Check Point 21800 Appliance | Datasheet
CHECK POINT
21800 APPLIANCE
CHECK POINT
21800 APPLIANCE
Datacenter-grade security
appliances
Product Benefits
Fits easily into complex networks
Redundancy eliminates downtime
Centralized control with LOM
Ideal for low latency transactions
Extensible Software Blade Architecture
Product Features
4100/43001 SecurityPower™ Units
Optimized for low latency
High port density
High availability and serviceability
Simple deployment and management
INSIGHTS
Today the Internet gateway is more than a firewall. It is a security device presented
with an ever-increasing number of sophisticated threats. As a security gateway it must
use multiple technologies to control network access, detect sophisticated attacks and
provide additional security capabilities like data loss prevention and protection from
web-based threats. The proliferation of mobile devices like smartphones and Tablets
and new streaming, social networking and P2P applications requires a higher
connection capacity and new application control technologies. Finally, the shift
towards enterprise private and public cloud services, in all its variations, cha nges the
company borders and requires enhanced capacity and additional security solutions .
SOLUTION
Leveraging its multi-core and acceleration technologies, with 4300 SecurityPower
Units, the Check Point 21800 appliance supports lightning-fast firewall throughput of
1
up to 110 Gbps with sub 5μs latency. The 21800 is designed from the ground up for
unmatched flexibility for even the most demanding enterprise and data center network
environments.
The 21800 appliance has 3 expansion slots supporting a wide range of network
options. The standard configuration includes one on-board 10/100/1000 RJ-45
Management port and a twelve 1 Gigabit Ethernet copper port card. In addition the
21800 appliance includes an on-board 10GbE Sync port (SR transceiver included). A
maximally configured 21800 provides up to 37 Gigabit Ethernet copper ports or 36
fiber ports or thirteen 10 Gigabit Ethernet fiber ports.
The 21800 appliance chassis is highly serviceable. Access to all components is
available from the front and the back of the unit when mounted in the rack. There is
one slot for an optional Security Acceleration Module to boost performance of the
appliance. In addition to hot-swappable redundant disk drives and power supply units,
the 21800 appliance also supports Lights-Out-Management (LOM) for remote support
and maintenance capabilities.
©2015 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non -confidential content | February 3, 2015
1
Check Point 21800 Appliance | Datasheet
21800
1
2
3
4
5
6
7
8
1
2
Graphic LCD display
2 x 500 GB RAID1 HDD
USB port for ISO installation
Sync 10GBase-F SFP+ (with SR transceiver)
Management 10/100/1000Base-T RJ45
Lights-Out Management port
Console port
Three network card expansion slots
3
5
4
8
7
6
SECURITY ACCELERATION MODULE
ALL-INCLUSIVE SECURITY SOLUTIONS
The optional Check Point Security Acceleration Module
(SAM-108) for the 21000 Appliances is ideal for latencysensitive applications such as financial trading and VoIP
communication. With sub 5 micro-seconds firewall latency,
this purpose-built acceleration module boasts 108
SecurityCores™ accelerating traffic on all AccelerationReady interface ports with a single SAM-108. Performance
for the 21800 appliance is boosted to 110 Gbps of firewall
throughput, 50 Gbps of VPN throughput and 300,000
connections per second.
The Check Point 21800 Appliance is available in four
Software Blade packages and extensible to include
additional Software Blades for further security protection.
INCLUSIVE HIGH PERFORMANCE PACKAGE
Customers with high connection capacity requirements can
purchase the affordable High Performance Package (HPP)
with the Next Generation security package of their choice.
This includes the appliance plus an Acceleration Ready
4x10Gb SFP+ interface card, transceivers and 64 GB of
memory for high connection capacity. The SAM-108 High
Performance Package also includes transceivers, 64 GB of
memory in the appliance and 48 GB of memory in the
Security Acceleration Module.
A RELIABLE SERVICEABLE PLATFORM
The Check Point 21800 appliance delivers business
continuity and serviceability through features such as hotswappable redundant power supplies, hot-swappable
redundant hard disk drives (RAID), redundant fans and an
advanced LOM card for out-of-band management. Combined
together, these features ensure a greater degree of business
continuity and serviceability when these appliances are
deployed in the customer’s networks.
