HP A Series Firewall

Built on the latest state-of-the-art, multi-core CPU platform, and gearing with advanced hardware acceleration, HP A Series firewalls enable advanced scalable network protection.

Overview
Features
Specs
Accessories
Services
Data Sheets

Product overview

Built on the latest state-of-the-art, multi-core CPU platform,and gearing with advanced hardware acceleration,HP A series firewalls enable advanced scalable network protection from the core to the edge at up to 40Gbps firewall throughput. the series also feature with rich VPN abilities including GRE, L2TP and IPSec tunnelling technologies which makes them to be ideal products to build VPN gateway of enterprise and data center user. Meanwhile, the appliances combine built-in protection against denial of service(DoS),hacking attacks, zonal and virtual stateful packet inspection firewall, application bandwidth management, Audio/Video IP multicast routing and email attachment filtering. All the advanced security capabilities build on the unified software platform with A series switches and routers which ensures an easy to integratation, simple management and deployment networking infrastructure, thus lowers a network's total cost of ownership.

High performance up to 40G Firewall throughput
Advanced Virtual Firewall
Rich VPN Functions, IPSec/GRE/L2TP
Comprehensive Security Protection
Carrier-Grade Reliability

Firewall

High Performance — Upto 40Gbps throughput secures traffic without compromising network performance.Maximum 4 million concurrent connections and 180,000 new connections per second enables high-volume networks to remain secure under peak traffic
Application Specific Packet Filter (ASPF) — Dynamically determines whether to forward or drop a packet by checking its application layer protocol information (such as FTP, HTTP, SMTP, RTSP and other application layer protocols based on TCP/UDP) and monitoring the connection-based application layer protocol status
Zone-based access policies — logically groups virtual LANs (VLANs) into zones that share common security policies; allows both unicast and multicast policy settings by zones instead of by individual VLANs
Virtualization — Multi-core architecture enables both multiple zones and multiple separate firewall instances to be created on the same device. Support for 256/512 security zones, 256 virtual firewalls and 4,094 virtual LANs (VLANs) offers robust protection to all corners of your network. Centralized deployment of a single device offering multiple virtual firewalls lowers total cost of ownership through streamlined training, simplified deployment and management and reduced power consumption
Application-level gateway (ALG) — deep packet inspection in the firewall discovers the IP address and service port information embedded in the application data; the firewall then dynamically opens appropriate connections for specific applications
NAT — Fully support of NAT applications including many-to-one, many-to-many, static NAT, dual translation, easy IP and DNS mapping. It supports NAT traversal with multiple protocols, and delivers NAT ALG functions such as DNS, FTP, H.323, and NBT.

Virtual private network (VPN)

IPSec — provides secure tunneling over an untrusted network such as the Internet or a wireless network; offers data confidentiality, authenticity, and integrity between two endpoints of the network
Layer 2 Tunneling Protocol (L2TP) — an industry standard-based traffic encapsulation mechanism supported by many common operating systems such as Windows® XP and Windows Vista®; will tunnel the Point-to-Point Protocol (PPP) traffic over the IP and non-IP networks; may use the IP/UDP transport mechanism in IP networks
Generic Routing Encapsulation (GRE) — can be used to transport Layer 2 connectivity over a Layer 3 path in a secured way; enables the segregation of traffic from site to site
Manual or automatic Internet Key Exchange (IKE) — provides both manual or automatic key exchange required for the algorithms used in encryption or authentication; auto-IKE allows automated management of the public key exchange, providing the highest levels of encryption

Management

Complete session logging — provides detailed information for problem identification and resolution
Manager and operator privilege levels — enable read-only (operator) and read-write (manager) access on CLI and Web browser management interfaces
Secure Web GUI — provides a secure, easy-to-use graphical interface for configuring the module via HTTPS
Command-line interface (CLI) — provides a secure, easy-to-use command-line interface for configuring the module via SSH or a switch console; provides direct real-time session visibility
SNMPv1, v2c, and v3 — facilitate centralized discovery, monitoring, and secure management of networking devices
Remote monitoring (RMON) — uses standard SNMP to monitor essential network functions; supports events, alarm, history, and statistics group plus a private alarm extension group
FTP, TFTP, and SFTP support — FTP allows bidirectional transfers over a TCP/IP network and is used for configuration updates; Trivial FTP is a simpler method using User Datagram Protocol (UDP)

