Barracuda CloudGen Firewall Rugged Appliance F193
Next-Generation Firewalls for Distributed Enterprises with Advanced Threat Detection
Sorry, this product is no longer available, please contact us for a replacement.
Click here to jump to more pricing!
Barracuda CloudGen Firewall F-Series:
Operating industrial control systems (ICS) in a secure way and integrating operational technology (OT) adds new challenges to the current standard means of protection and security management.
Barracuda CloudGen Firewall rugged appliances are the perfect fit for special requirements in regards to usability and operating concepts for industrial and harsh environments.
Full next-generation security:
Barracuda CloudGen Firewall is designed and built from the ground up to provide comprehensive, next-generation firewall protection. Firewalling, IPS, dual antivirus and application control (including industrial protocols and subprotocols) take place directly in the data path.
More resource-intensive tasks like sandboxing —required for protecting against ransomware—are seamlessly integrated in the cloud. All CloudGen Firewall platforms and models provide the same level of security, maintaining maximum security for micro-segmentation for Operational Technology with local enforcement of highest security levels.
Security meets OT
ICS/OT security projects have to combine two operating concepts: while the individual firewall is part of hundreds to thousands of other similar firewalls that follow similar policies and ensure that all security components function in a traceable and controllable manner, the very same firewall is one of many different components of a system that has to be integrated into operation and maintenance concepts.
Secure remote access for OT
For operational technology protected by CloudGen Firewall, secure remote access capabilities make it extremely convenient to grant secure, temporary VPN access to sensitive parts of manufacturing assets for third-party-maintenance providers.
Benefits:
|
|
|
|
|
|
Intrusion Detection and Prevention
Advanced Threat Protection
Traffic Intelligence & SD-WAN 
Features:
Security
While traditional solutions usually detect network threats after they have breached the network by sending log notifications to the administrator, Barracuda Advanced Threat Protection (ATP) implements full system emulation, providing deep visibility into malware behavior. Files are checked against a cryptographic hash database that is constantly updated. In case the file is unknown, it is emulated in a virtual sandbox where malicious behavior can be discovered.
Barracuda ATP offers Administrators granular, file-type-based control including automatic quarantine and block-listing features to maintain the highest level of protection for an organization’s network.
Barracuda ATP offers Administrators granular, file-type-based control including automatic quarantine and block-listing features to maintain the highest level of protection for an organization’s network.
Botnet and Spyware Protection guards against botnet infections by blocking access to malicious sites and servers, and detects potentially infected clients based on DNS Sinkholing technology. DNS Sinkholing blocks clients from accessing malicious domains by monitoring outbound DNS requests passing through the firewall. DNS requests to malicious domains are redirected to an internal sinkhole, thereby preventing data exfiltration and identifying the victim. Once an infected client is detected, it can be isolated automatically. An alert can also be created or reported by Barracuda Firewall Report Creator.
The Intrusion Detection and Prevention System (IDS/IPS) of Barracuda CloudGen Firewall strongly enhances network security by providing complete and comprehensive real-time network protection against a broad range of network threats, vulnerabilities, exploits, and exposures in operating systems, applications, and databases preventing network attacks such as:
- SQL injections and arbitrary code executions
- Access control attempts and privilege escalations
- Cross-Site Scripting and buffer overflows
- Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks
- Directory traversal and probing and scanning attempts
- Backdoor attacks, Trojans, rootkits, viruses, worms, and spyware
In today’s world of omnipresent botnets, one of the main tasks of perimeter protection is to ensure ongoing availability of the network for legitimate requests and to detect and repel malicious denial of service attacks. With TCP SYN Flood Protection, Barracuda CloudGen Firewall effectively functions as a generic TCP proxy, forwarding only legitimate TCP traffic to the inside of the network.
Additionally, Barracuda CloudGen Firewall allows the definition of a rate limit that is applied to the maximum number of sessions per source address to be handled by the firewall. Packets arriving at a rate faster than allowed will simply be dropped. In a massive DDoS attack, the attackers may simply aim for saturating the link by transmitting vast numbers of UDP packets. The integrated environmental monitoring feature of Barracuda CloudGen Firewall diagnoses such conditions by link and target address monitoring. Once the response of a remote target address to regular ICMP probing fails, the system can be configured to activate different routes and uplinks (for example backup line, ISDN, xDSL). Using this feature, traffic will be unimpeded across unaffected lines and crucial site-to-site and site-to-Internet connectivity remains operational.
