Blockbit

Datasheet

Blockbit Platform

Integrated cybersecurity, converging connectivity and security

  • Secure SD-WAN
  • Next-Generation Firewall

About Blockbit

Blockbit is the Brazilian leader in cybersecurity products, protecting thousands of companies and millions of users from digital attacks and threats. With cutting-edge technologies and an advanced intelligence lab, Blockbit develops proprietary solutions for network protection and secure connectivity with high quality and performance, always aligned with the leading global cybersecurity trends.

Section

Discover Blockbit Platform

The Blockbit Platform is perfectly aligned with the global trend of connectivity and security convergence, providing solid network protection and secure end-to-end connectivity.

Our platform is composed of Blockbit Secure SD-WAN and Blockbit NGFW (Next-Generation Firewall), both complemented by Blockbit GSM (Global Security Management) for centralized and simplified management of multiple devices. Additionally, Blockbit Cloud Threat Intelligence constantly provides advanced intelligence to the products.

The Blockbit Platform unites in a single solution the innovative products essential to accelerate your business securely, ensuring the desired quality and performance.

Blockbit Platform diagram
Section

Deployment Options

Blockbit Platform deployment options
Section

With Blockbit, it's easy to be secure

The Blockbit Platform offers an advanced, robust solution with innovative features that reduce your operational time through automated configuration, centralized management, and intuitive processes. As a result, you have more time to focus on what truly matters: your business.

Whether improving security, optimizing performance, or saving time, Blockbit is here to simplify the path toward a more secure and efficient digital environment.

Simplify your network by unifying connectivity and security

Our platform drastically simplifies network complexity by seamlessly integrating connectivity and security, being able to detect encapsulated applications and validate whether traffic complies with protocol specifications. With Blockbit, you reduce operational and administrative overhead, ensuring a consistent and robust security posture across your entire infrastructure.

Automatically configure your devices

With automatic configuration features, device deployment becomes more efficient than ever. There is no need to waste time installing our devices; Blockbit took care of that for you. Centralize configurations and distribute them automatically to remote assets. With the ZTP (Zero-Touch Provisioning) feature, you can reduce deployment time and costs.

Manage all Blockbit devices from one place

Blockbit enables you to manage all your devices and security events from a single centralized location. This eliminates the complexity of handling multiple interfaces and optimizes workflow, saving time while enabling rapid actions and informed decisions.

Save time with a user-friendly and intuitive interface

The Blockbit Platform was designed with a user-friendly and intuitive user interface, significantly reducing the time required for managing and configuring security devices. This puts control in your hands without the need for an extensive learning curve, allowing you to perform your tasks faster.

Get higher quality and performance at an affordable price

By combining cutting-edge technology with performance optimization approaches, Blockbit ensures that your cybersecurity does not compromise your network's speed and efficiency. All of this is offered at an affordable price, ensuring that quality is within reach of all businesses.

Section

Secure SD-WAN

The Blockbit Secure SD-WAN is a powerful combination of SD-WAN with all of Blockbit's advanced cybersecurity features. With it, you solve your primary challenges in both connectivity and security. Now you can enhance the quality of service of your connections, adopt lower-cost link solutions, and protect your environment, while reducing acquisition and operational costs by having a single solution, unifying and minimizing continuity risks and conflicts through a single point of control.

Monitoring of multiple links for long-distance connection, supporting connection types such as: ADSL/DSL, Cable Modem with Ethernet or fiber, LT/3G/4G/5G, MPLS, radio link, satellite link, among others.

Section

Next-Generation Firewall

Blockbit NGFW (Next-Generation Firewall) is the evolution of conventional firewalls, offering advanced capabilities for protection against attacks and threats, and going beyond network protection to also safeguard applications and users. With this solution, you can analyze application traffic in real time, enabling more granular and efficient security policies. It can be deployed as a gateway (L2) or inline (L3), optimized for layer 7 application content analysis, providing greater control and visibility over your environment and business.

With Blockbit NGFW, you have at your disposal the most advanced tool to face digital security challenges and protect your data, users, and systems from threats and attacks.

Blockbit SD-WAN and Blockbit NGFW capabilities comparison
Section

Blockbit Secure SD-WAN

Ensure the quality of service of connections and applications, with advanced security

Blockbit Secure SD-WAN is a comprehensive, next-generation solution for the control, advanced security, and centralized management of all WAN connections. With a modern, scalable architecture featuring innovative capabilities, you can simplify and enhance your organization's network, delivering greater efficiency and reliability. As a result, you have the flexibility to choose the best connectivity options for your business, allowing you to reduce infrastructure costs.

With Blockbit, integrating and managing multiple network connections becomes a reality, regardless of vendor, technology, or connection type. For example, using features such as WAN Aggregation & Link Failover, you can aggregate links from multiple providers and establish a contingency plan for situations where any of them fails. This functionality ensures greater redundancy and availability for your network, preventing unwanted disruptions.

Discover the main modules of Blockbit Secure SD-WAN:

Application-Aware Routing (AAR)

Prioritizes and optimizes critical application traffic to guarantee performance and increase your business resilience.

Dynamic Path Selection (DPS)

Allows automatically defining the best route for application traffic based on quality of service requirements, business policy, and network conditions.

WAN Optimization

Accelerates application delivery, reducing latency time, as well as improving bandwidth efficiency and reducing transmitted packet size.

WAN Aggregation

Combines multiple connections into a single logical route, increasing bandwidth, availability, reliability, quality, and performance of your connection.

Link Failover

Provides network resilience in case of failure of one or more connections, detecting connection failure and automatically redirecting traffic to a secondary connection.

Virtual Private Network (VPN)

Enables secure and private communication between branch offices and employees, allowing remote access to internal information, systems, and resources.

WAN Edge Security

Integrates all advanced security features into a single solution, adding ATP, IPS, and SWG modules, protecting your network and connection from attacks and external and internal threats.

Global Security Management (GSM)

Define configuration templates for centralized management (Manager) of multiple security devices and consolidate traffic logs and events (Analyzer).

Zero-Touch Provisioning (ZTP)

Simplifies Blockbit Secure SD-WAN deployment, enabling remote configuration and automated device installation.

Multi-Factor Authentication (MFA)

Offers a second authentication factor to validate your users' authentications, ensuring greater security for accessing Blockbit resources.

Section

Blockbit Next-Generation Firewall

Protect your business with the best next-generation firewall

Blockbit NGFW is a next-generation, high-performance enterprise firewall that incorporates advanced controls and protections for users, applications, and networks into a single solution.

The solution incorporates deep packet inspection (DPI), application control, advanced threat protection (ATP), intrusion prevention system (IPS), web content filtering (SWG), secure remote connection (VPN), centralized management and event consolidation (GSM), and much more. Thanks to the encrypted traffic inspection capability—which today represents the vast majority of traffic—the solution enables the control and blocking of threats and attacks that use encryption to conceal themselves.

Discover the main Blockbit NGFW modules:

Deep Packet Inspection (DPI)

Offers deep packet inspection capabilities for both clear and encrypted traffic, allowing the identification and blocking of malicious activities, specific applications, network protocols, data types, and even hidden threats.

Application Control

Allows controlling and managing the use of applications and services, automatically identifying thousands of applications, controlling usage and prioritizing bandwidth, and generating analytical information on application usage.

Advanced Threat and Malware Protection (ATP)

Detects and blocks cyber threats using advanced Inline Sandbox capabilities, utilizing artificial intelligence and machine learning to protect the environment from advanced threats and malware, including ransomware.

Cloud Sandbox

Integrated with the ATP module, it offers an additional layer for advanced protection against unknown threats by emulating and executing suspicious files in Blockbit's proprietary cloud.

Intrusion Prevention System (IPS)

Creates incident log records and elevates your visibility, actively identifying and blocking malicious traffic attempting to exploit vulnerabilities in applications and services on your network.

Secure Web Gateway (SWG)

Manage your users' access to web resources, preventing risky or unproductive behavior within your company or remotely.

DNS Content Filter

Enables the definition of internet access policies in a more granular and specific manner, ensuring greater security and control over browsing.

Virtual Domains (VDOM)

Allows segmenting Blockbit into multiple virtual domains, with independent administrations, to control and protect multiple networks with a single device.

Zero Trust Network Access (ZTNA)

Integrated with the VPN module, it provides granular access based on multiple security factors and only to the specific resources required by users.

Global Security Management (GSM)

Defines configuration templates for centralized management (Manager) of multiple security devices and consolidates traffic logs and events (Analyzer).

Zero-Touch Provisioning (ZTP)

The ZTP feature simplifies Blockbit NGFW deployment, allowing remote configuration and automated device installation.

Multi-Factor Authentication (MFA)

Offers a second authentication factor to validate your users' authentications, ensuring greater security for accessing Blockbit resources.

Section

Blockbit Appliances

Performance and Optional Specifications

BBX50

Blockbit BBX50 appliance — front and rear views
BBX50 — Blockbit Appliances
Firewall Throughput (UDP)7.2 Gbps
Concurrent Connections6.000.000
New Connections Per Second40.000
NGFW Throughput (IMIX)510 Mbps
SSL Inspection Throughput420 Mbps
IPS Throughput810 Mbps
Application Control Throughput *920 Mbps
Threat Protection Throughput510 Mbps
IPSEC VPN Throughput (AES-256 + SHA256)1.1 Gbps
SSL VPN Throughput (AES-256)500 Mbps
Form FactorDesktop
1 GbE RJ45 Interfaces4
2.5 GbE RJ45 Interfaces*
1 GbE Fiber Interfaces*
10 GbE Fiber Interfaces*
25 GbE Fiber Interfaces*
40 GbE Fiber Interfaces*
100 GbE Fiber Interfaces*
Local Storage64 GB
Redundant PSUs*
Optional
LTE 3G/4GYES (up to 2 modems)
5G*
Wi-FiYES
Local Storage120 GB or 240 GB

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX50HW (Hardware), BBX50SW (Software), BBX50-SBX-XX (Subscription), BBX50-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX80

Blockbit BBX80 appliance — front and rear views
BBX80 — Blockbit Appliances
Firewall Throughput (UDP)10 Gbps
Concurrent Connections6.000.000
New Connections Per Second45.000
NGFW Throughput (IMIX)850 Mbps
SSL Inspection Throughput700 Mbps
IPS Throughput1.3 Gbps
Application Control Throughput *1.3 Gbps
Threat Protection Throughput700 Mbps
IPSEC VPN Throughput (AES-256 + SHA256)2.0 Gbps
SSL VPN Throughput (AES-256)1.2 Gbps
Form FactorDesktop
1 GbE RJ45 Interfaces*
2.5 GbE RJ45 Interfaces4
1 GbE Fiber Interfaces*
10 GbE Fiber Interfaces*
25 GbE Fiber Interfaces*
40 GbE Fiber Interfaces*
100 GbE Fiber Interfaces*
Local Storage64 GB
Redundant PSUs*
Optional
LTE 3G/4GYES (up to 2 modems)
5G*
Wi-FiYES
Local Storage120 GB or 240 GB

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX80HW (Hardware), BBX80SW (Software), BBX80-SBX-XX (Subscription), BBX80-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX90