Layer 3 routing

Static IP routing — provides manually configured routing; includes ECMP capability
Routing Information Protocol (RIP) — provides RIPv1 and RIPv2 routing
OSPF — includes host-based ECMP to provide link redundancy/scalable bandwidth and NSSA
Border Gateway Protocol 4 (BGP-4) — Exterior Gateway Protocol (EGP) with path vector protocol uses TCP for enhanced reliability for the route discovery process, reduces bandwidth consumption by advertising only incremental updates, and supports extensive policies for increased flexibility, as well as scales to very large networks
Dual IP stack — maintains separate stacks for IPv4 and IPv6 to ease transition from an IPv4-only network to an IPv6-only network design
Policy routing — allows custom filters for increased performance and security; supports ACLs, IP prefix, AS paths, community lists, and aggregate policies
Layer 3 IPv6 routing — provides routing of IPv6 at media speed; supports static routes, RIPng, OSPFv3, BGP+,policy route and PIM-SM/DM

Security

Defense against attacks — A series Firewall provides defense against various attacks, such as DoS/DDoS, ARP spoofing, large ICMP packet, address/port scanning, Tracert, IP packets with the Record Route option, static and dynamic blacklists. It also supports binding of MAC address and IP address, and supports intelligent defense of worm viruses
Application layer content filtering — A series Firewall supports mail filtering, based on SMTP mail address, titles, attachments, and contents; supports Web page filtering including HTTP URL and content filtering
Multiple security authentication services — A series Firewall supports RADIUS and HWTACACS authentications, certificate-based (x.509 format) PKI/CA authentication, supports user identity management (different users own different rights to execute commands), supports levels of user views (users of different levels have different management rights).
Centralized management and auditing — A Series Firewall provides logging, traffic statistics and analysis, events monitoring and statistics, and mail notification of alarms.

Warranty and support

Electronic and telephone support — limited electronic and telephone support is available from HP; refer to www.hp.com/networking/warranty for details on the support provided and the period during which support is available
Software releases — refer to www.hp.com/networking/warranty for details on the software releases provided and the period during which software releases are available for your product(s)
1-year warranty — with advance replacement and 30-calendar-day delivery (available in most countries)

Performance

HP A-F1000-E	8Gbps Firewall throughput 2M Concurrent connections 60K new connections per second Max 20480 security policies 2Gbps 3DES/AES VPN Throughput 5000 IPSec Tunnel
HP A-F5000 Main Unit	40Gbps Firewall throughput 4M Cuncurrent connections 180K new connections per second MAX 50000 security policies 2Gbps 3DES/AES VPN Throughput 5000 IPSec Tunnel
HP A-F1000-S-EI	2Gbps Firewall throughput 1M Cuncurrent connections 30K new connections per second MAX 20480 security policies 600Mbps 3DES/AES VPN Throughput 2000 IPSec Tunnel
HP A-F1000-A-EI	4Gbps Firewall throughput 1M Cuncurrent connections 30K new connections per second MAX 20480 security policies 1Gbps 3DES/AES VPN Throughput 4000 IPSec Tunnel
HP A-F5000 Firewall Chassis	40Gbps Firewall throughput 4M Cuncurrent connections 180K new connections per second MAX 50000 security policies 2Gbps 3DES/AES VPN Throughput 5000 IPSec Tunnel