Additionally, Barracuda CloudGen Firewall allows the definition of a rate limit that is applied to the maximum number of sessions per source address to be handled by the firewall. Packets arriving at a rate faster than allowed will simply be dropped. In a massive DDoS attack, the attackers may simply aim for saturating the link by transmitting vast numbers of UDP packets. The integrated environmental monitoring feature of Barracuda CloudGen Firewall diagnoses such conditions by link and target address monitoring. Once the response of a remote target address to regular ICMP probing fails, the system can be configured to activate different routes and uplinks (for example backup line, ISDN, xDSL). Using this feature, traffic will be unimpeded across unaffected lines and crucial site-to-site and site-to-Internet connectivity remains operational.
The Malware Protection built into Barracuda CloudGen Firewall shields the internal network from malicious content by scanning web content (HTTP and HTTPs), email (SMTP, POP3), and file transfers (FTP) via two fully integrated antivirus engines. Barracuda Malware protection is based on regular signature updates as well as advanced heuristics to detect malware or other potentially unwanted programs even before signatures are available. Barracuda Malware Protection covers viruses, worms, Trojans, malicious java applets, and programs using known exploits on PDF, picture and office documents, macro viruses, and many more, even when using stealth or morphing techniques for obfuscation.
All Barracuda CloudGen Firewall models can apply IPS, Virus Protection, Application Control, URL Filter and even Advanced Threat Protection to SSL encrypted web traffic using the standard ' trusted man-in-the-middle' approach. SSL Interception can be fine-tuned to exempt local networks, users/groups, URL Filter categories or custom defined domains from SSL Inspection.
At the heart of every Barracuda CloudGen Firewall is a high performance stateful deep packet inspection engine examining the header as well as the data part of every passing packet. Malformed packets are disregarded, protecting the infrastructure behind the Barracuda device against network level attacks. Protocol compliant packages are then checked to match any of the defined firewall rules.
Once a data packet is opened up for inspection by the Firewall, all other security inspection mechanisms like IPS/IDS, anti-virus are also applied to the packet or stream of consecutive packets. Security inspection is done in single pas mode without the need to hand over to a separate proxy.
Multi-factor authentication (MFA) has become the standard for preventing unauthorized access to company critical information. Barracuda CloudGen Firewall supports and enforces multi factor authentication methods for protected resources, SSL-VPN as well as VPN connections. This makes the need for purchasing an additional multi-factor authentication or identity access management (IAM) solution obsolete.
Time-based one-time passwords (TOTP) are commonly used for two-factor authentication and is today the de-facto standard for multi factor authentication methods as used by cloud application providers. Every Barracuda CloudGen Firewall includes an advanced multi-factor authentication function using the TOTP algorithm to protect company critical resources as well as SSL-VPN and VPN connections from unauthorized use.
Connectivity & SD-WAN
If Dynamic Bandwidth & Latency Detection indicates the measured bandwidth of an uplink is not sufficient to sustain the minimally required business critical traffic (e.g., VoIP), Barracuda CloudGen Firewall automatically shifts sessions for non-business critical traffic to secondary links to free up bandwidth for critical traffic.
Barracuda CloudGen Firewall uses dynamic bandwidth and latency detection to automatically balance existing sessions inside logical VPN tunnels across all available uplinks. This real-time balancing optimizes network efficiency and bandwidth usage at any given moment.
A unique combination of next-generation security and adaptive WAN routing technology allows Barracuda CloudGen Firewall to dynamically assign available bandwidth, uplink, and routing information based not only on protocol, user, location, and content, but also on applications, application categories, and even web content categories. This keeps expensive, highly available lines free for business- and mission-critical applications, while significantly reducing response times and freeing up additional bandwidth.
Barracuda CloudGen Firewall combines a comprehensive set of advanced security features with capabilities that support the Software-Defined Wide-Area Network (SD-WAN). SD-WAN capabilities allow CloudGen Firewalls to create secure pathways across both multiple WAN connections and multiple carriers, without the involvement of typical high-management overhead. Advanced load sharing lets you use multiple WAN connections simultaneously and distribute encrypted VPN tunnels across multiple WAN connections. Built-in compression, caching, and WAN optimization technologies significantly increase your available bandwidth. These capabilities reduce your need for expensive leased lines, consolidate multiple security functions into a single device, and create a unified management framework—all of which results in significant cost savings for your organization.
In order to achieve the best possible user experience across the Wide Area Network, all Barracuda CloudGen Firewall models pro-actively measure the available bandwidths and latency between VPN endpoints. The results are directly available to the firewall policy engine to select the best suitable uplink per application or disqualify an uplink if the bandwidth or latency fall outside of acceptable limits.