Blockbit BBX90 appliance — front and rear views
BBX90 — Blockbit Appliances
Firewall Throughput (UDP)15 Gbps
Concurrent Connections7.500.000
New Connections Per Second60.000
NGFW Throughput (IMIX)1.4 Gbps
SSL Inspection Throughput1.3 Gbps
IPS Throughput2.8 Gbps
Application Control Throughput *2.2 Gbps
Threat Protection Throughput1.5 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)4.0 Gbps
SSL VPN Throughput (AES-256)1.8 Gbps
Form FactorDesktop / 1U Rack 19"
1 GbE RJ45 Interfaces*
2.5 GbE RJ45 Interfaces6
1 GbE Fiber Interfaces*
10 GbE Fiber Interfaces*
25 GbE Fiber Interfaces*
40 GbE Fiber Interfaces*
100 GbE Fiber Interfaces*
Local Storage64 GB
Redundant PSUs*
Optional
LTE 3G/4GYES (up to 2 modems)
5GYES
Wi-Fi*
Local Storage120 GB or 240 GB

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX90HW (Hardware), BBX90SW (Software), BBX90-SBX-XX (Subscription), BBX90-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX180

Blockbit BBX180 appliance — front and rear views
BBX180 — Blockbit Appliances
Firewall Throughput (UDP)15 Gbps
Concurrent Connections12.000.000
New Connections Per Second100.000
NGFW Throughput (IMIX)1.6 Gbps
SSL Inspection Throughput1.4 Gbps
IPS Throughput3.0 Gbps
Application Control Throughput *3.0 Gbps
Threat Protection Throughput1.8 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)4.2 Gbps
SSL VPN Throughput (AES-256)2.7 Gbps
Form FactorDesktop / 1U Rack 19"
1 GbE RJ45 Interfaces*
2.5 GbE RJ45 Interfaces6
1 GbE Fiber Interfaces*
10 GbE Fiber Interfaces*
25 GbE Fiber Interfaces*
40 GbE Fiber Interfaces*
100 GbE Fiber Interfaces*
Local Storage64 GB
Redundant PSUs*
Optional
LTE 3G/4GYES (up to 2 modems)
5GYES
Wi-Fi*
Local Storage120 GB or 240 GB

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX180HW (Hardware), BBX180SW (Software), BBX180-SBX-XX (Subscription), BBX180-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX200

Blockbit BBX200 appliance — front and rear views
BBX200 — Blockbit Appliances
Firewall Throughput (UDP)20 Gbps
Concurrent Connections8.200.000
New Connections Per Second90.000
NGFW Throughput (IMIX)2.5 Gbps
SSL Inspection Throughput2.0 Gbps
IPS Throughput3.0 Gbps
Application Control Throughput *3.0 Gbps
Threat Protection Throughput2.0 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)4.3 Gbps
SSL VPN Throughput (AES-256)2.0 Gbps
Form Factor1U 19" Rack
1 GbE RJ45 Interfaces6 - 8 - 10 (Optional)
2.5 GbE RJ45 Interfaces*
1 GbE Fiber Interfaces2 - 4 (Optional)
10 GbE Fiber Interfaces2 - 4 (Optional)
25 GbE Fiber Interfaces*
40 GbE Fiber Interfaces*
100 GbE Fiber Interfaces*
Local Storage120 GB
Redundant PSUs*
Optional
LTE 3G/4G*
5G*
Wi-Fi*
Local Storage240 GB

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX200HW (Hardware), BBX200SW (Software), BBX200-SBX-XX (Subscription), BBX200-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX500

Blockbit BBX500 appliance — front and rear views
BBX500 — Blockbit Appliances
Firewall Throughput (UDP)30 Gbps
Concurrent Connections16.000.000
New Connections Per Second105.000
NGFW Throughput (IMIX)3.0 Gbps
SSL Inspection Throughput2.3 Gbps
IPS Throughput5.1 Gbps
Application Control Throughput *5.0 Gbps
Threat Protection Throughput2.5 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)5.0 Gbps
SSL VPN Throughput (AES-256)2.0 Gbps
Form Factor1U 19" Rack
1 GbE RJ45 Interfaces8
2.5 GbE RJ45 Interfaces*
1 GbE Fiber Interfaces4 (Optional)
10 GbE Fiber Interfaces4 (Optional)
25 GbE Fiber Interfaces*
40 GbE Fiber Interfaces*
100 GbE Fiber Interfaces*
Local Storage240 GB
Redundant PSUs*
Optional
LTE 3G/4G*
5G*
Wi-Fi*
Local Storage480 GB

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX500HW (Hardware), BBX500SW (Software), BBX500-SBX-XX (Subscription), BBX500-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX700

Blockbit BBX700 appliance — front and rear views
BBX700 — Blockbit Appliances
Firewall Throughput (UDP)35 Gbps
Concurrent Connections20.000.000
New Connections Per Second120.000
NGFW Throughput (IMIX)3.6 Gbps
SSL Inspection Throughput2.5 Gbps
IPS Throughput6.0 Gbps
Application Control Throughput *6.0 Gbps
Threat Protection Throughput2.5 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)6.0 Gbps
SSL VPN Throughput (AES-256)2.0 Gbps
Form Factor1U 19" Rack
1 GbE RJ45 Interfaces8
2.5 GbE RJ45 Interfaces*
1 GbE Fiber Interfaces4 (Optional)
10 GbE Fiber Interfaces4 (Optional)
25 GbE Fiber Interfaces*
40 GbE Fiber Interfaces*
100 GbE Fiber Interfaces*
Local Storage240 GB
Redundant PSUs*
Optional
LTE 3G/4G*
5G*
Wi-Fi*
Local Storage480 GB

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX700HW (Hardware), BBX700SW (Software), BBX700-SBX-XX (Subscription), BBX700-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX900

Blockbit BBX900 appliance — front and rear views
BBX900 — Blockbit Appliances
Firewall Throughput (UDP)40 Gbps
Concurrent Connections22.000.000
New Connections Per Second138.000
NGFW Throughput (IMIX)4.2 Gbps
SSL Inspection Throughput2.8 Gbps
IPS Throughput7.0 Gbps
Application Control Throughput *7.0 Gbps
Threat Protection Throughput3.0 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)6.8 Gbps
SSL VPN Throughput (AES-256)2.5 Gbps
Form Factor1U 19" Rack
1 GbE RJ45 Interfaces8 - 10 - 12 (Optional)
2.5 GbE RJ45 Interfaces*
1 GbE Fiber Interfaces2 - 4 (Optional)
10 GbE Fiber Interfaces2 - 4 (Optional)
25 GbE Fiber Interfaces*
40 GbE Fiber Interfaces*
100 GbE Fiber Interfaces*
Local Storage240 GB
Redundant PSUs*
Optional
LTE 3G/4G*
5G*
Wi-Fi*
Local Storage480 GB

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX900HW (Hardware), BBX900SW (Software), BBX900-SBX-XX (Subscription), BBX900-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX1200

Blockbit BBX1200 appliance — front and rear views
BBX1200 — Blockbit Appliances
Firewall Throughput (UDP)45 Gbps
Concurrent Connections23.000.000
New Connections Per Second180.000
NGFW Throughput (IMIX)5.6 Gbps
SSL Inspection Throughput4.0 Gbps
IPS Throughput10 Gbps
Application Control Throughput *9.5 Gbps
Threat Protection Throughput4.8 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)9.1 Gbps
SSL VPN Throughput (AES-256)3.8 Gbps
Form Factor1U 19" Rack
1 GbE RJ45 Interfaces8 - 10 - 12 (Optional)
2.5 GbE RJ45 Interfaces*
1 GbE Fiber Interfaces2 - 4 (Optional)
10 GbE Fiber Interfaces2 - 4 (Optional)
25 GbE Fiber Interfaces*
40 GbE Fiber Interfaces*
100 GbE Fiber Interfaces*
Local Storage240 GB
Redundant PSUsYES
Optional
LTE 3G/4G*
5G*
Wi-Fi*
Local Storage480 GB

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX1200HW (Hardware), BBX1200SW (Software), BBX1200-SBX-XX (Subscription), BBX1200-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX1500

Blockbit BBX1500 appliance — front and rear views
BBX1500 — Blockbit Appliances
Firewall Throughput (UDP)65 Gbps
Concurrent Connections25.000.000
New Connections Per Second200.000
NGFW Throughput (IMIX)6.5 Gbps
SSL Inspection Throughput5.5 Gbps
IPS Throughput12 Gbps
Application Control Throughput *10 Gbps
Threat Protection Throughput5.5 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)10 Gbps
SSL VPN Throughput (AES-256)5.0 Gbps
Form Factor1U 19" Rack
1 GbE RJ45 Interfaces8 - 20 (Optional)
2.5 GbE RJ45 Interfaces*
1 GbE Fiber Interfaces20 (Optional)
10 GbE Fiber Interfaces8 (Optional)
25 GbE Fiber Interfaces4 (Optional)
40 GbE Fiber Interfaces4 (Optional)
100 GbE Fiber Interfaces*
Local Storage480 GB
Redundant, Hot-swap, load-sharing PSUsYES
Optional
LTE 3G/4G*
5G*
Wi-Fi*
Local Storage1 TB

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX1500HW (Hardware), BBX1500SW (Software), BBX1500-SBX-XX (Subscription), BBX1500-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX1800

Blockbit BBX1800 appliance — front and rear views
BBX1800 — Blockbit Appliances
Firewall Throughput (UDP)90 Gbps
Concurrent Connections25.000.000
New Connections Per Second250.000
NGFW Throughput (IMIX)12 Gbps
SSL Inspection Throughput8.0 Gbps
IPS Throughput15 Gbps
Application Control Throughput *13 Gbps
Threat Protection Throughput8.0 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)20 Gbps
SSL VPN Throughput (AES-256)10 Gbps
Form Factor1U Rack 19"
1 GbE RJ45 Interfaces*
2.5 GbE RJ45 Interfaces8 - 16 (Optional)
1 GbE Fiber Interfaces2 - 6 - 10 (Optional)
10 GbE Fiber Interfaces2 - 6 - 10 (Optional)
25 GbE Fiber Interfaces2 (Optional)
40 GbE Fiber Interfaces2 (Optional)
100 GbE Fiber Interfaces2 (Optional)
Local Storage480 GB
Redundant, Hot-swap, load-sharing PSUsYES
Optional
LTE 3G/4G*
5G*
Wi-Fi*
Local Storage1 TB

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX1800HW (Hardware), BBX1800SW (Software), BBX1800-SBX-XX (Subscription), BBX1800-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX3000

Blockbit BBX3000 appliance — front and rear views
BBX3000 — Blockbit Appliances
Firewall Throughput (UDP)240 Gbps
Concurrent Connections30.000.000
New Connections Per Second300.000
NGFW Throughput (IMIX)13 Gbps
SSL Inspection Throughput10 Gbps
IPS Throughput15 Gbps
Application Control Throughput *15 Gbps
Threat Protection Throughput10 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)55 Gbps
SSL VPN Throughput (AES-256)8.0 Gbps
Form Factor2U 19" Rack
1 GbE RJ45 Interfaces8 - 64 (Optional)
2.5 GbE RJ45 Interfaces8 - 64 (Optional)
1 GbE Fiber Interfaces32 (Optional)
10 GbE Fiber Interfaces32 (Optional)
25 GbE Fiber Interfaces24 (Optional)
40 GbE Fiber Interfaces8 (Optional)
100 GbE Fiber Interfaces8 (Optional)
Local Storage1 TB
Redundant, Hot-swap, load-sharing PSUsYES
Optional
LTE 3G/4G*
5G*
Wi-Fi*
Local Storage2x 1 TB RAID 0,1 or 2 TB
BMC/IPMIYES

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX3000HW (Hardware), BBX3000SW (Software), BBX3000-SBX-XX (Subscription), BBX3000-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX3200

