Gateway Anti-Malware, Intrusion Prevention & Application Control for TZ570 (3 Years)

Gateway Anti-Malware, Intrusion Prevention and Application Control

SonicWall Gateway Anti-Malware, Intrusion Prevention and Application Control integrates Gateway Anti-Virus, Anti-Spyware, Intrusion Prevention (IPS), Application Control, Geo-IP Filtering & Botnet Service to deliver intelligent, real-time network security protection against sophisticated application layer and content-based attacks. Because new threats emerge daily and are often unpredictable, SonicWall is able to deliver the highest protection possible with a deep packet inspection engine that delivers threat protection directly on the security gateway by matching downloaded, e-mailed and compressed files against an extensive and continuously updated database of signatures.

• Gateway Anti-Virus
  • Scans traffic over HTTP/S, FTP, SMTP, POP3, IMAP, SMB and generic TCP streams for viruses, worms and trojans.
  • It scans streams as they pass using the RFDPI engine, so there is low latency and no file-size limit.
  • It uses signatures stored on the firewall and updated continuously by Capture Labs.
  • It also inspects compressed and archived files.

• Gateway Anti-Malware
  • Extends protection beyond classic viruses to spyware, adware, keyloggers and other malicious code.
  • Anti-Spyware blocks spyware installation and stops existing spyware from sending data out.
  • Cloud Anti-Virus checks traffic against a much larger malware database in the SonicWall cloud than fits on the box.
  • It catches known malware, and Capture ATP handles unknown and zero-day files in its sandbox.

• Intrusion Prevention (IPS)
  • Detects and blocks exploits, vulnerability attacks, protocol anomalies and worm propagation.
  • Signatures are grouped into High, Medium and Low priority, each set to prevent or detect, with per-signature overrides and exclusions.
  • It inspects inbound, outbound and inter-zone traffic, so it can catch lateral movement and C&C behaviour.

• Application Control
  • Identifies thousands of applications and their sub-functions by signature rather than port.
  • Applications can be blocked, logged or bandwidth-managed per zone, user or group.
  • It feeds App Visualization and CTA reporting, showing what is actually running on the network.

• Geo-IP Filtering
  • Blocks or allows traffic to and from specific countries.
  • It can apply to all connections or to selected firewall rules, for example restricting VPN or management access to the UK only.
  • It can block IPs that don't resolve to a country, and exclusion objects handle cloud services and CDNs that geolocate unexpectedly.

• Botnet Filtering
  • Blocks connections to and from known botnet C&C servers using the Capture Labs reputation feed.
  • Its key value is stopping infected internal hosts from phoning home, and the logs point to the compromised device.
  • Dynamic Botnet Lists let you add custom bad IPs, and exclusion objects cover false positives.

In many cases it's better to go with the Essential Protection Security Suite (EPSS) or Advanced Protection Security Suite (APSS) which come with additional security, support and reporting. On Gen 7 or 8 firewall you can even go Managed Protection Security Suite (MPSS) and let SonicWall give you expert configuration, proactive firmware management and 24/7 monitoring.