REMOTE MANAGEMENT AND MONITORING
A Lights-Out-Management (LOM) card provides out-of-band
remote management to remotely diagnose, start, restart and
manage the appliance from a remote location. Administrators
can also use the LOM web interface to remotely install an OS
image from an ISO file.
Next Generation Firewall (NGFW): identify and control
applications by user and scan content to stop threats—with
IPS and Application Control.
Next Generation Secure Web Gateway (SWG): enables
secure use of Web 2.0 with real time multi-layered protection
against web-borne malware—with Application Control, URL
Filtering, Antivirus and SmartEvent.
Next Generation Data Protection (NGDP): preemptively
protect sensitive information from unintentional loss, educate
users on proper data handling policies and empower them to
remediate incidents in real-time - with IPS, Application
Control and DLP.
Next Generation Threat Prevention (NGTP): apply multiple
layers of protection to prevent sophisticated cyber-threats—
with IPS, Application Control, Antivirus, Anti-Bot, URL
Filtering and Email Security.
PREVENT UNKNOWN THREATS
Check Point Appliances are a key component in the
ThreatCloud Ecosystem providing excellent protection from
undiscovered exploits, zero-day and targeted attacks.
Appliances inspect and send suspicious files to the
ThreatCloud Emulation Service which runs them in a virtual
sandbox to discover malicious behavior. Discovered malware
is prevented from entering the network. A signature is
created and sent to the ThreatCloud which shares
information on the newly identified threat to protect other
Check Point customers.
INTEGRATED SECURITY MANAGEMENT
The appliance can either be managed locally with its
available integrated security management or via central
unified management. Using local management, the appliance
can manage itself and one adjacent appliance for high
availability purposes.
©2015 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non -confidential content | February 3, 2015
2
Check Point 21800 Appliance | Datasheet
SPECIFICATIONS
PERFORMANCE
Production Performance
NETWORK
2
Network Connectivity
4100/4300 SecurityPower
IPv4 and IPv6
30.4–44.5 Gbps firewall throughput
1024 interfaces or VLANs per system
6.9 Gbps firewall and IPS throughput
4096 interfaces per system (in Virtual System mode)
1
1
RFC 3511, 2544, 2647, 1242 PERFORMANCE
(LAB)
802.3ad passive and active link aggregation
Layer 2 (transparent) and Layer 3 (routing) mode
78–110 Gbps of firewall throughput, 1518 byte UDP
High Availability
23.5–50 Gbps of AES-128 VPN throughput
Active/Active - L3 mode
9.9 Gbps of IPS throughput, IPS Recommended profile,
IMIX traffic blend
Active/Passive - L3 mode
1
1
6–28 million concurrent connections, 64 byte response
198,000–300,000 connections per second,
64 byte response
1
Session synchronization for firewall and VPN
Session failover for routing change
Device failure detection
Link failure detection
ClusterXL or VRRP
EXPANSION OPTIONS
Base Configuration
PHYSICAL
1 on-board 10/100/1000Base-T RJ45
Power Requirements
1 on-board 10GbE SFP+ (SR transceiver included)
AC Input Voltage: 100-240V
12 x 10/100/1000BaseT RJ45 NIC (default)
16 GB memory
Redundant dual hot-swappable power supplies
Redundant dual hot-swappable 500GB hard drives
LOM card
Frequency: 47-63Hz
Single Power Supply Rating: 1200W
Power Consumption Maximum: 489W/784W
Maximum thermal output: 1669.4 BTU/2673.4 BTU
Telescopic rails (26"–35")
Dimensions
Network Expansion Slot Options (3 slots)
Enclosure: 2RU
12 x 10/100/1000Base-T RJ45 ports
12 x 1000Base-F SFP ports
4 x 10GBase-F SFP+ ports
Max Configuration
Up to 37 x 10/100/1000Base-T RJ45 ports
Up to 36 x 1000Base-F SFP ports
Metric (W x D x H): 431 x 710 x 88 mm
Weight: 26 kg (57.4 lbs.)
Operating Environmental Conditions
Temperature: 32°to104°F / 0° to 40°C
Humidity: 20%-90% (non-condensing)
Storage Conditions
32,64 GB RAM
Temperature: –4° to 158°F / –20° to 70°C
Max VSs: 150 (w/16GB), 250 (w/64GB)
1
2
With Security Acceleration Module
Check Point's SecurityPower is a new benchmark metric that allows customers
to select security appliances by their capacity to handle real-world network traffic,
multiple security functions and a typical security policy.