Blockbit BBX3200 appliance — front and rear views
BBX3200 — Blockbit Appliances
Firewall Throughput (UDP)300 Gbps
Concurrent Connections30.000.000
New Connections Per Second375.000
NGFW Throughput (IMIX)16 Gbps
SSL Inspection Throughput12.5 Gbps
IPS Throughput18.5 Gbps
Application Control Throughput *18.5 Gbps
Threat Protection Throughput12.5 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)68 Gbps
SSL VPN Throughput (AES-256)10 Gbps
Form Factor2U Rack 19"
1 GbE RJ45 Interfaces8 - 64 (Optional)
2.5 GbE RJ45 Interfaces8 - 64 (Optional)
1 GbE Fiber Interfaces8 - 64 (Optional)
10 GbE Fiber Interfaces32 (Optional)
25 GbE Fiber Interfaces24 (Optional)
40 GbE Fiber Interfaces8 (Optional)
100 GbE Fiber Interfaces8 (Optional)
Local Storage1 TB
Redundant, Hot-swap, load-sharing PSUsYES
Optional
LTE 3G/4G*
5G*
Wi-Fi*
Local Storage2x 1 TB RAID 0,1 or 2 TB
BMC/IPMI(Optional)

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX3200HW (Hardware), BBX3200SW (Software), BBX3200-SBX-XX (Subscription), BBX3200-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX3600

Blockbit BBX3600 appliance — front and rear views
BBX3600 — Blockbit Appliances
Firewall Throughput (UDP)240 Gbps
Concurrent Connections45.000.000
New Connections Per Second400.000
NGFW Throughput (IMIX)20 Gbps
SSL Inspection Throughput12 Gbps
IPS Throughput18 Gbps
Application Control Throughput *18 Gbps
Threat Protection Throughput12 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)55 Gbps
SSL VPN Throughput (AES-256)10 Gbps
Form Factor2U 19" Rack
1 GbE RJ45 Interfaces8 - 64 (Optional)
2.5 GbE RJ45 Interfaces8 - 64 (Optional)
1 GbE Fiber Interfaces32 (Optional)
10 GbE Fiber Interfaces32 (Optional)
25 GbE Fiber Interfaces24 (Optional)
40 GbE Fiber Interfaces8 (Optional)
100 GbE Fiber Interfaces8 (Optional)
Local Storage1 TB
Redundant, Hot-swap, load-sharing PSUsYES
Optional
LTE 3G/4G*
5G*
Wi-Fi*
Local Storage2x 1 TB RAID 0,1 or 2 TB
BMC/IPMIYES

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX3600HW (Hardware), BBX3600SW (Software), BBX3600-SBX-XX (Subscription), BBX3600-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX3800

Blockbit BBX3800 appliance — front and rear views
BBX3800 — Blockbit Appliances
Firewall Throughput (UDP)300 Gbps
Concurrent Connections45.000.000
New Connections Per Second500.000
NGFW Throughput (IMIX)25 Gbps
SSL Inspection Throughput15 Gbps
IPS Throughput22.5 Gbps
Application Control Throughput *22.5 Gbps
Threat Protection Throughput15 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)68 Gbps
SSL VPN Throughput (AES-256)12.5 Gbps
Form Factor2U Rack 19"
1 GbE RJ45 Interfaces8 - 64 (Optional)
2.5 GbE RJ45 Interfaces8 - 64 (Optional)
1 GbE Fiber Interfaces8 - 64 (Optional)
10 GbE Fiber Interfaces32 (Optional)
25 GbE Fiber Interfaces24 (Optional)
40 GbE Fiber Interfaces8 (Optional)
100 GbE Fiber Interfaces8 (Optional)
Local Storage1 TB
Redundant, Hot-swap, load-sharing PSUsYES
Optional
LTE 3G/4G*
5G*
Wi-Fi*
Local Storage2x 1 TB RAID 0,1 or 2 TB
BMC/IPMI(Optional)

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX3800HW (Hardware), BBX3800SW (Software), BBX3800-SBX-XX (Subscription), BBX3800-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX4200

Blockbit BBX4200 appliance — front and rear views
BBX4200 — Blockbit Appliances
Firewall Throughput (UDP)240 Gbps
Concurrent Connections55.000.000
New Connections Per Second520.000
NGFW Throughput (IMIX)26 Gbps
SSL Inspection Throughput14 Gbps
IPS Throughput23 Gbps
Application Control Throughput *25 Gbps
Threat Protection Throughput14 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)55 Gbps
SSL VPN Throughput (AES-256)12 Gbps
Form Factor2U 19" Rack
1 GbE RJ45 Interfaces8 - 64 (Optional)
2.5 GbE RJ45 Interfaces8 - 64 (Optional)
1 GbE Fiber Interfaces32 (Optional)
10 GbE Fiber Interfaces32 (Optional)
25 GbE Fiber Interfaces24 (Optional)
40 GbE Fiber Interfaces8 (Optional)
100 GbE Fiber Interfaces8 (Optional)
Local Storage1 TB
Redundant, Hot-swap, load-sharing PSUsYES
Optional
LTE 3G/4G*
5G*
Wi-Fi*
Local Storage2x 1 TB RAID 0,1 or 2 TB
BMC/IPMIYES

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX4200HW (Hardware), BBX4200SW (Software), BBX4200-SBX-XX (Subscription), BBX4200-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX4400

Blockbit BBX4400 appliance — front and rear views
BBX4400 — Blockbit Appliances
Firewall Throughput (UDP)300 Gbps
Concurrent Connections55.000.000
New Connections Per Second650.000
NGFW Throughput (IMIX)32 Gbps
SSL Inspection Throughput17.5 Gbps
IPS Throughput28.5 Gbps
Application Control Throughput *31 Gbps
Threat Protection Throughput17.5 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)68 Gbps
SSL VPN Throughput (AES-256)15 Gbps
Form Factor2U Rack 19"
1 GbE RJ45 Interfaces8 - 64 (Optional)
2.5 GbE RJ45 Interfaces8 - 64 (Optional)
1 GbE Fiber Interfaces8 - 64 (Optional)
10 GbE Fiber Interfaces32 (Optional)
25 GbE Fiber Interfaces24 (Optional)
40 GbE Fiber Interfaces8 (Optional)
100 GbE Fiber Interfaces8 (Optional)
Local Storage1 TB
Redundant, Hot-swap, load-sharing PSUsYES
Optional
LTE 3G/4G*
5G*
Wi-Fi*
Local Storage2x 1 TB RAID 0,1 or 2 TB
BMC/IPMI(Optional)

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX4400HW (Hardware), BBX4400SW (Software), BBX4400-SBX-XX (Subscription), BBX4400-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX5000

Blockbit BBX5000 appliance — front and rear views
BBX5000 — Blockbit Appliances
Firewall Throughput (UDP)240 Gbps
Concurrent Connections70.000.000
New Connections Per Second900.000
NGFW Throughput (IMIX)45 Gbps
SSL Inspection Throughput20 Gbps
IPS Throughput32 Gbps
Application Control Throughput *35 Gbps
Threat Protection Throughput20 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)55 Gbps
SSL VPN Throughput (AES-256)16 Gbps
Form Factor2U 19" Rack
1 GbE RJ45 Interfaces8 - 64 (Optional)
2.5 GbE RJ45 Interfaces8 - 64 (Optional)
1 GbE Fiber Interfaces32 (Optional)
10 GbE Fiber Interfaces32 (Optional)
25 GbE Fiber Interfaces24 (Optional)
40 GbE Fiber Interfaces8 (Optional)
100 GbE Fiber Interfaces8 (Optional)
Local Storage1 TB
Redundant, Hot-swap, load-sharing PSUsYES
Optional
LTE 3G/4G*
5G*
Wi-Fi*
Local Storage2x 1 TB RAID 0,1 or 2 TB
BMC/IPMIYES

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX5000HW (Hardware), BBX5000SW (Software), BBX5000-SBX-XX (Subscription), BBX5000-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX5200

Blockbit BBX5200 appliance — front and rear views
BBX5200 — Blockbit Appliances
Firewall Throughput (UDP)300 Gbps
Concurrent Connections70.000.000
New Connections Per Second1.125.000
NGFW Throughput (IMIX)56 Gbps
SSL Inspection Throughput25 Gbps
IPS Throughput40 Gbps
Application Control Throughput *43.5 Gbps
Threat Protection Throughput25 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)68 Gbps
SSL VPN Throughput (AES-256)20 Gbps
Form Factor2U 19" Rack
1 GbE RJ45 Interfaces8 - 64 (Optional)
2.5 GbE RJ45 Interfaces8 - 64 (Optional)
1 GbE Fiber Interfaces32 (Optional)
10 GbE Fiber Interfaces32 (Optional)
25 GbE Fiber Interfaces24 (Optional)
40 GbE Fiber Interfaces8 (Optional)
100 GbE Fiber Interfaces8 (Optional)
Local Storage1 TB
Redundant, Hot-swap, load-sharing PSUsYES
Optional
LTE 3G/4G*
5G*
Wi-Fi*
Local Storage2x 1 TB RAID 0,1 or 2 TB
BMC/IPMIYES

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX5200HW (Hardware), BBX5200SW (Software), BBX5200-SBX-XX (Subscription), BBX5200-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

BBX6200

Blockbit BBX6200 appliance — front and rear views
BBX6200 — Blockbit Appliances
Firewall Throughput (UDP)350 Gbps
Concurrent Connections100.000.000
New Connections Per Second2.000.000
NGFW Throughput (IMIX)90 Gbps
SSL Inspection Throughput55 Gbps
IPS Throughput65 Gbps
Application Control Throughput *70 Gbps
Threat Protection Throughput42 Gbps
IPSEC VPN Throughput (AES-256 + SHA256)140 Gbps
SSL VPN Throughput (AES-256)32 Gbps
Form Factor2U 19" Rack
1 GbE RJ45 Interfaces8 - 64 (Optional)
2.5 GbE RJ45 Interfaces8 - 64 (Optional)
1 GbE Fiber Interfaces32 (Optional)
10 GbE Fiber Interfaces32 (Optional)
25 GbE Fiber Interfaces24 (Optional)
40 GbE Fiber Interfaces8 (Optional)
100 GbE Fiber Interfaces8 (Optional)
Local Storage1 TB
Redundant, Hot-swap, load-sharing PSUsYES
Optional
LTE 3G/4G*
5G*
Wi-Fi*
Local Storage2x 1 TB RAID 0,1 or 2 TB
BMC/IPMIYES

* Application Control performance uses the proxy-based methodology (proxy based).

The main Part Numbers related to this product belong to the following families: BBX6200HW (Hardware), BBX6200SW (Software), BBX6200-SBX-XX (Subscription), BBX6200-MDX (Accessories), BBXGSM-SVX-XX (Global Security Management), among others.

* Application Control performance uses the proxy-based methodology (proxy based).

Photos for illustrative purposes only.