Emissions

CISPR 22; EN 55022; ICES-003; AS/NZS CISPR 22; FCC Part 15; EN 61000-3-2; EN 61000-3-3; VCCI V-3

Immunity

ESD: EN300 386/EN 55024/EN 61000-4-2/EN301489-1/EN301489-17/IEC 61000-4-2

Radiated: EN300 386/EN 55024/EN301489-1/EN301489-17/EN 61000-4-3/IEC 61000-4-3

EFT/Burst: EN300 386/EN 55024/EN301489-1/EN301489-17/EN 61000-4-4/IEC 61000-4-4

Surge: EN300 386/EN 55024/EN301489-1/EN301489-17/EN 61000-4-5/IEC 61000-4-5

Conducted: EN300 386/EN 55024/EN301489-1/EN301489-17/EN 61000-4-6/IEC 61000-4-6

Power frequency magnetic field: EN 55024/EN 61000-4-8/IEC 61000-4-8

Voltage dips and interruptions: EN300 386/EN 55024/EN301489-1/EN301489-17/EN 61000-4-11/IEC 61000-4-11

Management

IMC - Intelligent Management Center; command-line interface; Web browser; SNMP Manager; Telnet; HTTPS; FTP

Standards and protocols

IPv6

RFC 1981 IPv6 Path MTU Discovery
RFC 2460 IPv6 Specification
RFC 2465 Management Information Base for IP Version 6: Textual Conventions and General Group(partially support, only "IPv6 Interface Statistics table")
RFC 3484 Default Address Selection for IPv6
RFC 3513 IPv6 Addressing Architecture
RFC 3587 IPv6 Global Unicast Address Format
RFC 4007 IPv6 Scoped Address Architecture
RFC 4862 IPv6 Stateless Address Auto-configuration

Security

IEEE 802.1X:Port-Based Network Access Control (2001)
RFC 1321 The MD5 Message-Digest Algorithm
RFC 1334 PPP Authentication Protocols (PAP)
RFC 1994 PPP Challenge Handshake Authentication Protocol (CHAP)
RFC 2104 Keyed-Hashing for Message Authentication
RFC 2138 RADIUS Authentication
RFC 2618 RADIUS Authentication Client MIB
RFC 2620 RADIUS Accounting Client MIB
RFC 2716 PPP EAP TLS Authentication Protocol
RFC 2865 RADIUS Authentication
RFC 2866 RADIUS Accounting
RFC 2867 RADIUS Accounting Modifications for Tunnel Protocol Support
RFC 2868 RADIUS Attributes for Tunnel Protocol Support
RFC 2869 RADIUS Extensions
draft-grant-tacacs-02 (TACACS)

VPN

RFC 1701 Generic Routing Encapsulation (GRE)
RFC 1702 Generic Routing Encapsulation over IPv4 networks.
RFC 1828 IP Authentication using Keyed MD5
RFC 1829 The ESP DES-CBC Transform
RFC 1853 IP in IP Tunneling
RFC 2085 HMAC-MD5 IP Authentication with Replay Prevention
RFC 2401 Security Architecture for the Internet Protocol

RFC 2402 IP Authentication Header
RFC 2403 The Use of HMAC-MD5-96 within ESP and AH
RFC 2404 The Use of HMAC-SHA-1-96 within ESP and AH
RFC 2405 The ESP DES-CBC Cipher Algorithm With Explicit IV
RFC 2406 IP Encapsulating Security Payload (ESP)
RFC 2410 The NULL Encryption Algorithm and Its Use With IPsec
RFC 2411 IP Security Document Roadmap
RFC 2451 The ESP CBC-Mode Cipher Algorithms
RFC 2473 Generic Packet Tunneling in IPv6 Specification
RFC 2529 Transmission of IPv6 over IPv4 Domains without Explicit Tunnels
RFC 2661 Layer Two Tunneling Protocol "L2TP"
RFC 2784 Generic Routing Encapsulation (GRE)
RFC 2868 RADIUS Attributes for Tunnel Protocol Support
RFC 2893 Transition Mechanisms for IPv6 Hosts and Routers
RFC 3602 The AES-CBC Cipher Algorithm and Its Use with IPsec
RFC 4214 Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)

