G fiber ports - for links up to 40km [10GBASE-ER] | CPAC-TR-10ER-C |
| SFP+ transceiver module for 10G fiber ports - long range [10GBase-LR] | CPAC-TR-10LR-C |
| SFP+ transceiver module for 10G fiber ports - short range [10GBase-SR] | CPAC-TR-10SR-C |
| SFP+ transceiver 10GBASE-T RJ45 [Copper] - for links up to 30m over CAT6a/CAT7 | CPAC-TR-10T-C |
| SFP transceiver module for 1G fiber ports - short range [1000Base-SX] | CPAC-TR-1SX-C |
| SFP transceiver module for 1G fiber ports - long range [1000Base-LX] | CPAC-TR-1LX-C |
| SFP transceiver to 1000 Base-T RJ45 [Copper] | CPAC-TR-1T-C |
* In the R81.20 software release and later, the MHO-140 1/10G interfaces support 25G transceivers, ** It is recommended to use the CPAC-TR-40SR-QSFP-100m
when using the splitters CPAC-TR-40SPLIT-QSFP-3M or CPAC-TR-40SPLIT-QSFP-6M
---
## ORDERING MAESTRO SOLUTIONS (continued)
## All-inclusive Security
| | NGFW | NGTP | SNBT(SandBlast) |
| --- | --- | --- | --- |
| | Basic access control with IPS | Prevent known threats | Prevent known and zero-day attacks |
| Firewall | √ | √ | √ |
| VPN(IPsec) | √ | √ | √ |
| Mobile Access | √ | √ | √ |
| Identity Awareness | √ | √ | √ |
| Application Control | √ | √ | √ |
| Content Awareness | √ | √ | √ |
| IPS | √ | √ | √ |
| URL Filtering | | √ | √ |
| Anti-Bot | | √ | √ |
| Anti-Virus | | √ | √ |
| Anti-Spam | | √ | √ |
| DNS Security | | √ | √ |
| SandBlast Threat Emulation | | | √ |
| SandBlast Threat Extraction | | | √ |
| Zero Phishing | | | √ |
Each gateway requires a license for the enabled security feature. The first-year purchase includes the SNBT package. Security subscription renewals, NGFW, NGTP
and SNBT are available for subsequent years.