Datasheet

Features
RFDPI engine
Feature Description
Reassembly-Free Deep Packet Inspection This high-performance, proprietary and patented inspection engine performs stream based bi-directional
trac analysis, without proxying or buering, to uncover intrusion attempts, malware and identify application
trac regardless of port.
Bi-directional inspection Scans for threats in both inbound and outbound trac simultaneously to ensure that the network is not used
to distribute malware, and does not become a launch platform for attacks in case an infected machine is
brought inside.
Single-pass inspection A single-pass DPI architecture simultaneously scans for malware, intrusions and application identification,
drastically reducing DPI latency and ensuring that all threat information is correlated in a single architecture.
Stream-based inspection Proxy-less and non-buering inspection technology provides ultra-low latency performance for deep packet
inspection of simultaneous network streams without introducing file and stream size limitations, and can be
applied on common protocols as well as raw TCP streams.
Intrusion prevention
Feature Description
Countermeasure-based protection Tightly integrated intrusion prevention system (IPS) leverages signatures and other countermeasures to scan
packet payloads for vulnerabilities and exploits, covering a broad spectrum of attacks and vulnerabilities.
Automatic signature updates The Dell SonicWALL Threat Research Team continuously researches and deploys updates to an extensive list
of IPS countermeasures that covers more than 50 attack categories. The new updates take immediate eect
without any reboot or service interruption required.
Intra-zone IPS protection Bolsters internal security by segmenting the network into multiple security zones with intrusion prevention,
preventing threats from propagating across the zone boundaries.
Botnet command and control (CnC) detection and
blocking
Identifies and blocks command and control trac originating from bots on the local network to IPs and
domains that are identified as propagating malware or are known CnC points.
Protocol abuse/anomaly Identifies and blocks attacks that abuse protocols in an attempt to sneak past the IPS.
Zero-day protection Protects the network against zero-day attacks with constant updates against the latest exploit methods and
techniques that cover thousands of individual exploits.
Anti-evasion technology Extensive stream normalization, decoding and other techniques ensure that threats do not enter the network
undetected by utilizing evasion techniques in Layers 2-7.
Threat prevention
Feature Description
Gateway anti-malware The RFDPI engine scans all inbound, outbound and intra-zone trac for viruses, Trojans, key loggers and other
malware in files of unlimited length and size across all ports and TCP streams.
CloudAV malware protection A continuously updated database of over 17 million threat signatures resides in the Dell SonicWALL cloud
servers and is referenced to augment the capabilities of the onboard signature database, providing RFDPI with
extensive coverage of threats.
Around-the-clock security updates New threat updates are automatically pushed to firewalls in the field with active security services, and take
eect immediately without reboots or interruptions.
SSL decryption and inspection Decrypts and inspects SSL trac on the fly, without proxying, for malware, intrusions and data leakage, and
applies application, URL and content control policies in order to protect against threats hidden in SSL encrypted
trac Included with security subscriptions for all models except SOHO. Sold as a separate license on SOHO
Bi-directional raw TCP inspection The RFDPI engine is capable of scanning raw TCP streams on any port bi-directionally preventing attacks that
they to sneak by outdated security systems that focus on securing a few well-known ports.
Extensive protocol support Identifies common protocols such as HTTP/S, FTP, SMTP, SMBv1/v2 and others, which do not send data in raw
TCP, and decodes payloads for malware inspection, even if they do not run on standard, well-known ports.
Application intelligence and control
Feature Description
Application control Control applications, or individual application features, that are identified by the RFDPI engine against a
continuously expanding database of over 3,500 application signatures, to increase network security and
enhance network productivity.
Custom application identification Control custom applications by creating signatures based on specific parameters or patterns unique to an
application in its network communications, in order to gain further control over the network.
Application bandwidth management Granularly allocate and regulate available bandwidth for critical applications or application categories while
inhibiting nonessential application trac.
Granular control Control applications, or specific components of an application, based on schedules, user groups, exclusion
lists and a range of actions with full SSO user identification through LDAP/AD/Terminal Services/Citrix
integration
Content filtering
Feature Description
Inside/outside content filtering Enforce acceptable use policies and block access to websites containing information or images that are
objectionable or unproductive with Content Filtering Service. Extend policy enforcement to block internet
content for devices located outside the firewall perimeter with the Content Filtering Client.
5