Barracuda CloudGen Firewall copies packets and sends them simultaneously through the selected primary and secondary VPN transports. Both packet streams are reassembled at the other end of the logical VPN tunnel. This significantly reduces packet loss for applications like VoIP or video streaming. It also provides instant failover—with no packets dropped—in case one VPN transport of a logical VPN tunnel goes down.
In order to achieve the best possible user experience across your WAN, all Barracuda CloudGen Firewall models are able to detect available bandwidths and latency between VPN endpoints in real time. The firewall policy engine is able to dynamically select the most suitable uplink for each application, or to disqualify an uplink if bandwidth or latency is outside defined limits. In addition, if the measured bandwidth of an uplink is not sufficient to sustain business-critical traffic (e.g., VoIP), the CloudGen Firewall automatically shifts sessions for non-critical traffic to secondary links, to free up high-quality bandwidth for critical traffic.
Due to the limitations that come with standard IPsec connections, Barracuda Networks has created several powerful extensions to standard IPsec tunnel management. This core of Barracuda Firewall VPN Engine is called TINA (Transport Independent Network Architecture). The TINA protocol allows the use of TCP, UDP, and ESP for high speed VPN connections, which improves the VPN connectivity substantially by adding:
- Endpoint-to-Endpoint (not network-to-network) connectivity
- NAT friendliness
- Multiple physical transport paths for a logical tunnel
- Multiple tunnels between two locations
- HTTPS and SOCKS4/5 proxy compatibility
- Dynamic Address Support
- Tunnel heartbeat monitoring
Create highly reliable and secure site-to-site connections between on-premises firewalls (both hardware and virtual appliances). Site-to-site connectivity also includes public cloud offerings like Amazon Web Services and Microsoft Azure. But it is not just about maintaining static site-to-site VPN tunnels. Having a hub-and-spoke VPN setup allows you to create tunnels automatically and on-demand between connected nodes in order to avoid the hub turning into a bottleneck. You thereby ensure low latency connections for VoIP applications, for example. As soon as the connection is no longer required, the VPN tunnel is automatically closed again. Administrators naturally have full real-time visibility into the dynamic mesh VPN setup.
To ensure unbeatable, cost-efficient connectivity, Barracuda CloudGen Firewall provides a wide range of built-in uplink options including unlimited leased lines, up to twelve DHCP uplinks, and up to four xDSL uplinks. By eliminating the need to purchase additional devices for link balancing, security-conscious customers have access to a WAN connection that never goes down, even if one or two of the existing WAN uplinks are severed. In addition, traffic intelligence mechanisms ensure that the next-defined uplink is activated on the fly and that all traffic is rerouted to make full use of the remaining lines. In the event that backup lines provide less bandwidth, intelligent traffic shaping automatically prioritizes business-critical applications, networks, or distinct endpoints.
Limited network resources make bandwidth prioritization a necessity. Barracuda CloudGen Firewall provides strong Quality of Service (QoS) that lets the administrator apply quality aspects and service guarantees to selected traffic flows within the WAN. QoS is often used to prioritize the network traffic of applications that are critical and must not be affected by the network traffic of other applications.
Barracuda CloudGen Firewall provides a large set of QoS techniques, such as traffic shaping, traffic prioritization, and bandwidth partitioning, which assigns a bandwidth limit to certain types of traffic. To select traffic for different priority classes, the available real-time traffic analysis can be used to identify whether network traffic was sent by business-critical applications or by potentially unwanted applications.
Barracuda CloudGen Firewall provides a large set of QoS techniques, such as traffic shaping, traffic prioritization, and bandwidth partitioning, which assigns a bandwidth limit to certain types of traffic. To select traffic for different priority classes, the available real-time traffic analysis can be used to identify whether network traffic was sent by business-critical applications or by potentially unwanted applications.
Barracuda CloudGen Firewall can significantly enhance the WAN performance of distributed network environments by improving the availability, performance, and response time of business-critical applications by lowering throughput and transmission delays, affecting time-sensitive decisions and enterprise profitability. The next-generation networking concept of Barracuda CloudGen Firewall provides a set of powerful features to efficiently reduce and offset the negative effects of high latencies and response times.
By implementing enterprise-grade WAN acceleration features such as data deduplication, traffic compression, and protocol optimization, Barracuda CloudGen Firewalls can significantly improve site-to-site WAN traffic and increase productivity by accelerating the delivery of business applications - at no extra charge. WAN traffic can be effectively compressed up to 95 percent, significantly reducing the bandwidth needed at remote locations while increasing network responsiveness.