Section

Deployment Options

Hardware Appliance

  • Maximum performance
  • Guaranteed stability
  • Quick installation
  • LED indicators for interface and power supplies

Virtual Appliance

  • Greater scalability
  • Faster disaster recovery
  • Infrastructure optimization

Cloud Instance

  • AWS, Oracle, Azure, Google and IBM
Section

Virtual Appliance model specifications

Virtual Appliance model specifications
DescriptionOverall Throughput (UDP)NGFW Throughput (IMIX)
BBX507.2 Gbps510 Mbps
BBX8010 Gbps850 Mbps
BBX9015 Gbps1.4 Gbps
BBX18015 Gbps1.6 Gbps
BBX20020 Gbps2.5 Gbps
BBX50030 Gbps3.0 Gbps
BBX70035 Gbps3.6 Gbps
BBX90040 Gbps4.2 Gbps
BBX120045 Gbps5.6 Gbps
BBX150065 Gbps6.5 Gbps
BBX180090 Gbps12 Gbps
BBX3000240 Gbps13 Gbps
BBX3200300 Gbps16 Gbps
BBX3600240 Gbps20 Gbps
BBX3800300 Gbps25 Gbps
BBX4200240 Gbps26 Gbps
BBX4400300 Gbps32 Gbps
BBX5000240 Gbps45 Gbps
BBX5200300 Gbps56 Gbps
BBX6200350 Gbps90 Gbps
Blockbit appliance family
Section

Technical description

Security Policies

  • Supports IPv4 and IPv6.
  • Source/Destination IP, Port, and Protocol.
  • Source/Destination Subnet.
  • By users, groups, IPs, networks and Zone (LAN, WAN, DMZ) and country code (BR, EUA, etc.).
  • Application control, name, type, risk, by static and dynamic groups.
  • Application control with Smart Profiles.
  • Filtering:
    • Web content, Web Applications.
  • Inspection Profiles: SSL, IPS, Threat Protection, Web Filter, and Application Control (implemented in a single policy, and changing an engine does not impact others).
  • QoS (bandwidth control/prioritization).
  • Multiple services.
  • Security rule editor (filtering policies) with scheduling capability.
  • Enable and disable logs.
  • Action types: allow, deny, and reject.
  • Creation of policies by users or groups based on authentication for all services (Firewall, VPN, IPS, Sandbox, Application Control, and others).
  • Traffic simulator, policy locator, and validator.
  • Conflicting Policy Detector in NGFW and GSM.
  • File blocking by extension and allows accurate file identification by its MIME type, even when its extension is renamed.
  • Allows monitoring internet traffic without blocking user access.

Firewall

  • Policy with authentication option and the ability to enable or disable logging.
  • NAT (SNAT and DNAT), 1:1, N:1, NAT64, NAT46, NAT44, and NAT66, PAT, Source NAT, and Destination NAT and simultaneously.
  • Dynamic NAT (Many-to-Many and Many-to-1).
  • Static NAT (1:1 and Many-to-Many) and bidirectional 1:1.
  • NAT 444 (CGNAT).
  • Security:
    • DoS (Denial of Service) protection available in global mode and per security policy, PortScan, invalid packets, ICMP Sweep, and Brute Force.
    • Flood Protection (SYN, ICMP, UDP).
    • Anti-spoofing protection through RPF (Reverse Path Forwarding) verification.
    • ICMP (controls, transmission, redirection).
    • PING (Echo/Request).
    • Multicast forwarding.
    • Invalid Source routing, Checksum, Log.
    • Flow Control for Dynamic applications.
    • Protocol traffic blocking on custom ports.
    • Supports multicast objects and rules.
    • TCP_be_liberal.
    • IP spoofing.
    • Protection against Man-in-the -Middle attacks.
    • TCP/UDP/ICMP/IP connection controls.
  • Supports transparent mode (layer 2), gateway mode (layer 3), and port mirroring, including mixed mode, with layer 2 and layer 3 interfaces configured simultaneously on different physical interfaces.
  • Supports real-time protocols.
  • Supports GPO (SCCM) distribution via Microsoft AD of the VPN client.
  • Allows internet access control by domain, for example: gov.br, org.br, edu.br.
  • Queries the integrated RADIUS server (NAS); if authorized, the IP address is delivered.
  • Allows limiting the maximum number of packets per second on the firewall, preventing distributed attacks or traffic anomalies caused by potential malware on the network.
  • Features Stateful Inspection firewall technology.

QoS - Quality of Service

  • Packet marking for traffic prioritization (TOS and DSCP).
  • Priority Queue from Lowest Priority to Highest Priority.
  • Traffic control and bandwidth guarantee per policy (applications, users, or user groups synchronized with Windows AD or LDAP), network zone, specific host, or source/destination.
  • Real-time statistics for QoS classes in the WEB Management Interface.
  • Supports QoS for LAG interfaces.
  • Supports packet transmission without modification, with DSCP value remarking and packet dropping for traffic exceeding the specified bandwidth.
  • Allows modification of DSCP values.
  • Allows individually limiting the bandwidth used by P2P file-sharing programs.
  • Allows defining QoS policies using up to 100% of the available bandwidth.
  • Hierarchical queues (HTB) based on DiffServ (RFCs 2474, 2475, 2597, and 3260).

Web Cache and Proxy

  • Transparent or Explicit Proxy (custom ports).
  • Support for web services (HTTP and HTTPS versions 1.0, 1.1, 2.0, FTP, POP3, and SMTP).
  • Disk and Memory Cache size configuration.
  • Web cache configuration in memory and disk.
  • Enabling web caching of dynamic content (Facebook, Google Maps, MSN Video, Source forge Downloads, Windows Update, YouTube).
  • Cache exception, configurable by regular expressions.
  • Proxy hierarchy with and without authentication.
  • Support for HTTP Antivirus integration through proxy hierarchy.
  • Block message for the end user.
  • Supports policies by time, schedule, and/or period (day, month, year, day of the week, and hour). Supports user groups, IPs, networks, and/or security zones.
  • Enables integration with external web cache servers.
  • Features the ability to exclude specific URLs from the web cache, configurable via a keyword list with support for regular expressions.
  • Allows configuring the Explicit Proxy port.

IPS - Intrusion Prevention System

  • Detection and prevention of attacks and intrusions based on +100mil signatures grouped as Client (Applications) and Server (Servers).
  • Supports the creation and uploading of custom signatures compatible with the Snort format, enabling granular definition of flow parameters (session state and direction), services and ports, content patterns and regular expressions, and inspection offset and depth (length and depth) in the data stream.
  • Impact Levels: Low, Medium, and High.
  • Protection against application layer threats (known Exploits, Shellcode, SQL Injection, Buffer overflow, etc.).
  • Protection against malformed packets.
  • Pattern recognition, protocol and anomaly analysis, and vulnerability blocking.
  • Packet reassembly capability after analysis to identify attacks.
  • Source Session Limit with TCP Reset for session termination.
  • DoS, DDoS (Flood, Scan, Session, and Sweepe), PORTSCAN, Reconnaissance, Evasione, and ICMP prevention.
  • DoS and DDoS (denial of service) attack mitigation.
  • Prevention against P2P technology attacks.
  • Prevention against Worm, Trojan, Backdoor, Portscan (detects and blocks the source), IP Spoofing, SYN-ICMP-UDP flood, and Spyware attacks.
  • Prevention against protocol anomalies (HTTP, SMTP, POP, IMAP, Sendmail, NTP, NetBIOS, HTTPS, FTP, DNS, SMB, CIFS, RPC, RDP, CHARGEN, SSDP, SNMP, TCP highjacking, SSH, and Telnet).
  • Prevention against Botnet, DNS Poisoning, and Privilege Escalation.
  • SSH blocking on non-standard protocol ports and behavior-based through patterns.
  • Incident logging for each identified attack type.
  • Malformed traffic and invalid headers.
  • Automatic and periodic updates.
  • Decodes multiple Unicode formats.
  • IP fragmentation and defragmentation.
  • Policies applied to interfaces or security zone.
  • Alarm via email or SNMP trap.
  • Support for Inline implementation at L2 layer (bridge/transparent mode) and L3 layer (firewall) and port mirroring.
  • Supports exceptions by IP registered in the rules.
  • Whitelist and Blacklist creation by IP (IPv4 and IPv6).
  • Allows enabling or disabling signatures, or enabling them in monitoring mode.
  • Allows analyzing and generating logs, blocks and quarantines the attacker's IP for a period of time.
  • Allows using negation operators when creating custom IPS signatures, enabling the creation of exceptions with granularity in the configurations.
  • Logs the following information about identified threats in the monitoring console: signature or attack name, application, user, source, and destination of the communication, as well as the action taken by the device.
  • Appliance-based intrusion detection functionality.
  • Allows the number of packets to be captured by IPS signatures to be defined, or allows capturing the packet that triggered the alert along with its context, facilitating forensic analysis and false positive identification.
  • Features alarms in the administration console.
  • Active attack response/logging capability.
  • Smart IPS Profiles.
  • Cross-referencing with CVEs.
  • Detect and prevent DNS tunneling attacks.
  • Flow-based, stateful IPS engine with packet reassembly and continuous application stream analysis, allowing inspection of the entire session without predefined size limitations beyond available hardware resources.

Threat Protection

  • Antivirus and Anti-Malware with real-time analysis.
  • HTTP, HTTPS, FTP, SMB, CIFS, POP3, and SMTP (native to the solution).
  • Protection against unauthorized applications.
  • Protection against password-protected files.
  • Anti-Malware Quarantine.
  • Scanned files report.
  • Identifies, classifies, and blocks malware such as trojans, spyware, adware, keyloggers, hijackers, worms, viruses, C&C (Command and Control) connections, and Anti-bot (Botnet).
  • Allows blocking by address reputation classified into 6 categories: spam, reputation, malware, attacks, anonymous, and abuse.
  • Automatic and periodic updates.
  • Antibot features a multilayered detection mechanism, uses DNS, URL, and IP reputation to identify infected hosts making queries to malicious domains, and detects C&C patterns and botnet signatures.
  • Blocks files by extension and also identifies by MIME type (even if the extension is changed).
  • Flow-based inspection, detection, and prevention.
  • Specific actions for distinct malicious codes.

SD-WAN

  • Support for multiple configuration profiles, allowing enablement on any WAN interface (DSL, MPLS, 3G/4G LTE) and Packet Duplication (PD), aggregation with VPN capabilities, support for static and dynamic routing (OSPF, BGP), IPv4/IPv6, and support for dynamic and outbound NAT.
  • Definition of traffic forwarding via selected interface, supports Policy Based Routing.
  • Failover, Load Balance, Spillover and Performance.
  • Link availability monitoring and protection against data link degradation.
  • Supports link balancing by source and destination IP hash, by weight with percentage configuration, and can utilize 2 to 9 links.
  • Link failure verification via TCP/UDP Echo, ICMP (ping), and HTTP protocols.
  • Measurement by bandwidth consumption, packet loss, jitter, latency, MOS (Mean Opinion Score), monitoring of multiple destinations and on all interfaces, with more than 3 targets, with measurement values being configurable.
  • Application- and policy-based routing for multiple WAN paths, with app blocking.
  • Customizable link failback from 1 to 100 and Link persistence.
  • Implements link balancing without creating zones or using virtual instances.
  • Group-based routing in SD-WAN rules, traffic balancing per session and packets.
  • LTE (3G/4G) use as link load balance and failover.
  • Allows using IPsec VPN to interconnect remote units.
  • Adapts SD-WAN policies according to bandwidth.
  • Allows modification of the link check time, configured in seconds.
  • Allows traffic distribution based on the number of active connections or sessions per link.
  • Allows traffic balancing based on volume definition.
  • Allows traffic to be routed based on source and/or destination IP addresses.

