Secure Gateway Firewall

(1)

Secure Gateway – Firewall

(2)

2

The Verizon names and logos and all other names, logos, and slogans identifying Verizon’s products and services are trademarks and service marks or registered trademarks and service marks of Verizon Trademark Services LLC or its affiliates in the United States and/or other countries. All other trademarks and service marks are the property of their respective owners.

PROPRIETARY STATEMENT

This document and any attached materials are the sole property of Verizon and are not to be

used by you other than to evaluate Verizon’s service.

This document and any attached materials are not to be disseminated, distributed, or otherwise

conveyed throughout your organization to employees without a need for this information or to

any third parties without the express written permission of Verizon.

(3)

3

Agenda

• The customer environment:

–

Business objectives

–

Business challenges

• Verizon solution:

–

Secure Gateway – Firewall

• The Verizon difference

(4)

Section 1

(5)

5

Business Objectives

• Reduce operating expenses

• Increase operational efficiency

• Establish a flexible, scalable, and robust Internet service

• Implement an integrated private and public network

(6)

6

Business Challenges

• Minimal technical expertise at remote locations

• Lack of standardized public network access

(7)

Section 2

Section 2 Verizon Solution:

(8)

8

• Minimal technical expertise

at remote locations

• Lack of standardized

network access

• Absent or minimal

centralized protection

against security threats

• Help reduce operating expenses

• Increase operational efficiency

• Establish a flexible, scalable,

and robust Internet service

• Implement an integrated

private and public network

• Help ensure network stability

and predictability

Challenges

Objectives

Verizon Secure

Gateway –

Firewall

Overcoming Challenges to Meet Objectives

(9)

9

Internet

Verizon

IP Network

Secure Gateway – Firewall

Customer Network 1 Customer Network 3

Trunks

to UUNET

NBFW PVC

HR Routers

Protected Path Through

Secure Gateway

NBFW

Secure Gateway

Customer Network 2

Verizon Frame Relay/

ATM/Private IP

Verizon Frame Relay/

ATM/Private IP

(10)

10

Secure Gateway Port:

NRC/MRC

Private Network:

NRC/MRC

• 64K to 3 MB standard (ICB above 3 MB)

• Dual Secure Gateway port/gateway

provisioned (network service

redundancy) for additional charge

Standard rates for Private IP,

Frame Relay, and ATM apply

Secure Gateway – Firewall

U.S. Pricing – One Component + Private Network

Secure Gateway – Firewall

(11)

Section 3

(12)

12

Benefit

Feature

Challenge Addressed

Objective Met

Provides Verizon Frame Relay,

Private IP, and ATM customers

with the ability to securely

access the public network

(Internet)

Low

Low--cost firewall optioncost firewall option Verizon NOC provides 24x7

Verizon NOC provides 24x7

management, monitoring, and

support for HWC and VPN

Helps protect network from

common attacks

Can help eliminate costly

redundant circuits

No on

No on--site technical site technical resources needed

resources needed

Secure Gateway – Firewall

Overcoming Challenges to Meet Objectives

Secure Gateway – Firewall

Overcoming Challenges to Meet Objectives

Centralizes network

Centralizes network- -based firewall service

based firewall service

Utilizes firewall located

in the Verizon network

Verizon monitors,

maintains, and manages

the network

the network--based based

firewall platform (not

rule

rule--sets)sets)

Provides protection

from many types of

network threats

Internet Access

for Verizon Private

Network customers

Network

Network--based servicebased service

Lack of standardized network access

Absent or minimal centralized

protection against security threats

Minimal technical expertise

at remote locations

protection against security threats

Lack of standardized network access

Minimal technical expertise

at remote locations

Bring stability and predictability

to the corporate network (WAN)

environment

protection against security

threats

Can help reduce expenses and

ensure network stability and

predictability

Can help ensure network

stability and predictability

Provides an integrated solution

for private and public network

connectivity, can help reduce

expenses, and establish a

flexible, scalable, and robust

Internet service

Can help reduce expenses and

increase operational efficiency

(13)

13

Yes

UDP flooding

Yes

Fragmentation attacks

Yes

IP

-

spoofing attacks

Yes

TCP

-

based attacks

Yes

ICMP attacks

Varies

No

Intrusion detection

Varies

No

Reporting

Centralized or distributed

Centralized

Management

Firewall at central site

or local firewalls at remote sites

None Required

CPE

Requires individual firewalls at each remote

location or centralized firewall

Secure Gateway port

(cost determined by bandwidth)

Cost

Verizon CPE-Based

Firewall

Verizon Secure

Gateway – Firewall

How Is Secure Gateway – Firewall Different

From CPE-Based Firewall Service?