1
Standard (W x D x H): 17 x 28 x 3.5 in.
Up to 13 x 10GBase-F SFP+ ports
Virtual Systems
1
Humidity: 5% to 95% at 60°C (non-condensing)
Certifications
Safety: UL/cULT
Emissions: FCC, CE
Environmental: RoHS
©2015 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non -confidential content | February 3, 2015
3
Check Point 21800 Appliance
|
Datasheet
APPLIANCE PACKAGES
BASE CONFIGURATION
1,2
21800 Next Generation Firewall Appliance (with FW, VPN, ADNC, IA, MOB -5, IPS and APCL
Blades); bundled with local management for up to 2 gateways.
CPAP-SG21800-NGFW
Secure Web Gateway 21800 Appliance (with FW, VPN, ADNC, IA, APCL, AV and URLF
Blades); bundled with local management and SmartEvent for up to 2 gateways.
CPAP-SWG21800
21800 Next Generation Data Protection Appliance (with FW, VPN, ADNC, IA, MOB -5, IPS,
APCL, and DLP Blades); bundled with local management for up to 2 gateways.
CPAP-SG21800-NGDP
21800 Next Generation Threat Prevention Appliance (with FW, VPN, ADNC, IA, MOB -5, IPS,
APCL, URLF, AV, ABOT and ASPM Blades); bundled with local management for up to 2
gateways.
CPAP-SG21800-NGTP
21800 Next Generation Firewall Appliance with 20 Virtual Systems
CPAP-SG21800-NGFW-VS20
21800 Next Generation Firewall Appliance Bundle, one primary and one HA, with 20 VS
CPAP-SG21800-NGFW-VS20-2
1,2
HIGH PERFORMANCE PACKAGES
21800 Next Generation Firewall Appliance High Performance Package with 12x1GbE copper
interface card, Acceleration Ready 4x10Gb SFP+ interface card, 4xSR transceivers and 64 GB
of memory for high connection capacity
CPAP-SG21800-NGFW-HPP
21800 Next Generation Firewall High Performance Package Appliance with SAM-108 Security
Acceleration Module, an Acceleration Ready 4x10Gb SFP+ interface card, 4xSR transceivers,
64 GB of memory in the appliance and 48 GB of memory in the Security Acceleration Module.
CPAP-SG21800-NGFWHPPSAM-BUN
21800 Secure Web Gateway Appliance High Performance Package with 12x1GbE copper
interface card, Acceleration Ready 4x10Gb SFP+ interface card, SR transceivers and 64 GB of
memory for high connection capacity.
CPAP-SWG21800-HPP
21800 Next Generation Data Protection Appliance High Performance Package with 12x1GbE
CPAP-SG21800-NGDP-HPP
copper interface card, Acceleration Ready 4x10Gb SFP+ interface card, 4xSR transceivers and
64 GB of memory for high connection capacity.
21800 Next Generation Threat Prevention Appliance High Performance Package with 12x1GbE CPAP-SG21800-NGTP-HPP
copper interface card, Acceleration Ready 4x10Gb SFP+ interface card, 4xSR transceivers and