Secure Web Gateway

  • The features below are appliance-based.
  • Content Filter (without NAT).
  • +88 categories (including Government, Webmail, Healthcare Institutions, News, Pornography, Restaurant, Social Media, Sports, Education, Games, Shopping), +52 million cataloged URLs, domain login control for Google, SafeSearch integration, Google, Bing, and Yahoo, and end-user block message.
  • SSL inspection with invalid certificate blocking.
  • Integration with ATP inspection and Windows AD / LDAP for user and group identification.
  • Blocking of Social Media Applications such as: Aol Instant Messenger, Badoo, BaiduHi, Airtime, Blogger, Bold Chat, ChatON, China.com, Facebook, Flickr, FC2, Fring, Google Analytics, Google App, LinkedIn, Meetup, Skype, Tinder, Tuenti, X (formerly Twitter), WhatsApp, WeChat, and ZohoChat, as well as Chat Applications.
  • Blocking of Office-type files, Java and Javascript, Cookies, ActiveX, Multimedia, Images.
  • Application Recognition – DPI (Deep Packet Inspection).
  • Identifies Applications through SSL, HTTP, HTTPS protocols or non-standard access ports.
  • Category-based SNI control.
  • Filtering, categorization, and reclassification of websites by URL.
  • User authentication in LDAP, LDAPS, Radius, TACACs+, SAML, Microsoft Active Directory, AzureAD, and Google Workspace directories.
  • Blocking through the construction of specific filters with a text search engine.
  • Custom lists (whitelist and blacklist).
  • Captive Portal with social login (Facebook, X (formerly Twitter), Google).
  • Browsing quotas by time and/or traffic volume.
  • Scheduled and Automatic Update in transparent mode.
  • Application recognition regardless of port and protocol.
  • Identifies the use of evasive tactics to control applications that attempt to use encrypted connections (Skype / TOR network).
  • Customizable block message.
  • Recognition of more than 8000 applications.
  • Has more than +24 categories for application classification.
  • Allows application traffic monitoring without blocking user access.
  • Regular product updates are performed without interrupting the execution of application control services and web content filtering services.
  • Features DNS Content Filter.
  • DNS Content Filter with integration into search engine SafeSearch (Google, Bing, and Yahoo).
  • Support for detection techniques for peer-to-peer file sharing and instant messaging programs, supporting: Yahoo! Messenger, MSN Messenger, ICQ, Telegram, WhatsApp, WeChat, Snapchat, BitTorrent, UTorrent, Vuze, eDonkey, GNUTella, Skype, and Microsoft Teams.
  • Enables differentiation of P2P traffic for various software (Bittorrent, emule, and others) with granular application control.
  • Enables differentiation of instant messaging traffic with granular application control.
  • Enables differentiation of Proxy applications with granular application control.
  • Allows allowing and blocking applications without the need to allow ports and protocol.
  • Allows port control to be applied to all applications.
  • Identifies applications through behavioral traffic analysis, including P2P and VOIP.
  • Decrypts SSL traffic for payload inspection and application signature verification.
  • Enables application control across all security rules (IPv4 and IPv6).
  • Control of known and unknown applications.
  • Allows the creation of custom signatures for proprietary application recognition via WEB interface, using regular expressions, without requiring manufacturer action.
  • Allows requesting the inclusion of applications in the application signature database via the vendor.
  • Allows sending alerts when an application is blocked.
  • Allows the creation of static and dynamic application groups based on characteristics such as risk level, technology, and category.

WEB and CLI Interface

  • Granularity (read and read/write profiles, applying configurations, etc.) for administrator access in the Web Interface with simultaneous sessions.
  • CLI (Command-line interface for management and diagnostics via SSH and RS-232/RJ-45 serial).
  • Proprietary Web interface available in Portuguese, English, and Spanish accessible through any physical interface of the product.
  • Management (LAN or WAN) via WEB (HTTPS via browser) and SSHv2, using cryptographic keys of at least 16bits.
  • Support for web console access via HTTP and CLI via TELNET.
  • Allows changing the default port for accesses to the administration interface via HTTP, HTTPS, and CLI.

Zero-touch Provisioning

  • Automatic provisioning associated with the equipment's serial number.
  • Configures security templates and IPv4/IPv6 policies.

Authentication

  • 2FA for user, VPN, and administrator authentication.
  • Local, Windows AD, LDAP, Windows SSO (single sign on via Kerberos), WMI and SAML – unified authentication, Linux SSO (single sign on via agent), X-Auth for VPN services, authentication on Radius servers, RSSO (radius single sign on), password complexity identifier, Token ID, Sessions and Applications based on TCP (HTTP, HTTPS, FTP and TELNET) /UDP/ICMP.
  • Integration with at least 3 WMI servers simultaneously.
  • AD/LDAP, RADIUS, TACACS+, and SAML support for administration users and Firewall users.
  • Synchronization of users, groups, and hosts with Windows AD and LDAP servers, with replication of established user sessions.
  • AAA (Authentication, Authorization and Accounting).
  • Identification through the AD database allows the use of SSO, so users do not need to log in again to the network to browse through the Firewall.
  • Supports authentication for Firewall and VPN: Tokens, RADIUS, TACACS+, LDAP, LDAPS, SAML, Microsoft Active Directory, AzureAD, Google Workspace, and digital certificates.
  • Encrypted packet access control to authentication servers.
  • Support for multiple administrators, with a change-locking option to prevent conflicts during concurrent sessions.
  • Allows replacement of active sessions.

Networks and Interfaces

  • Interfaces:
  • Ethernet (with support for FEC - Forward Error Correction).
  • VLAN (IEEE 802.1q) up to 4094 ID per interface.
  • VLAN Trunking with support for VLANs per trunk.
  • VXLAN (Virtual eXtensible LAN) available for integrations and advanced use.
  • WAN support: ADSL/DSL, MPLS, LTE (3G/4G/5G).
  • Alias (Virtual IP).
  • Link aggregation.
  • Ethernet bonding (802.3ad) LACP.
  • VLAN on aggregated link with support for up to 4094 IDs per LAG.
  • Dynamic routing: BGP4/BGP4+, OSPFv2/v3, RIPv1/v2, and PIM-SM/PIM-DM.
  • Support for IGMP v2 and v3.
  • Support for MD5 authentication between OSPF peers.
  • Support for multiple independent and concurrent OSPF routing processes.
  • Supports OSPF graceful restart.
  • BFD (Bidirectional Forwarding Detection) support for BGP.
  • Static routing (IPv4 and IPv6) with ECMP support.
  • Multicast Routing: supports rules and objects.
  • Native support for IPv4 and IPv6.
  • DHCP (dynamic host configuration protocol) IPv4 and IPv6.
  • DHCP Relay, Server and Client.
  • DHCP Option support with values from 1 to 250.
  • Recursive DNS.
  • Policy-based routing (PBR - Policy Based Routing or PBF – Policy Based Forwarding).
  • Supports logical Ethernet subinterfaces.
  • Displays the operational status (active/inactive) of network interfaces.
  • Proxy ARP for advertising IP addresses used in NAT on the local network.
  • Support for gratuitous ARP to update the ARP cache after NAT creation/modification.
  • Automatic publishing of NAT virtual IPs (Alias/Virtual IP) on LAN interfaces.

Monitoring

  • Support for SNMP v1, v2, and v3 protocols, monitoring CPU, memory, disk space usage, VPN, cluster status, and security violations.
  • Performance, concurrent connections, DHCP lease, authenticated users, and enabled or disabled services.
  • System and Security Notifications.
  • Detailed event viewing window.
  • Tool for disk maintenance and real-time network traffic monitoring (Live Sessions and Trafic Monitor) with throughput and concurrent connections information.
  • Security and Threat Event Logs.
  • Allows traffic capture and download in PCAP format.
  • User logging in authentication, access, blocking, and threat events.

Data Filter

  • Features a capability to identify and prevent the transfer of various file types (MS Office, PDF, etc.) identified over applications (HTTP, HTTPS, FTP, SMTP).
  • Capable of identifying compressed files on the data network and applying usage policies to the content of these file types.
  • Supports Antispam feature.
  • DLP (Data Loss Prevention).

Backup and Restore

  • Encrypted System Snapshot and Backup.
  • Disaster Recovery (backup/restore) via Web interface.
  • Storage (for backup and log saving).
  • NFS / DISK(HDD) / SSH / Flash (via USB).
  • Backup Rotation in storage with configuration of the number of copies.
  • Scheduling of Snapshot or System Backups through the graphical interface.

IPSEC VPN and SSL VPN

  • VPN Tunnel (LAN to LAN) / Site-to-Site and Client-to-Site VPN.
  • RAS/SSL VPN (remote access allows access via VPN client or direct clientless support on the workstation - Web Interface), that is, SSL VPN can be used with or without an agent.
  • SSL VPN Portal via HTTPS for RDP, VNC, SSH, WEB, and SMB access (without requiring JAVA), with a secure connection throughout the session.
  • VPN Client compatible with Win7, 8,8.1, 10, and 11 (32 and 64 bits), Linux and MacOS, Android and IOS.
  • Authentication.
  • Allows enabling, disabling, restarting, and updating IKE, Gateways, and IPsec VPN tunnels from the graphical interface.
  • PSK (Pre-Shared Key) - XAuth (AD, local LDAP, RADIUS), IKE P1 digital certificate, EAP (MSCHAPv2).
  • Allows establishing the tunnel before user authentication on the workstation, after authentication, or on demand.
  • Native IPsec VPN authentication using MD5, SHA-1, SHA-256, SHA-384, SHA-512, and AES-XCBC.
  • High availability.
  • Full FQDN (Quality Domain Name) and DDNS Support.
  • NAT-T (UDP encapsulation and I/D (Dead Peer Detection).
  • IKEv1 exchange mode: Main mode or Aggressive Mode.
  • Support for compressed data.
  • Protocols:
    • IKEv1 and IKEv2 (in phase 1 and phase 2) and ESP.
    • Symmetric Encryption: AES128, 192 and 256, 3DES.
    • Asymmetric Encryption: DH - Diffie-Hellman (Group1, Group2, Group5, Group14, Group15, Group16, Group17, Group18, Group19, Group20, Group21, Group22, Group23, Group24, Group25, Group26, Group27, Group28, Group29, Group30, Group31, and Group 32).
    • RSA key generation.
  • Auto-Discovery VPN (AD-VPN) support, allows multiple devices (Spokes) with a centralizing gateway (hub) and Site-to-Site, supports tunnel types (Site-to-Site, Full Mesh, Star).
  • Supports RSA and Diffie-Hellman algorithms.
  • SSL VPN with X509 v3 digital certificate support.
  • Supports the enrollment of certificate authorities through SCEP (Simple Certificate Enrollment Protocol).
  • Support for Dynamic Public IP, RIPv2 and OSPFv3 routing.
  • Support for certificates issued by a certificate authority in the ICP-Brasil standard.
  • Support for certificate revocation list (CRL) verification.
  • Support for multiple hubs in hub-spoke topologies.
  • Supports traffic isolation based on services and destinations (IoT, Banking Network, Guest Network).
  • Appliance-based VPN functionality.
  • Support for encryption algorithms: 3DES, AES128, AES256, AES GCM-128.
  • Features Auto-Discovery VPN (AD-VPN) capabilities able to allow creating dynamic tunnels for multiple devices (spokes) with a centralizing gateway (hub).
  • The AD-VPN feature supports the following tunnel types: Full-Mesh, Site-to-Site, and Star.
  • Support for configuration via Virtual interface when configuring site-to-site VPN tunnels with SD-WAN Protection.
  • The solution imposes no logical or licensing limitation on the number of VPN tunnels, whether site-to-site, remote access (RAS), clientless, AD-VPN, among others.
  • The client-to-site VPN supports automatic establishment of the VPN over ICMP or DNS (53/UDP) protocols if the remote client identifies that the default port is being blocked.
  • Features the ability to configure multiple simultaneous tunnels in client-to-site VPN, with traffic performance optimization.
  • SSL and IPSec VPN (client-to-site) with Blockbit Client for Windows.
  • Allows assigning DNS on remote VPN clients.
  • Clientless VPN (IPSec and SSL) without market vendor restrictions.
  • SSL certificate management (X.509).
  • Allows all traffic from remote VPN users to be routed into the VPN tunnel, preventing direct communication with local devices such as proxies.
  • Allows using IPSec VPN to interconnect remote units.
  • Features interoperability with any manufacturers using the IPSec standard.
  • Allows creating Application Control, IPS, Antivirus, Anti-Spyware, and URL Filter policies for connected remote client traffic.
  • Supports automatic distribution of the VPN agent to desktops and laptops via GPO or direct download via portal.
  • Allows applying the DiffServ code to the ESP packet.
  • Support for hardware encryption acceleration.