How Is Secure Gateway – Firewall Different

From CPE-Based Firewall Service?

(14)

14

Secure Gateway – Firewall

Case Study: Seafood Processor/Distributor

Secure Gateway – Firewall

Case Study: Seafood Processor/Distributor

• Customer requirements:

–

Network standardization

–

Prioritize traffic for a future implementation of VoIP

–

Obtain secure centralized Internet access to a specified

subset of their end-users

–

Eliminate circuit and service redundancy

• Verizon solution:

–

Private IP network

(15)

Summary: Secure Gateway – Firewall

Solves Business Challenges

Summary: Secure Gateway – Firewall

Solves Business Challenges

• Secure access to the Internet

• Centralized protection against security

threats

(16)

Section 4

(17)

Section 5

Section 5 Appendix

• Pricing

• Details on NAT Functionality With SIG

• Firewall Configurations

• Details on DDoS Policy

(18)

18

$1,300.00

$200.00

3,072

NA

2,048

$650.00

$200.00

1,536

$450.00

$100.00

1,024

$420.00

$100.00

768

768 $360.00

$360.00

$100.00

512

512 $310.00

$310.00

$100.00

384

384 $250.00

$250.00

$100.00

256

256 $170.00

$170.00

$100.00

128

128 $150.00

$150.00

$100.00

64

64 MRC

NRC

Secure Gateway port

Port Speed (KB)

U.S. Secure Gateway Port Pricing (MBS II, MBS I, and Pre-MBS)

Note: 4680 Kbps to 15,360 Kbps Secure Gateway ports are available after obtaining an approval from Capacity

Planning. Minimum one-year term required.

Early termination fee applies. Please see your Verizon account manager for complete details.

Pricing was effective July 2005 and subject to change without notice. Excludes taxes and surcharges.

Secure Gateway – Firewall

Secure Gateway Port Pricing

Secure Gateway – Firewall

(19)

19

Internet

Customer Network

Secure Gateway – Firewall

Standard Configuration

Secure Gateway – Firewall

Standard Configuration

Frame Relay or ATM Link

NBFW PVC

Trunks to

UUNET

HR Routers

NBFW

Verizon

Frame Relay/

ATM/Private IP

Verizon

Frame Relay/

ATM/Private IP

Internet

Trunks to

UUNET

HR Routers

NBFW

Customer’s

PVC to Private IP

Link to Private IP

Verizon

Frame Relay/

ATM/Private IP

Verizon

Frame Relay/

ATM/Private IP

Verizon

IP Network

Verizon

IP Network

(20)

20

Secure Gateway – Firewall

Redundancy Configuration

Secure Gateway – Firewall

Redundancy Configuration

NBFW 1 NBFW 2 NBFW 2 NBFW 1

Internet

Verizon

Frame Relay/

ATM/Private IP

Verizon

Frame Relay/

ATM/Private IP

Verizon

Frame Relay/

ATM/Private IP

Verizon

Frame Relay/

ATM/Private IP

Verizon

IP Network

Verizon

IP Network

(21)

21

Verizon

Frame Relay/

ATM/Private IP

Verizon

Frame Relay/

ATM/Private IP

Verizon

Frame Relay/

ATM/Private IP

Verizon

Frame Relay/

ATM/Private IP

Customer Network Customer Network

Secure Gateway – Firewall

Redundancy Configuration

(cont’d)

Secure Gateway – Firewall

Redundancy Configuration

(cont’d)

NBFW 2 NBFW 1

Trunks to

UUNET

Frame Relay or ATM Link

NBFW 1 NBFW 2

Trunks to

UUNET

HR Routers

Verizon

IP Network

Verizon

IP Network

Internet

(22)

22

Details on Basic Stateful Firewall Rules

(23)

23

Details on Anti-Spoofing Rules

(24)

24

Details on Ingress Anti-Spoofing Rules

(25)

25

Details on Network Address

Translation (NAT) Services

Details on Network Address

Translation (NAT) Services

(26)

26

Details on NAT/PAT Translations

and Mapping Features

Details on NAT/PAT Translations

and Mapping Features

PC 10.10.10.1.80 PC 10.10.10.2.8080 PC with any 10.10.10.x.23 SMTP Server 10.10.10.43.25 or Public Address Assigned to Customer Previously

Private

Addresses

NBFW/NAT

66.200.243.146

10.10.10.1.8 translated to 66.200.243.145.105 10.10.10.2.8080 translated to 66.200.243.145.9189 10.10.10.x.2343.25 mapped to 66.200.243.146.25 10.10.10.x.23 translated to 66.200.243.145.245