QUANTUM QLS650 LIGHTSPEED FIREWALL

Check Point Quantum Lightspeed Next Generation Firewalls redefine security price performance — enabling enterprises to deploy network security that performs at the speed of business to accelerate large file transfers and provide low latency for high frequency applications.

Secure Hi-speed Data Transfers

! 650 Gbps line-rate in a single firewall

Protect Hi-frequency Trading Apps

! 3μSec ultra low latency

Resilient Data Center Security

! Eliminate failure with a robust clustering technology

! !QLS650

QUANTUM SECURITY PLATFORM

QLS650 LIGHTSPEED FIREWALL

1. RJ45 and USB Type-C console ports
2. 2x USB 3.0 ports
3. Lights-out Management port
4. Sync and Management 10/100/1000 Base-T ports
5. ESD grounding point
6. 2x 960GB SSD RAID1
7. 3x double-wide ConnectX NICs
8. 2x 4 port 10G network cards
   3x redundant power supplies (back view not shown)

Low Latency, High Throughput Firewall

Quantum QLS650 firewalls are equipped with three NVIDIA ConnectX network interface cards (NIC), each with 2x 100G QSFP28 ports. NVIDIA ConnectX NICs offload network processing from the host CPUs, providing substantial performance gains of up to 600 Gbps for trusted firewall traffic. In addition, firewall latency is significantly reduced to a low 3μSec at nearly line rate ensuring access to data and higher throughput with minimal delay.

All-inclusive Security

Check Point QLS650 firewalls include the Check Point stateful inspection firewall and are also available in all-inclusive security packages such as NGFW (Application Control with IPS), NGTP (NGFW with URL filtering, antivirus and anti-bot) or SandBlast (NGTP with sandboxing and Threat Extraction, a Content Disarm & Reconstruction technology).

Resilient Security

Modern organizations need robust cyber security to protect their critical systems. High Availability (HA) firewall clusters are designed to minimize downtime for critical systems using redundant systems. If an organization wants to implement a simple HA firewall cluster with up to 5 nodes, this can be accomplished using Check Point’s built-in HA and load sharing functionality: ClusterXL.

Check Point ClusterXL is a software-based clustering solution for firewall redundancy and load sharing which uses state synchronization to keep active connections alive and prevent data loss if a cluster member fails. This ensures critical systems are always connected and secure. In addition, each QLS650 has redundancy built-in with two SSD drives in a RAID1 array and hot-swappable redundant power supplies, ensuring continuity when one component fails.

Remote Management and Monitoring

A Lights-Out-Management (LOM) card provides out-of-band remote management to remotely diagnose, start, restart and manage the appliance from a remote location. Also use LOM for remote installs of the GAiA OS.

More is demanded of today’s network devices. There are simply more connected devices. Apps and connected applications are more content-heavy. For instance, workloads and data sets move from on-premises data centers to the cloud and back again, encapsulated in VXLAN, GRE and VPN packets. Furthermore, some apps require pure speed. For High Frequency Trading apps, profit or loss is determined by nanosecond differences in network latency. Check Point Quantum Lightspeed firewalls deliver on these demands for high throughput with low latency by securely offloading network processing to NVIDIA ConnectX NICs.

NVIDIA ConnectX

The eight single-width slots in the QLS650 support three NVIDIA ConnectX dual-width network cards, each with 2x 100G QSFP28 ports, supporting an aggregate throughput of 200G of firewall throughput through each ConnectX. The dual-width cards maximizes the PCIe bandwidth beyond a single slot limit. With the three ConnectX NICs in the QLS650 access to data and higher throughput with minimal delay is ensured for trusted traffic.

How it Works

The first packet of a connection is validated by the firewall to decide if the connection is allowed by policy based upon port and IP address. If allowed, the firewall uses a Data Plane Development Kit (DPDK) API to instruct the ConnectX to allow a bidirectional connection between the client and server. Subsequent packets are processed on the ConnectX. This includes doing stateful inspection checks such as full header validation of TCP state and sequence number validation. In addition, the ConnectX supports Network Address Translation (NAT) and encapsulates and decapsulates packets in VXLAN and GRE tunnels. Furthermore, long duration sessions of large data transfers of up to 100G that occur within a single connection, also called elephant flows, are securely offloaded to the ConnectX NIC.

Accelerating connections by offloading connections to a lower OSI layer device

This is not a new Check Point technology. Check Point SecureXL technology was developed over a decade ago to offload network processing to a lower-level device to accelerate packet rates. As a stateful firewall, once a connection is allowed by policy, an entry is created in the firewall’s connections table. The firewall then updates lower level devices so that bidirectional connections can be checked and allowed by the device. The device and the firewall update connection tables as the state changes. With NVIDIA, this is done using the industry standard DPDK API. When the connection ends, responsibility for handling the connection teardown is shifted back to the firewall.