Logs and Reports

  • Support for Netflow / IPFIX.
  • Session, Authentication, and VPN Log Reports, by single device or consolidated.
  • Creation of customizable Analyzer-type reports (native to the tool) for Firewall, Web Filter, Application Control, IPS, ATP, VPN, and User Behavior services (IP information, user Operating System, Hostname, and "top 10"-style threat ranking).
  • Remote Syslog for sending logs and log export via SCP, supports sending logs via SSL protocol.
  • Report export in multiple formats (PDF, CEF, CSV, HTML).
  • Events identify the attack's country of origin.
  • Events record status changes and SD-WAN link health.
  • Historical reports with link health monitoring.
  • Historical report generation by period.
  • Has logs and reports for website browsing time.

H.A. (High Availability)

  • Mirroring of firewall sessions and user authentication, and synchronization of all configurations, sessions, certificates for SSL inspection, VPN IPSsec SA (Security Associations), and all ATP, Application Control, IPS and WEB Filter signatures between the primary and secondary devices, ensuring a transparent and fast switch over.
  • Interface monitoring in case of link failure.
  • High Availability Cluster System (Active-Passive/Active-Active, only with identical appliances) with preservation of established sessions, traffic distribution, state table maintenance, and session balancing across multiple availability zones.
  • Server synchronization is performed via a dedicated Heartbeat interface.
  • In the event of a primary active device failure, the secondary device takes over transparently, without user impact or service loss.
  • Supports session persistence for users and established connections between High Availability members.
  • The cluster operates in heartbeat mode over an IP network, using Ethernet interfaces that can be connected to the switch infrastructure or, optionally, in a direct connection (cross), depending on the topology.
  • The solution does not depend on a direct physical connection between cluster nodes, being able to form and maintain the cluster exclusively through the customer's IP network infrastructure and switches, with support for up to 3-port LAG for redundancy and performance.
  • The cluster supports operation between geographically distinct sites, provided there is adequate IP connectivity for synchronization traffic (heartbeat).

Web Application and API Protection

  • Secure publishing of internal applications and services (Port Forwarding/DNAT) with dedicated security inspections, individually configurable per publishing rule.
  • SSL/TLS inspection of inbound traffic with the published service certificate, via an SSL/WAF/WAAP inspection profile applicable to the publication rule and operating in reverse proxy mode — providing the prevention engine with full visibility into the content of encrypted HTTP/HTTPS requests (HTTPS, SMTPS, POPS, and IMAPS).
  • Application of IPS profile per publication rule, with independent inspection policy for each exposed application.
  • Threat Blocking by threat classes directly in the publication rule: Abuse, Anonymizers, Attacks, Malware, Reputation, and Spam.
  • DoS protection per published service, with packets-per-second limiting (Packet Rate) and configurable tolerance for legitimate spikes (Burst Rate).
  • Access control to the published application: authentication requirement by users and groups within the rule itself, allowed and blocked source lists, and activation windows by time and date.
  • Database of +100k signatures, with thousands dedicated to web application and API protection (WAF/WAAP), organized into specific categories — sql, web_specific_apps, web_server, web_client, server-webapp, and exploit, among others — with Client/Server grouping, severity rating, and cross-referencing with CVEs.
  • Continuous and automatic updates of the web application and API protection signature database, with new signatures published by Blockbit's intelligence lab (Threat Signature Reports).
  • Coverage of major web application attack vectors: SQL injection, Cross-Site Scripting (XSS), CSRF, command and object injection, path/directory traversal, local and remote file inclusion (LFI/RFI), arbitrary file read, malicious file upload and webshells, authentication bypass, buffer overflow, and remote code execution — addressing the primary vulnerabilities mapped in the OWASP Top 10.
  • Specific API protection: REST and SOAP endpoint exploitation, insecure deserialization, SSRF (Server-Side Request Forgery), XXE (XML External Entity), and authentication token (JWT) manipulation.
  • Continuous virtual patching for recent vulnerabilities (CVEs) in CMSs, frameworks, application servers, and exposed devices, applied by the IPS engine without changes to the protected application.
  • Creation of custom signatures in the web interface, with flow granularity (state and direction), services and ports, content patterns and regular expressions, offset and depth — enabling immediate shielding of internal applications (on-demand virtual patching).
  • Granular per-signature action — enabling, blocking, and automatic quarantine by source or destination with configurable duration — with risk rating per signature; inspection profiles operable in inline (firewall), transparent, passive (detection), and packet logger modes, featuring multiple inspection processes.
  • Resistance to evasion techniques: URL Obfuscation, HTML Obfuscation, Payload Encoding, multiple Unicode format decoding, IP fragmentation and reassembly, and stream segmentation.
  • Anomaly prevention in HTTP and HTTPS protocols and application layer attack verification.
  • Handling of modern web traffic protocols, with declared compliance with HTTP/2 (RFC 7540 and RFC 7541) and QUIC (RFC 9000).
  • Protection against DoS, DDoS, brute force, and port scanning, in global mode and per security policy.
  • Upload and download control by true file type (MIME) and extension, with antivirus, heuristic analysis, handling of password-protected files, and inline sandbox over HTTP and HTTPS.
  • Data Loss Prevention integrated into the IPS engine, with dedicated categories, blocking, and quarantine.
  • Threat intelligence applied to web protection: CTI integration (IPs, domains, and malware hashes), external dynamic lists for IP, URL, and FQDN updated every 30 to 900 seconds, and YARA rules.
  • SSL certificate validation with filtering by Common Name and control by SNI; support for TLS 1.2 and TLS 1.3.
  • Visibility and forensics: IPS events with severity, impact, and geolocation, packet capture (PCAP)
  • per IPS rule and dedicated reports in centralized management, with search by more than 30 filters — source/destination, user, site, method, signature (SID), threat class, and impact.

GSM - Centralized Management

  • Support for centralized configuration of NGFW devices, covering filtering rules, WebFilter, IPS, and all other security features available in the solution.
  • Centralized backup of managed devices.
  • Reboot or shutdown (NGFW/SD-WAN) via centralized management.
  • Supports automations for management activities, for example, rule synchronization, centralized management, and orchestration.
  • Centralized update and rollback.
  • Support for alerts via email, SNMP, and Syslog through centralized management.
  • Log centralization through centralized management.
  • Support for authentication server groups.
  • Support for authentication via X509v3 certificates.
  • Support for revoked certificates (LCR).
  • Multi-tenant environment.
  • Supports simultaneous access by multiple administrators, with a change-locking option to prevent conflicts during concurrent sessions.
  • Viewing and comparison of current and historical configurations with artificial intelligence support.
  • Visualization of inventoried devices through online geolocation maps.
  • Allows duplication of existing reports.
  • Allows customization of charts and reports.
  • Allows the creation of customized dashboards (Dashboards) for traffic visibility.
  • Offers drill-down capability for real-time report detailing.
  • Sending reports by email with customized recipient definition per report.
  • Displays the total generated logs via graphical interface.
  • Allows performance analysis and troubleshooting based on generated logs.
  • Log export via HTML, PDF, and CSV.
  • Displays consolidated information from logs generated by a Device or group of Devices.
  • Orchestration of site-to-site and Star (HUB-Spoke) VPNs.
  • Authentication via SAML, Radius, AD, and LDAP, with 2FA support.
  • API support for integration with third-party systems.
  • Device deployment via ZTP (Zero Touch Provisioning).
  • Cluster support in the centralized management tool and in the log management tool.
  • Allows automated scheduling of configuration deployments, supporting approval workflows and a complete audit trail, ensuring control, compliance, and governance throughout the change lifecycle.
  • Allows real-time monitoring and management of the status and performance of managed devices.

Sandboxing - APT

  • Enables the mitigation of advanced persistent threats (APT and Zero-Day) through dynamic analysis to identify unknown malware, with automatic database updates across an intelligence network. Analyzes PDF files, Microsoft Office files, executables, and compressed files (ZIP, TAR, GZIP, BZ2, RAR, 7Z).
  • Capable of creating signatures and also adding them to the firewall's antivirus database, preventing recurrence of the attack.
  • Supports adding URLs identified as sources of such unknown threats to the firewall (Blacklist), preventing these addresses from being accessed again by network users.
  • The APT module supports analyzing the file via antivirus, cloud query, code emulation, sandboxing, and call-back verification, and analyzes the behavior of suspicious files in a controlled environment, in real time.
  • Capable of emulating, executing, detecting, and blocking any malware and/or malicious code.
  • Emulates sandbox of Microsoft environments in various versions and Office.
  • Displays behavioral reports with file type, network communication, and associated IPs, including the malware source IP, enabling auditing and investigation.
  • The analysis returns classification by risk levels (high, medium, and low).
  • Preserves the original analyzed file, allowing it to be downloaded by the administrator.
  • Produced indicators and signatures are propagated in real time to the solution's integrated components, ensuring immediate blocking across the entire ecosystem.
  • The APT module performs dynamic analysis with synchronous flow, temporarily holding suspicious files until the verdict is issued, allowing real-time blocking or allowing.

User Identification

  • Allows the creation of policies based on URL control and URL categories.
  • Allows creating policies based on visibility and control of who is using which applications through integration with directory services, authentication via LDAP, Active Directory, and local database.
  • Compatible with Microsoft Active Directory (Windows Server 2016, 2019, 2022, and 2025) for identifying users, groups, and machines/computers, providing granular control and policies based on users and user groups, with single sign-on support.
  • Supports unlimited users.
  • Supports authentication for Firewall and VPN: Tokens, TACACS+, RADIUS, and digital certificates.
  • Allows control, without software client installation, on devices requesting internet outbound traffic so that before starting browsing, an authentication portal resident on the firewall (Captive Portal) is displayed.
  • Supports the identification of multiple users connected to the same IP address in Citrix and Microsoft Terminal Server environments, enabling visibility and granular per-user control over application usage within these services.
  • Allows the creation of custom user groups on the firewall, based on LDAP/AD attributes.
  • Allows the creation of administration groups with different access profiles.
  • Monitor Profile: Read-only.
  • Operator Profile: Read/Write, without permission to disable interfaces.
  • Administrator Profile: Read/Write/Modify.
  • Supports multiple Authentication Servers (MS AD and/or LDAP) operating in failover mode.