64 GB of memory for high connection capacity.
21800 Next Generation Firewall Appliance with 20 Virtual Systems and the High Performance
Package
CPAP-SG21800-NGFW-VS20HPP
21800 Next Generation Firewall Appliance Bundle, one primary and one HA, with 20 Virtual
Systems and the High Performance Package
CPAP-SG21800-NGFW-VS20HPP-2
1
2
SKUs for 2 and 3 years are available, see the online Product Catalog
DC power SKUs are also available
SOFTWARE BLADE PACKAGES
1
SOFTWARE BLADE PACKAGES
21800 Next Generation Firewall Appliance Software Blade package for 1 year (IPS and APCL
Blades)
CPSB-NGFW- 21800-1Y
Secure Web Gateway 21800 Appliance Software Blade package for 1 year (APCL, AV and
URLF Blades)
CPSB-SWG- 21800-1Y
21800 Next Generation Data Protection Appliance Software Blade package for 1 year (IPS,
APCL, and DLP Blades)
CPSB-NGDP- 21800-1Y
21800 Next Generation Threat Prevention Appliance Software Blade package for 1 year (IPS,
APCL, URLF, AV, ABOT and ASPM Blades)
CPSB-NGTP- 21800-1Y
SOFTWARE BLADES
1
Check Point Mobile Access Blade for unlimited concurrent connections
CPSB-MOB-U
Data Loss Prevention Blade for 1 year (for 1,500 users and above, up to 250,000 mails per
CPSB-DLP-U-1Y
©2015 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non -confidential content | February 3, 2015
4
Check Point 21800 Appliance
|
Datasheet
hour and max throughput of 2.5 Gbps)
Check Point IPS blade for 1 year
CPSB-IPS-XL-1Y
Check Point Application Control blade for 1 year
CPSB-APCL-XL-1Y
Check Point URL Filtering blade for 1 year
CPSB-URLF-XL-1Y
Check Point Antivirus Blade for 1 year
CPSB-AV-XL-1Y
Check Point Anti-Spam & Email Security Blade for 1 year
CPSB-ASPM-XL-1Y
Check Point Anti-Bot blade for 1 year - for ultra-high-end appliances and pre-defined systems
CPSB-ABOT-XL-1Y
VIRTUAL SYSTEM PACKAGES
50 Virtual Systems package
CPSB-VS-50
50 Virtual Systems package for HA/VSLS
CPSB-VS-50-VSLS
25 Virtual Systems package
CPSB-VS-25
25 Virtual Systems package for HA/VSLS
CPSB-VS-25-VSLS
10 Virtual Systems package
CPSB-VS-10
10 Virtual Systems package for HA/VSLS
CPSB-VS-10-VSLS
1
SKUs for 2 and 3 years are available, see the online Product Catalog
ACCESSORIES
SECURITY ACCELERATION MODULE
Security Acceleration Module with 12 GB RAM
CPAC-SAM108-V2
Memory upgrade kit to 24GB RAM for SAM-108
CPAC-RAM24GB-SAM108
Memory upgrade kit to 48GB RAM for SAM-108
CPAC-RAM48GB-SAM108
Security Acceleration Module with 24 GB RAM
CPAC-SAM108-24GB
Security Acceleration Module with 48 GB RAM
CPAC-SAM108-48GB
INTERFACE CARDS AND TRANSCEIVERS
12 Port 10/100/1000 Base-T RJ45 interface card
CPAC-12-1C-21000
12 Port 1000Base-F SFP interface card; requires additional 1000Base SFP transceiver
modules per interface port
CPAC-12-1F-21000
SFP transceiver module for 1G fiber ports - long range (1000Base-LX)
CPAC-TR-1LX
SFP transceiver module for 1G fiber ports - short range (1000Base-SX)
CPAC-TR-1SX
SFP transceiver to 1000 Base-T RJ45 (Copper)
CPAC-TR-1T
4 Port 10GBase-F SFP+ Acceleration Ready interface card
CPAC-ACCL-4-10F-21000
SFP+ transceiver module for 10G fiber ports - long range ( 10GBase-LR)
CPAC-TR-10LR
SFP+ transceiver module for 10G fiber ports - short range ( 10GBase-SR)
CPAC-TR-10SR
SPARES AND MISCELLANEOUS
32GB RAM Memory upgrade for 21000 appliances excluding 21400
CPAC-RAM32GB-21000
64GB RAM Memory upgrade for 21000 appliances excluding 21400
CPAC-RAM64GB-21000
Replacement parts kit (including 1 Hard Disk Drive, one Power Supply, one Fan) for 21000
appliances excluding 21400
CPAC-SPARES-21000
500 GB Hard Drive for 21000 Appliances
CPAC-HDD-500G-21000
Replacement AC Power Supply for 21000 appliances excluding 21400
CPAC-PSU-21000
CONTACT US
Worldwide Headquarters | 5 Ha’Solelim Street, Tel Aviv 67897, Israel | Tel: 972-3-753-4555 | Fax: 972-3-624-1100 | Email:
[email protected]
U.S. Headquarters | 959 Skyway Road, Suite 300, San Carlos, CA 94070 | Tel: 800-429-4391; 650-628-2000 | Fax: 650-654-4233 | www.checkpoint.com
©2015 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non -confidential content | February 3, 2015
5