思科安全产品销售培训.ppt

1、思科安全产品销售培训,Version: 20071125,徐震 安全产品经理 2020/7/29,内容安排,思科ASA安全产品简述及市场竞争态势分析 如何体现思科ASA安全产品的技术优势? 如何提升安全产品的Attach Rate? 如何提升代理商的利润空间,UTM 市场一览,IDC定义，译成由硬件、软件和网络技术组成的具有专门用途的设备，它主要提供一项或多项安全功能， 它将多种安全特性集成于一个硬设备里, 构成一个标准的统一管理平台 直说就是： FW （防火墙） + VPN（虚拟专用网）+IPS（入侵防护）+ AV （网关防毒）,UTM之厂商比较,Cisco ASA 5500 Series

2、Adaptive Security Appliances,Teleworker,Branch Office,InternetEdge,ASA 5550 (1.2 Gbps, 36K conn/s),ASA 5580-20 (5-10 Gbps, 90K conn/s),ASA 5580-40 (10-20 Gbps, 150K conn/s),ASA 5505 (150 Mbps, 4K conn/s),Cisco ASA 5580: Extends Market-leading Family to the Data Center,Data Center,ASA 5540 (650 Mbps,

3、 25K conn/s),ASA 5520 (450 Mbps, 12K conn/s),ASA 5510 (300 Mbps, 9K conn/s),Campus,Cisco ASA 5500 Platforms,SSG appliances: SSG 5/20/140 SSG 320/350 SSG 520/550 Netscreen appliances: NS 5GT, 25, 50 NS 204, 208, 500 NS 5200 and 5400 IDP and ISG appliances: IDP 50, 200 IDP 600, 1100 ISG 1000, 2000 (wi

4、th IDP),SSL VPN 接入: Secure Access 700 Secure Access 2000, 4000 Secure Access 6000, 6000 SP 访问控制: Steel Belted Radius Odyssey Access Client Infranet Controller 4000, 6000 安全管理: J-Security Center Central (SSL) Manager Netscreen Security Manager,注意：NS系列为之前Netscreen的产品，仅有Firewall/IPSEC VPN功能，SSG/ISG为UTM

5、产品,当前Juniper安全产品一览,Juniper SSG系列产品的定位,SSG仍采用原有Netsreen的OS(基于Vxworks)， 提供软件转换（可转换至JUNos); 可作传统的防火墙使用； SSG开始集成UTM功能； 增加了部分IPS(软件实现)、病毒防护、防垃圾邮件等功能 SSG支持部分广域网接口； 可作为安全路由器(类似ISR Security Bundle),SSG 5,SSG 20,SSG 140,SSG 550M,SSG 520M,SSG 320M,SSG 350M,Juniper ISG 系列产品,共两个型号:ISG1000/ISG2000,为原Netscreen产品;

6、 与SSG最大的区别在于提供硬件的IDP模块; 可作传统防火墙使用; 部分集成了UTM功能; 新建连接20000、23000/秒,ISG1000,ISG2000,SSG/ISG 系列与Cisco产品大致对应关系,ASA5580发布之前，一般用ISG 1000与ASA5540/50 对应，ISG2000与ASA5550/FWSM对应 ASA5580发布后后，建议用ISG 1000对应FWSM/ASA5550/80-20,用ISG2000对应FWSM/ASA5580-20/40;,JNPR s FW street price of Mar 25, 2008,内容安排,思科ASA安全产品简述及市场竞

7、争态势分析 如何体现思科ASA安全产品的技术优势? 如何提升安全产品的Attach Rate? 如何提升代理商的利润空间,12,12,12,思科ASA5500专用安全硬件扩展模块,Cisco ASA 5500 SeriesAdvanced Inspection and Prevention Module (AIP SSM),High-Performance Module for Additional Services,Thumbscrews for EasyInsertion and Removal,Gigabit Ethernet Port forOut-of-Band Management

8、, Etc.,Diskless (Flash-Based) Design for Improved Reliability,Cisco ASA 5500 SeriesAdvanced Inspection and Prevention Module (AIP SSM),不断升级的安全威胁 内容及网络安全的必要性,锁住了网络（层）之门, 但电子邮件及网页门仍然洞开,网络安全,内容安全,端口 25,端口 80,Innovative Security for Unified Communications Protect Cisco Communication Manager and IP Phone

9、s,Ensure SIP, SCCP, H.323, MGCP requests conform to standards Prevent inappropriate SIP Methods from being sent to Communication Manager Network Rate Limit SIP Requests Policy enforcement of calls (whitelist, blacklist, caller/called party, SIP URI) Dynamic port opening for Cisco applications Enable

10、 only “registered phones” to make calls Enable inspection of encrypted phone calls,Cisco ASA with SSL VPN,Cisco Security Agent (CSA),Cisco ASA with VPN,Cisco ASA with IPS and VPN,Protection Against Attacks On Unified Communications Call Control, Endpoints And Applications,使用统一VPN接入系统满足各种客户需求,Public

11、Internet,ASA 5500 VPN Edition,网页定制化的SSL VPN接入,网页定制化SSL VPN接入,隧道模式的SSL或IPSec VPN LAN接入,商业合作伙伴的VPN接入,Requires “locked-down” access to specific extranet resources and applications,出差员工的远程接入服务,Remote access users require seamless, easy to use, access to corporate network resources,第三方平台临时接入服务,Remote use

12、rs may require lightweight access to e-mail and web-based applications from a public machine,远程分支机构以及SOHU型用户的LAN接入,Day extenders and mobile employees require consistent LAN-like, full-network access, to corporate resources and applications,隧道模式的SSL或IPSec VPN客户端接入,ASA SSL VPN 的机会分析,We do can make more money with SSL VPN solution We have good chance to win this market, with ASA 8.0 released/Public Demo Site We are not only SSL VPN gateway, we also support firewall and IPsec VPN,Juniper SSG140与Cis