By implementing enterprise-grade WAN acceleration features such as data deduplication, traffic compression, and protocol optimization, Barracuda CloudGen Firewalls can significantly improve site-to-site WAN traffic and increase productivity by accelerating the delivery of business applications - at no extra charge. WAN traffic can be effectively compressed up to 95 percent, significantly reducing the bandwidth needed at remote locations while increasing network responsiveness.
With Azure Virtual WAN, Microsoft and Barracuda CloudGen Firewall automate the process of building secure, high-performance branch-to-branch and branch-to-cloud networks. Support for Azure Virtual WAN fully automates the creation of company-wide secure WANs using Azure’s high-performance fiber backbone. Every Barracuda CloudGen Firewall supports Azure vWAN, and Barracuda Firewall Control Center provides central orchestration, management, and maintenance.
Secure VPN tunnels between Barracuda CloudGen Firewall appliances, regardless if in the cloud, across multiple clouds or on premises are created programmatically on demand via API or command line. This enables automation across the whole enterprise and automation of DevOps processes.
To extend the SASE service at line speed to every site device and overcome limitations introduced by traditional SD-WAN technology based on shared uplinks like broadband, CloudGen Firewall features uplink optimization technology with Forward Error Correction and self-healing traffic intelligence. This allows using the available physical bandwidth more effectively and expanding the benefits of SD-WAN to sites with single uplinks as well as optimized utilization of shared uplinks.
Adaptive Session Balancing technology ensures using the best available uplink for the application profile, for all encrypted tunnels across SD-WAN sites. If the health state of the initial uplink recovers, encrypted SD-WAN traffic transparently switches back to this uplink. Application-based routing, factoring in the results of Dynamic Bandwidth and Latency Detection, applies the same concept for outbound internet traffic, ensuring that SaaS applications like Office 365 are always leveraging the best available uplink, even when conditions change frequently.
Secure SD-WAN connections with Barracuda CloudGen Firewall are designed for high-speed networking across shared lossy lines such as internet broadband or 4G/5G. The underlying forward error correcting (FEC) technology to remediate packet loss is based on a new set of algorithms in the category of random linear network codes (RLNC). Algorithms based on RLNC codes react much faster to losses, remediate these faster on the fly, requiring fewer packet retransmissions and reducing overhead on the devices. This results in high quality voice and video calls even in high packet loss scenarios and with many subscribers on the shared line.
Specifications:
Front View
| Barracuda CloudGen Firewall F193A.R | |
|---|---|
| Throughput | |
| Firewall1 | 2.1 Gbps |
| SD-WAN2 | 320 Mbps |
| IPS3 | 790 Mbps |
| NGFW4 | 800 Mbps |
| Threat protection5 | 700 Mbps |
| Recommended no. of concurrent users | 75 - 150 |
| Concurrent Sessions | 100,000 |
| New Sessions per Second | 9,000 |
| Hardware | |
| Form Factor | Compact, DIN rail mount |
| Dimensions (WxDxH; in) | 2.67 x 5.9 x 5.11 |
| Dimensions (WxDxH; cm) | 6.8 x 15 x 13 |
| Weight (lbs) | 3.1 |
| Weight (kg) | 1.4 |
| 1 GbE Copper Ethernet NICs | 5x1 GbE |
| 1 GbE Fiber NICs (SFP) | 2x1 GbE |
| 10 GbE Fiber NICs (SFP+) | n/a |
| 40 GbE Fiber NICs (QSFP) | n/a |
| Max Storage | 100 GB or better |
| Power Supply | Phoenix 4-pin |
| Integrated Wi-Fi Access Point | n/a |
| Features | |
| Firewall incl.IPS | |
| Application Control | |
| Dynamic Routing | |
| App-Based Provider Selection | |
| Remote access | |
| SSL Interception | |
| Secure SD-WAN | |
| Web Filter | |
| Zero-Touch Deployment | |
| Advanced Threat Protection | Optional |
| Malware Protection | Optional |
| Advanced Remote Access | Optional |
| Reporting with Firewall Insights | Optional |
1 Firewall throughput measured with large UDP packets (MTU1500), bidirectional across multiple ports, utilizing highest available port density
2 SD-WAN performance is based on 1415 Byte UDP packets, bidirectional using BreakingPoint traffic generator
3 IPS throughput is measured using large UDP packets (MTU1500) and across multiple ports, utilizing highest available port density.
4 NGFW throughput is measured with IPS, application control, and web filter enabled, based on BreakingPoint Realworld-IPS-Enterprise-Traffic-Mix, bidirectional across multiple ports, utilizing highest available port density
5 Threat protection throughput is measured with IPS, application control, web filter, antivirus, and SSL inspection enabled, based on BreakingPoint Realworld-IPS-Enterprise-Traffic-Mix, bidirectional across multiple ports.