Focused, Parallel Processing

For advanced inspection such as IPS that requires pattern matching, connections are distributed to the multiple cores of the QLS 650. This is how Check Point delivers a network security architecture that offers true threat prevention, not just threat detection. It does this without delay in one session, scales across multiple sessions, and is agile enough for deployment wherever you need security — on premises and in the cloud.

LIGHTSPEED SECURITY USE CASES

Any Enterprise with a Data Center, Hybrid Cloud or Distributed Data Centers

Secure High Speed Transfers of Large Data Sets: Networks converge at the data center core and in high speed interconnects between data centers and the hybrid cloud. Businesses routinely transfer large data sets across these networks for data analysis, disaster recovery planning and workload migration.

Quantum Lightspeed 100 gigabit network interfaces enables enterprises to accelerate these transfers of large data sets across data center core and data center interconnects — supporting up to 250, 450, 650 and 800 Gbps of single firewall throughput in the QLS250, QLS450, QLS650 and QLS800 respectively. Add redundancy and scale even higher using the unique Maestro Active-Active load sharing solution where multiple Quantum Lightspeed MLS200 and MLS400 firewalls scale throughput nearly linearly with each additional firewall added to the cluster.

Banking and Financial Services

Secure Financial Transactions with Micro-second Latency: In the world of finance where trading and cryptocurrency algorithms generate millions of transactions, a fraction of a second makes a huge difference. In some reports 80% of trading on the stock market is done via algorithmic-based automated programs that execute software programs to buy, sell or hold assets.

High frequency trading firms need network security technology that does not introduce latency and satisfies regulatory and compliance security mandates. The Quantum Lightspeed NGFW series enables banking, insurance and investment firms to securely increase transaction capacity for high frequency applications by deploying network security that performs at the speed of business — with low 3μSec latency.

The 100 gigabit QSFP28 network interfaces in the Quantum Lightspeed firewalls comfortably handle initial transfers of large data sets at the start of the trading day. They also support up to 100G elephant flows, characterized by a large, continuous flow that stays open and occupies a disproportionate share of the total bandwidth of a network link for a long duration.

Any Enterprise Requiring Investment Security

Support Hyper-growth with Scalable Security Throughput: Some businesses such as ecommerce see wide and seasonal requirements in online traffic. In 2020 all businesses saw a boost in traffic as workers moved to a work from home model. Other scenarios requiring scalable security are business mergers, data center consolidation and migrations to cloud, hybrid cloud and hybrid data center models.

When used in the unique Maestro Hyperscale Network Security solution with the MLS200 and MLS400, enterprises can scale to up to 3 Tbps of firewall throughput. Each additional firewall added to the Maestro Active -Active load sharing cluster, scales throughput nearly linearly. Furthermore, customers can group multiple firewalls into Security Groups and move firewalls manually or dynamically as needed to meet changes in traffic demands. Security Groups are logical groups of appliances where each Security Group has dedicated internal and external interfaces and may have a different configuration set and policy. The Maestro Orchestrator MHO175 has a total fabric capacity of 3.2 Tbps with 400 nsec port to port latency and supports up to 32x 100GbE or 128x 10GbE network interfaces.

Telco 5G Networks

Support Hyper-growth with Scalable Security Throughput: The demand for improved speeds, low latency, and connecting a larger number of devices has paved the path to 5G, fifth generation digital cellular networks. Telco mobile operator 5G networks are also expected to be widely used for private networks with applications in industrial IoT, enterprise networking, and critical communications. The network topology will be sliced with logical networks riding on top of the core infrastructure and previously unimaginable services will be created. These use cases require the ability for mobile operators to scale security functions with elasticity using Quantum Maestro in order to guarantee service continuity and availability.

SPECIFICATIONS

1. Performance measured with enterprise testing conditions with logging enabled. NGFW: FW, App Control and IPS, NGTP: FW, App Control, URL Filtering, IPS, Antivirus, Anti-Bot and SandBlast Zero-Day Protection.

ORDERING QUANTUM QLS650

DEFAULT CONFIGURATION 1

1 DEFAULT CONFIGURATION

QLS650 includes 6x100G QSFP28 ConnectX ports, 8x 10GbE SFP+ ports with 8x 10GbE SR transceivers, 192 GB RAM, 2x 960GB CPAP-SG-QLS650 SSD, 3x AC PSUs, LOM, telescopic rails and 5 Virtual Systems

The default package includes 5 virtual system (VS) licenses which are additive when adding additional VS licenses.

1 NGFW, NGTP and SandBlast (SNBT) packages and renewals are available in the online product catalog.

QLS650 Accessories

ORDERING QUANTUM QLS650 (Continued)

All-inclusive Security

The base includes the firewall. Security subscription NGFW, NGTP and SNBT extensions and renewals for subsequent years are also available.