Other Features

  • Proxy Services (SSH, SMB/CIFS, HTTP, FTP, SMTP, POP3).
  • Supports Voip (SIP/H.323) and RTP over IPv4/IPv6.
  • Support for multiple Authentication domains.
  • Supports fail-closed and optional fail-open (bypass) interface.
  • Transparent Update, automatically, periodically, and offline.
  • Supports session authentication for all protocols and any applications.
  • Resource objects.
  • IP addresses, MAC addresses, port and protocol services, schedule table, period and date table, dictionaries (set of words and/or regular expressions), content types.
  • Support for NTP (Network Time Protocol) servers for date and time updates.
  • Option for automatic and periodic system updates for fixes and web HTTPS releases or via GSM.
  • TCP Flow Optimization.
  • Features Packet Flow in Forwarding and Control modes.
  • Supports access via SSH, CLI, client, or web (HTTPS).
  • VPN Client Compatibility: Windows (32-bit and 64-bit); Windows Server (2008 in all versions, 2011, 2012, 2012 R2, 2016, 2019, 2022, 2025, and higher); Windows (7 in all versions, 8.1, 10, 11, and higher); macOS (amd/arm); Big Sur (11); Monterey (12); Ventura (13); Sonoma (14); Sequoia (15); Tahoe (26) and higher; Linux (32-bit and 64-bit); Ubuntu (18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, and higher); Debian (10, 11, 12, and higher); Debian-based distributions: Kali Linux; Linux Mint; Pop!_OS; Zorin OS; MX Linux; Raspbian (Raspberry Pi OS) based on Debian 10 and higher; Fedora (35 and higher); CentOS (8, 9, and higher); Red Hat Enterprise Linux (RHEL 7, 8, 9, and higher); Rocky Linux (8, 9, and higher); AlmaLinux (8, 9, and higher); Alpine (3.14 and higher); SUSE Linux Enterprise or OpenSUSE (12, 15, and higher); AWS Linux (2, 2023, and higher); Oracle Linux (7, 8, 9, and higher); Azure Linux (cloud and on-premises); Google Cloud (Ubuntu Pro, Debian, RHEL, and derivatives); iOS, and Android.
  • Virtualization and deployment of solutions (NGFW, SD-WAN, and GSM) in public cloud (Google Cloud®, Microsoft Azure®, Oracle Cloud®, and AWS®) and in private cloud based on OpenStack, as well as integration with virtualization platforms such as VMware vSphere®/vCenter®, Citrix XenCenter®, Hyper-V®, KVM, Proxmox®, and Nutanix®.
  • Support for Context (Virtual Domain).
  • All policies support application control.
  • Supports various methods for application identification and classification, such as signature checking and protocol decoding.
  • Allows the creation of custom signatures in the WEB interface for application recognition and IDS/IPS.
  • Allows requests to include applications in the standard database.
  • Supports granularity in IPS, Antivirus, AntiSpam, and Anti-Spyware policies, enabling the creation of different policies per security zone, source address, destination address, service, and any combination of these items.
  • Features protection against viruses in HTML and Javascript content, spyware, and Worms.
  • Protection against involuntary HTTP downloads of executable and/or malicious files.
  • Enables the configuration of different threat and attack control policies based on firewall policies considering users, user groups, source, destination, security zones, and MAC Address; each firewall policy can have a different IPS configuration, with these policies applying to users, user groups, source, destination, and security zones.
  • Supports Virtual Systems (VDOM) on all models.
  • VDOMs: no predefined logical limit; supported quantity conditioned on the physical and computing resource capacity available on the appliance and resource allocation per instance.
  • VDOM system allows creating virtual contexts with support for creating multiple administrators.
  • Supports TLS 1.2 and TLS 1.3.
  • Supports creating block or allow policies by geolocation and indicates the source and/or destination country in the logs with a flag to facilitate traffic identification.
  • Support for dynamic website categorization.
  • Website reclassification via vendor portal.
  • Support for multiple simultaneous accesses.
  • Validation of security policies to identify duplicate or shadowed rules.
  • All models support the creation of at least: 1000 (one thousand) firewall rules and/or policies.
  • Statistical reports of concurrent connections.
  • VPN usage reports.
  • Statistical reports of traffic (Input and Output).
  • Supports license expiration notification in the alert window showing the days remaining until the expiration date.
  • Snapshot restore without running the Wizard and without licensing.
  • Any network interface on the device can be used for management; that is, there is no dedicated interface exclusively for the management function.
  • Allows access to the web management interface through any configured network interface.
  • Allows service scheduling.
  • Enables the configuration of connection protocol response timeouts, and supports defining options for default ICMP timeout, TCP establishment, SYN sending in TCP sessions.
  • Features a single security policy configuration window where WEB Proxy, IPS, APP control, SD-WAN, and ATP profiles can be inserted.
  • Allows implementing IPS, WEB Filter, Threat Protection, SSL Inspection, and Application Control filters, as well as application routing via SD-WAN and DoS packet rate limiting in a single policy.
  • Displays which modules are enabled directly within the policy, without requiring editing of the protection rule.
  • Enables editing linked objects without the need to recreate the policy.
  • Enables the duplication of a policy, optimizing configuration time.
  • Allows access to the CLI management interface physically on the equipment.
  • The USB interface supports the use of a 3G/4G/LTE modem for internet link connection.
  • Connectivity with Medidor Educação Conectada (SIMET/nic.br) without the need to install external equipment (e.g., SIMET Box).
  • Manual selection of speed and duplex mode per interface; SFP+ and SFP28 interfaces are backward compatible with transceivers, also operating at 1 Gbps and 10 Gbps, respectively.
  • Features Encrypted Traffic Analysis (ETA) functionality.
  • Features a mechanism to dedicate processing on the equipment.
  • Support for Network Access Control (NAC) with RADIUS (Remote Authentication Dial-In User Service) authentication.
  • Ability to manage the equipment (CLI) via USB port.
  • Web platform for opening, tracking, and closing technical support tickets for Blockbit solutions, with SLA time tracking.
  • Support for native integration with SDN and container orchestration solutions, including, at a minimum, Cisco ACI, VMware NSX-T, and Kubernetes-orchestrated environments.
  • Our equipment features 2P+T power supply, via IEC C14/C13 connectors and separate NBR 14136 standard cables, with automatic dual-voltage operation (100 to 240 V AC, 50/60 Hz, with automatic voltage detection).
  • All equipment uses SSD or NVMe storage, designed for data center environments and supporting PLP (Power Loss Protection).
  • Supports the inclusion of at least 25,000 (twenty-five thousand) dynamic routes in the routing table.
  • Allows optional CPU reservation for the management console; when not used, the solution automatically employs all processing resources dynamically, without manual adjustments or the need for a reboot.
  • Dynamic objects updated automatically at configurable intervals from 30 to 900 seconds, with support for external lists of IP addresses, domain names, URLs, FQDNs and software-defined data centers (SDDC – Software-Defined Datacenter and SDN – Software-Defined Network) for direct use in security policies.
  • Supports third-party integration via RESTful APIs (HTTP/HTTPS, JSON), SNMP v2/v3, NetFlow, IPFIX, and other standardized mechanisms.
  • Supports YARA, allowing the creation and application of custom rules to identify malicious artifacts during the analysis process.
  • Integrates external CTI - Cyber Threat Intelligence services for ingestion of threat indicators (IPs, MACs, domains, and malware hashes), with automatic reputation list updates.
  • Operating relative humidity: Form Factor: Desktop / 1U Rack 19: 5%–95%, non-condensing; Form Factor: 1U/2U: 10%–90%, non-condensing.
  • Operating temperature: Factor: Desktop / 1U Rack 19: -10°C to 60°C; Form Factor: 1U/2U: 0°C to 40°C.
  • Storage temperature: Factor: Desktop / 1U Rack 19: -20°C to 70°C; Form Factor: 1U: -15°C to 35°C; Form Factor: 2U: -20°C to 75°C.
  • Maximum expected firewall latency, considering proper environment sizing: BBX50 / BBX80 / BBX90: up to 2.85 µs; BBX180: up to 2.95 µs; BBX200 / BBX500 / BBX700 / BBX900: up to 3.05 µs; BBX1200 / BBX1500 / BBX1800: up to 3.11 µs; BBX3000 / BBX3200 / BBX3600 / BBX3800: up to 3.15 µs; BBX4200 / BBX4400 / BBX5000: up to 3.40 µs; BBX5200 / BBX6200: up to 3.70 µs.
Section

Some RFC’s supported by Blockbit Platform

BGP

  • RFC 7911: Advertisement of Multiple Paths in BGP.
  • RFC 7606: Revised Error Handling for BGP UPDATE Messages.
  • RFC 4724: Graceful Restart Mechanism for BGP.
  • RFC 4456: BGP Route Reflection: An Alternative to Full Mesh Internal BGP (IBGP).
  • RFC 4360: BGP Extended Communities Attribute.
  • RFC 4271: A Border Gateway Protocol 4 (BGP-4).
  • RFC 2918: Route Refresh Capability for BGP-4.
  • RFC 2545: Use of BGP-4 Multiprotocol Extensions for IPv6 Inter-Domain Routing.
  • RFC 2439: BGP Route Flap Damping.
  • RFC 1997: BGP Communities Attribute.
  • RFC 1930: Guidelines for creation, selection, and registration of an Autonomous System (AS).
  • RFC 1772: Application of the Border Gateway Protocol in the Internet.
  • RFC 5925: TCP-AO.
  • RFC 2858 / 4760: Multi-Protocol Extensions for BGP-4.
  • RFC 3392: Capabilities Advertisement with BGP-4.
  • RFC 2385: BGP Session protection via TCP MD5.

IPv4 and IPv6

  • RFC 6864: Updated Specification of the IPv4 ID Field.
  • RFC 5177: Network Mobility (NEMO) Extensions for Mobile IPv4.
  • RFC 4632: Classless Inter-domain Routing (CIDR): The Internet Address Assignment and Aggregation Plan.
  • RFC 3927: Dynamic Configuration of IPv4 Link-Local Addresses.
  • RFC 3021: Using 31-Bit Prefixes on IPv4 Point-to-Point Links.
  • RFC 1812: Requirements for IP Version 4 Routers.
  • RFC 7761: Protocol Independent Multicast - Sparse Mode (PIM-SM): Protocol Specification (Revised).
  • RFC 6343: Advisory Guidelines for 6to4 Deployment.
  • RFC 5175: IPv6 Router Advertisement Flags Option.
  • RFC 5095: Deprecation of Type 0 Routing Headers in IPv6.
  • RFC 4941: Privacy Extensions for Stateless Address Autoconfiguration in IPv6.
  • RFC 4862: IPv6 Stateless Address Autoconfiguration.
  • RFC 4861: Neighbor Discovery for IP version 6 (IPv6).
  • RFC 4389: Neighbor Discovery Proxies (ND Proxy).
  • RFC 4213: Basic Transition Mechanisms for IPv6 Hosts and Routers.
  • RFC 4193: Unique Local IPv6 Unicast Addresses.
  • RFC 4007: IPv6 Scoped Address Architecture.
  • RFC 3971: Secure Neighbor Discovery (SEND).
  • RFC 3596: DNS Extensions to Support IP Version 6.
  • RFC 3587: IPv6 Global Unicast Address Format.
  • RFC 3493: Basic Socket Interface Extensions for IPv6.
  • RFC 3056: Connection of IPv6 Domains via IPv4 Clouds.
  • RFC 3053: IPv6 Tunnel Broker.
  • RFC 2894: Route Renumbering for IPv6.
  • RFC 2675: IPv6 Jumbograms.
  • RFC 2464: Transmission of IPv6 Packets over Ethernet Networks.
  • RFC 2185: Routing Aspects of IPv6 Transition.
  • RFC 1752: The Recommendation for the IP Next Generation Protocol.
  • RFC 8200: Internet Protocol, Version 6 (IPv6) Specification.
  • RFC 8201: Path MTU Discovery for IP Version 6.
  • RFC 2460: Internet Protocol, Version 6 (IPv6) - Specification.
  • RFC 2461: Neighbor Discovery for IP Version 6 (IPv6).
  • RFC 2462: IPv6 Stateless Address Auto-Configuration.
  • RFC 4884: Extended ICMP to Support Multi-Part Messages.
  • RFC 4291: IP Version 6 Addressing Architecture.
  • RFC 6540: IPv6 support required for all IP-capable nodes.
  • RFC 4443: Internet Control Message Protocol (ICMPv6) for IPv6.