IKEv1

RFC 2407 The Internet IP Security Domain of Interpretation for ISAKMP
RFC 2408 Internet Security Association and Key Management Protocol (ISAKMP).
RFC 2409 The Internet Key Exchange (IKE)
RFC 2412 The OAKLEY Key Determination Protocol
RFC 3526 More Modular Exponential (MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)
RFC 3706 A Traffic-Based Method of Detecting Dead Internet Key Exchange (IKE) Peers

PKI

RFC 2510 Internet X.509 Public Key Infrastructure Certificate Management Protocols
RFC 2511 Internet X.509 Certificate Request Message Format
RFC 3279 Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
RFC 3280 Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
draft-nourse-scep-06:
PKCS#1
PKCS#10
PKCS#12
PKCS#7

Additional accessories

HP A-F1000-E VPN Firewall Appliance (JD272A) accessories

»HP A6600 4-port Gig-T HIM Module (JC163A)
»HP A6600 8-port Gig-T HIM Module (JC164A)
»HP A6600 1-port 10-GbE XFP HIM Module (JC168A)
»HP 4-port GbE SFP HIM A6600 Module (JC171A)

HP A-F5000 Firewall Main Processing Unit (JG215A) accessories

»HP A-F5000 8-port Gig-T/4-port GbE Combo Module (JD263A)
»HP A-F5000 2-port 10GbE XFP Module (JD264A)
»HP A-F5000 8-port GbE SFP/4-port GbE Combo Module (JG212A)

HP A-F1000-S-EI VPN Firewall Appliance (JG213A) accessories

»HP A-F1000-S/A 2-port 10-GbE SFP+ Module (JG317A)

»HP A5800/A5500 150W AC Power Supply (JD362A)
»HP A5800/A5500 150W DC Power Supply (JD366A)

HP A-F1000-A-EI VPN Firewall Appliance (JG214A) accessories

»HP A-F1000-S/A 2-port 10-GbE SFP+ Module (JG317A)
»HP A5800/A5500 150W AC Power Supply (JD362A)
»HP A5800/A5500 150W DC Power Supply (JD366A)

HP A-F5000 Firewall Standalone Chassis (JG216A) accessories

»HP A7500 650W DC Power Supply (JD209A)
»HP A7500 650W AC Power Supply (JD217A)
»HP A-F5000 Fan Assembly (JG217A)
»HP A-F5000 Firewall Main Processing Unit (JG215A)

HP Networking Services

Services that add value to your business

The warranties on HP Networking products provide a robust foundation for ongoing network support, but many customers have advanced support needs. Today's enterprise businesses, regardless of their size, are under increasing pressure to reduce the cost and complexity of supporting their network infrastructures. Demand for new services from businesses and their end users is constantly increasing. HP offers an affordable, comprehensive portfolio of networking services for organizations of all sizes. HP has a unique services advantage you can benefit from, and HP is the only vendor in the IT industry that can provide integrated and consistent support for your entire technology infrastructure worldwide, including networking, servers and storage, and imaging and printing, as well as desktop and mobile computing, to help you grow your business with expert support that is affordable, personal, and scaled to your needs. HP Networking's implementation and design centers simplify your network planning, while HP Technology and Enterprise Services deliver choice and flexibility.

HP provides a full range of custom services to meet the end-to-end networking needs of our customers. HP Network Lifecycle Services form the core foundation of network consulting, assessments, planning, design, integration, deployment, and management. They are available as standalone services or can be crafted to deliver solutions across the services portfolio, spanning network performance, network security and risk management, global deployment, data center networking, wireless LAN/mobility, and Unified Communications and Collaboration.

Data Sheets

Data Sheets: Firewall Series

Quick Specs: Firewall Series

HP A Series Firewall

Product overview

Firewall

Virtual private network (VPN)

Management

Layer 3 routing

Security

Warranty and support

Performance

Emissions

Immunity

Management

Standards and protocols

Additional accessories

HP Networking Services

Data Sheets

Free Consultation

Unbeatable Prices

Professional Services

24x7 Tech Support