Technical Specifications:
Firewall
- Stateful packet inspection and forwarding
- Full user-identity awareness
- IDS/IPS
- Application control and granular application enforcement
- Interception and decryption of SSL/TLS encrypted applications
- Antivirus and web filtering in single pass mode
- Email security
- SafeSearch enforcement
- Google Accounts Enforcement
- Denial of Service protection (DoS/DDoS)
- Spoofing and flooding protection
- ARP spoofing and trashing protection
- DNS reputation filtering
- NAT (SNAT, DNAT), PAT
- Dynamic rules / timer triggers
- Single object-oriented rule set for routing, bridging, and routed bridging
- Virtual rule test environment
- Network security orchestration with tufin SecureTrack
Protocol support
- IPv4, IPv6
- BGP/OSPF/RIP
- VoIP (H.323, SIP, SCCP [skinny])
- RPC protocols (ONC-RPC, DCE-RPC)
- 802.1q VLAN
- Industrial protocols and subprotocols (S7, S7+, IEC 60870-5- 104, IEC 61850, MODBUS, DNP3)
Intrusion detection and prevention
- Protection against exploits, threats and vulnerabilities
- Packet anomaly and fragmentation protection
- Advanced anti-evasion and obfuscation techniques
- Automatic signature updates
Infrastructure services
- DHCP server, relay
- SIP and HTTP proxies
- SNMP and IPFIX support
- JSON lifecycle automation API
- Auto VPN via API and script control
- Authoritative DNS server
- DNS server
- DNS cache
- Wi-Fi (802.11n) on selected models
- Built-in support for Azure Virtual WAN
Remote and Zero Trust Access
- Network access control
- iOS and Android mobile device support
- Two-factor authentication via timebased one-time passwords (TOTP), Radius, or RSA MFA (requires an active Advanced Remote Access subscription) for remote access clients
- Multi-factor authentication for browser-based remote access and CudaLaunch
- Barracuda CloudGen Access support - CloudGen Access Proxy service included with every CloudGen Firewall for quick ZeroTrust-Access rollout
Advanced threat protection
- Dynamic, on-demand analysis of malware programs (sandboxing)
- Dynamic analysis of documents with embedded exploits (PDF, Office, etc.)
- Detailed forensic analysis
- Botnet and spyware protection
- TypoSquatting and link protection for email
Central management options via Barracuda Firewall Control Center
- Administration for unlimited firewalls
- Support for multi-tenancy
- Multi-administrator support & RCS
- Zero-touch deployment
- Enterprise/MSP licensing
- Template & repository-based management
- REST API
High Availability
- Active-passive
- Transparent failover without session loss
- Encrypted HA communication
Self-Healing SD-WAN
- Drag & drop configuration
- Optimized direct internet uplink selection
- Internet uplink optimization (forward error correction)
- Simultaneous use of multiple uplinks (transports) per SD-WAN connection
- FIPS 140-2 certified cryptography
- On-demand direct connection creation between remote spoke locations based on application type
- Dynamic bandwidth detection
- Performance-based transport selection
- Application-aware traffic routing
- Adaptive session balancing across multiple uplinks
- Application-based provider selection
- Traffic shaping and QoS
- Built-in data deduplication
Barracuda Energize Updates
- Standard technical support
- Firmware updates
- IPS signature updates
- Application control definition updates
- Web filter updates
- Barracuda CloudGen Access support
Instant Replacement Service
- Replacement unit shipped next business day
- 24/7 technical support
- Free hardware refresh every four years
Barracuda Firewall Insights
Consolidates security, application flow, and connectivity information from hundreds or even thousands of firewalls on the extended wide area network – regardless of whether they are hardware, virtual, or cross-cloudbased deployments.
Malware Protection
Provides gateway-based protection against malware, viruses, spyware, and other unwanted programs inside SMTP/S, HTTP/S, and FTP/S traffic.
Advanced Threat Protection
Prevents from network breaches, identifies zero-day malware exploits, targeted attacks, advanced persistent threats and other advanced malware.
Advanced Remote Access
Provides a customizable and easy-touse browser-based remote access as well as sophisticated network access control (NAC) functionality and CudaLaunch support.
Documentation:
Download the Barracuda Networks CloudGen Firewall Overview (PDF)
Download the Barracuda Networks CloudGen Firewall Rugged Data Sheet (PDF)
Pricing Notes:
- Pricing and product availability subject to change without notice.