SIP

  • RFC 3960: Early Media and Ringing Tone Generation in the Session Initiation Protocol (SIP).
  • RFC 3325: Private Extensions to the Session Initiation Protocol (SIP) for Asserted Identity within Trusted Networks.
  • RFC 3262: Reliability of Provisional Responses in the Session Initiation Protocol (SIP).
  • RFC 3261: SIP: Session Initiation Protocol.

TLS and SSL

  • RFC 8446: The TLS Protocol Version 1.3.
  • RFC 6347: Datagram Transport Layer Security Version 1.2.
  • RFC 6066: TLS Extensions: Extension Definitions.
  • RFC 5746: TLS Renegotiation Indication Extension.
  • RFC 5246: The Transport Layer Security (TLS) Protocol Version 1.2.
  • RFC 5245: Interactive Connectivity Establishment (ICE).
  • RFC 5425: Transport Layer Security (TLS) Transport Mapping for Syslog.
  • RFC 4680: TLS Handshake Message for Supplemental Data.
  • RFC 6176: Prohibiting Secure Sockets Layer (SSL) Version 2.0.
  • RFC 6101: The Secure Sockets Layer (SSL) Protocol Version 3.0.

SNMP

  • RFC 4293: Management Information Base for the IP.
  • RFC 4273: Definitions of Managed Objects for BGP-4.
  • RFC 4113: Management Information Base for User Datagram Protocol (UDP).
  • RFC 4022: Management Information Base for the TCP.
  • RFC 3635: Definitions of Managed Objects for the Ethernet-like Interface Types.
  • RFC 3417: Transport Mappings for the SNMP.
  • RFC 3416: Version 2 of the Protocol Operations for the SNMP.
  • RFC 3414: User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3).
  • RFC 3413: SNMP Applications.
  • RFC 3412: Message Processing and Dispatching for the SNMP.
  • RFC 3411: An Architecture for Describing SNMP Management Frameworks.
  • RFC 3410: Introduction and Applicability Statements for Internet Standard Management Framework.
  • RFC 2863: The Interfaces Group MIB.
  • RFC 2578: Structure of Management Information Version 2 (SMIv2).
  • RFC 1238: CLNS MIB for use with Connectionless Network Protocol (ISO 8473) and End System to Intermediate System (ISO 9542).
  • RFC 1215: A Convention for Defining Traps for use with the SNMP.
  • RFC 1213: Management Information Base for Network Management of TCP/IP-based internets: MIB-II.
  • RFC 1212: Concise MIB Definitions.
  • RFC 1157: A Simple Network Management Protocol (SNMP).
  • RFC 1156: Management Information Base for Network Management of TCP/IP-based internets.
  • RFC 1155: Structure and Identification of Management Information for TCP/IP-based Internets.

Diffserv

  • RFC 3260: New Terminology and Clarifications for Diffserv.
  • RFC 3246: An Expedited Forwarding PHB (Per-Hop Behavior).
  • RFC 2597: Assured Forwarding PHB Group.
  • RFC 2475: An Architecture for Differentiated Services.
  • RFC 2474: Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers.

NAT

  • RFC 7857: Updates to Network Address Translation (NAT) Behavioral Requirements.
  • RFC 6146: Stateful NAT64: Network Address and Protocol Translation from IPv6 Clients to IPv4 Servers.
  • RFC 5508: NAT Behavioral Requirements for ICMP.
  • RFC 5382: NAT Behavioral Requirements for TCP.
  • RFC 4787: NAT Behavioral Requirements for Unicast UDP.
  • RFC 4380: Teredo: Tunneling IPv6 over UDP through NAT.
  • RFC 3948: UDP Encapsulation of IPsec ESP Packets.
  • RFC 3022: Traditional IP Network Address Translator (Traditional NAT).

LDAP

  • RFC 4513: Authentication Methods and Security Mechanisms.
  • RFC 4512: Directory Information Models.
  • RFC 4511: The Protocol.
  • RFC 3494: Lightweight Directory Access Protocol version 2 (LDAPv2) to Historic Status.

RIP

  • RFC 4822: RIP-2 Cryptographic Authentication.
  • RFC 2453: RIP Version 2.
  • RFC 2080: RIPng for IPv6.
  • RFC 1724: RIP Version 2 MIB Extension.
  • RFC 1058: Routing Information Protocol.

VPN

  • RFC 4761: Virtual Private LAN Service (VPLS) Using BGP for Auto-Discovery and Signaling.
  • RFC 4684: Constrained Route Distribution for Border Gateway Protocol/Multiprotocol Label Switching (BGP/ MPLS) Internet Protocol (IP) Virtual Private Networks (VPNs).
  • RFC 4577: OSPF as the Provider/Customer Edge Protocol for BGP/MPLS IP Virtual Private Networks (VPNs).
  • RFC 4364: BGP/MPLS IP Virtual Private Networks (VPNs).
  • RFC 3715: IPsec-Network Address Translation (NAT) Compatibility Requirements.

Other Protocols

  • RFC 9000: QUIC: A UDP-Based Multiplexed and Secure Transport.
  • RFC 7541: HPACK: Header Compression for HTTP/2.
  • RFC 7540: Hypertext Transfer Protocol Version 2 (HTTP/2).
  • RFC 5424: The Syslog Protocol.
  • RFC 4960: Stream Control Transmission Protocol.
  • RFC 3376: Internet Group Management Protocol, Version 3.
  • RFC 2890: Key and Sequence Number Extensions to GRE.
  • RFC 2784: Generic Routing Encapsulation (GRE).
  • RFC 2236: Internet Group Management Protocol, Version 2.
  • RFC 4604: SSM with IGMPv3.
  • RFC 6724 (Default Address Selection for IPv6).
  • RFC 5905: Network Time Protocol Version 4 (NTPv4).
  • RFC 1928: SOCKS Protocol Version 5. Supported when explicit proxy is implemented.
  • RFC 1413: Identification Protocol.
  • RFC 1305: NTP (Version 3) Specification, Implementation and Analysis.
  • RFC 959: File Transfer Protocol (FTP).
  • RFC 862: Echo Protocol.
  • RFC 783: The TFTP Protocol (Revision 2).
  • RFC 768: User Datagram Protocol.
  • RFC 8907: The Terminal Access Controller Access-Control System Plus (TACACS+) Protocol.

Encryption

  • RFC 7627: Transport Layer Security (TLS) Session Hash and Extended Master Secret Extension.
  • RFC 7427: Signature Authentication in the IKEv2.
  • RFC 7383: IKEv2 Message Fragmentation.
  • RFC 7296: Internet Key Exchange Protocol Version 2 (IKEv2).
  • RFC 7027: Elliptic Curve Cryptography (ECC) Brainpool Curves for Transport Layer Security (TLS).
  • RFC 6989: Additional Diffie-Hellman Tests for IKEv2.
  • RFC 6954: Using the Elliptic Curve Cryptography (ECC) Brainpool Curves for IKEv2.
  • RFC 6290: A Quick Crash Detection Method for the Internet Key Exchange Protocol (IKE).
  • RFC 6032: A Childless Initiation in the IKEv2 Security Association (SA).
  • RFC 5723: IKEv2 Session Resumption.
  • RFC 5282: Using Authenticated Encryption Algorithms with the Encrypted Payload of the IKEv2 Protocol.
  • RFC 5280: Internet .509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile.
  • RFC 4756: IKE and IKEv2 Authentication Using the Elliptic Curve Digital Signature Algorithm (ECDSA).
  • RFC 4355: IANA SHA1/SHA256 Algorithm Identifiers.
  • RFC 4492: Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS).
  • RFC 4478: Repeated Authentication in IKEv2 Protocol.
  • RFC 4106: The Use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload (ESP).
  • RFC 3947: Negotiation of NAT-Traversal in the IKE.
  • RFC 3667: The AES CBC Cipher Algorithm and Its Use with IPsec.
  • RFC 3526: More Modular Exponential (MODP) Diffie-Hellman groups for IKE.
  • RFC 2631: Diffie-Hellman Key Agreement Method.
  • RFC 2409: The Internet Key Exchange (IKE).
  • RFC 2410: The NULL Encryption Algorithm and Its Use with IPsec.
  • RFC 2408: The Internet Key Exchange Algorithm ith PKE.
  • RFC 2406: IPsec-AH and ESP.
  • RFC 2104: HMAC-MD5 IP Authentication with Replay Prevention.
  • RFC 1321: The MD5 Message-Digest Algorithm.
  • RFC 3768: Virtual Router Redundancy Protocol (VRRP).
  • RFC 2787: Definitions of Managed Objects for the Virtual Router Redundancy Protocol.
  • RFC 2451: The IKE CBC-Mode Cipher Algorithms.

OSPF

  • RFC 6860: Hiding Transit-Only Networks in OSPF.
  • RFC 6845: OSPF Hybrid Broadcast and Point-to-Multipoint Interface Type.
  • RFC 5709: OSPFv2 HMAC-SHA Cryptographic Authentication.
  • RFC 5340: OSPF for IPv6.
  • RFC 4812: OSPF Restart Signaling.
  • RFC 4811: OSPF Out-of-Band Link State Database (LSDB) Resynchronization.
  • RFC 4203: OSPF Extensions in Support of Generalized Multi-Protocol Label Switching (GMPLS).
  • RFC 3630: Traffic Engineering (TE) Extensions to OSPF Version 2.
  • RFC 3623: Graceful OSPF Restart.
  • RFC 3509: Alternative Implementations of OSPF Area Border Routers.
  • RFC 3101: The OSPF Not-So-Stubby Area (NSSA) Option.
  • RFC 2328: OSPF Version 2.
  • RFC 1765: OSPF Database Overflow.
  • RFC 1370: Applicability Statement for OSPF.

DHCP

  • RFC 4361: Node-specific Client Identifiers for Dynamic Host Configuration Protocol Version Four (DHCPv4).
  • RFC 3736: Stateless Dynamic Host Configuration Protocol (DHCP) Service for IPv6.
  • RFC 3633: IPv6 Prefix Options for Dynamic Host Configuration Protocol (DHCP) version 6.
  • RFC 3442: The Classless Static Route Option for Dynamic Host Configuration Protocol (DHCP) version 4.
  • RFC 3315: Dynamic Host Configuration Protocol for IPv6 (DHCPv6).
  • RFC 2132: DHCP Options and BOOTP Vendor Extensions.
  • RFC 2131: Dynamic Host Configuration Protocol.

* PERFORMANCE TESTS ARE PERFORMED IN A LABORATORY ENVIRONMENT, USING APPLICABLE METHODOLOGIES FROM RFC 2544, RFC 3511, RFC 9411 AND RFC 6985, WITHOUT SUMMARIZATION BY USERS, IPS AND SERVICES / FIREWALL THROUGHPUT: MEASURED WITH UDP TRAFFIC AND 1518-BYTE PACKETS, WITH THE ADDITIONAL SECURITY INSPECTION MECHANISMS AND APPLICATION DETECTORS DISABLED / HTTP THROUGHPUT: MEASURED USING 1280 KB HTTP GET REQUESTS / IPS/ATP THROUGHPUT: MEASURED WITH FACTORY DEFAULT SIGNATURES ENABLED / NGFW THROUGHPUT: MEASURED WITH FIREWALL, IPS AND APPLICATION CONTROL ENABLED SIMULTANEOUSLY, USING IMIX TRAFFIC / THREAT PROTECTION THROUGHPUT: MEASURED WITH FIREWALL, IPS, APPLICATION CONTROL AND MALWARE AND THREAT PROTECTION MECHANISMS ENABLED SIMULTANEOUSLY, USING IMIX TRAFFIC.

Section