1 Overview

1.1 Introduction

Sangfor Network Secure has the capabilities of risk prediction, deep security protection, and detection response, forming an integrated security system with whole-process protection and visibility.

Integration is not a simple function superposition, but integration of technical security means provided for the risks encountered in the service development process. It gives whole-process protection to the service. Integrated security includes asset risk discovery, policy detection, various security defense methods that should be available during the incident, continuous detection, and rapid response mechanisms after the incident.

1.2 Key Features

I. Preparation & Prediction: Asset/Vulnerability/Policy Effectiveness

Network Secure can automatically identify risks such as open ports, vulnerabilities, and weak passwords on internal servers in advance and judge whether the identified assets have corresponding security protection policies and are in effect.

II. Real-Time Defense: Complete Defense System + Security Correlation + Threat Intelligence

Network Secure integrates several security technologies for effective defense during an event. It provides a complete security defense system (L2-L7) to ensure no weaknesses in security protection. At the same time, Network Secure can also improve the timeliness and effectiveness of the defense system through security integration, including integrating cloud and endpoint security solutions and coordinating different modules. In addition, Network Secure also cooperates with third-party security agencies and utilizes threat intelligence from multiple sources, such as the Chinese National Vulnerability Database, VirusTotal, and malicious URL databases, to help users prepare for defense before security events occur.

III. Post-event Detection & Response: Continuous Detection of Threatening Behaviors and Rapid Response

Traditional security work mainly focuses on border security defense and cannot detect and respond when attackers bypass security measures. If there are mature post-event detection and response measures, the impact of security events can be greatly reduced. Network Secure integrates post-event detection and rapid response technologies, which help users timely discover malicious behaviors even after hacking, such as detecting malicious behaviors initiated by zombie computers, webpage tampering, website backlink embedment, and Webshell backdoor, and quickly push alarm events to assist users in responding and handling.

2 Installation and Deployment

This chapter mainly describes the installation preparation, including tools, installation environment, and software and hardware.

2.1 Installation Preparations

2.1.1 Environment Requirements

Network Secure can be used in the following environments. To ensure the long-term stable operation of the system, the power supply should be properly grounded, and the operating environment features dustproof measures, smooth air, and stable room temperature. This product complies with the design requirements for environmental protection. The placement, usage, and abandonment of the product shall comply with relevant national laws and regulations where it is applied.

Parameter	Requirements
Voltage	110V~230V
Temperature	0~45°C
Humidity	5~90%
Power supply	110V AC to 230V AC: Please ensure the power supply has good grounding measures before switching on the power.

Table 1: Operating Environment Requirements for Network Secure

2.1.2 Product Appearance

Network Secure's front panel is shown below (Network Secure-2000-B2150 as an example).

Device Name	No. (Front)	Note
Network Secure-2000-B2150	1	CONSOLE interface
	2	USB interface
	3	IPMI interface
	4	MANAGEMENT interface (ETH0)
	5	ETH1
	6	ETH2
	7	ETH3
	8	ETH4
	9	ETH5
	10	ETH6

Table 2: Networking Interfaces of Network Secure-2000-B2150

Network Secure's rear panel is shown below (using Network Secure-2000-B2150 as an example).

Device Name	No. (Rear)	Note
Network Secure-2000-B2150	1	POWER button
	2	POWER interface
	3	POWER interface

Table 3: Interfaces on Rear Panel (Network Secure-2000-B2150)

Precautions:

1. The alarm indicator is steady red when the device is running. Generally, the red alarm indicator goes out after one or two minutes, indicating the device is successfully turned on. If the red alarm indicator does not go out for a long time, please turn off the device and wait for 5 minutes before turning it on.

2. If the red alarm indicator remains on, please contact Sangfor Technical Support to determine whether the device is damaged. After the normal startup, the indicator may blink red sometimes. It is normal as the device is generating a system log.

3. The CONSOLE interface is for development, testing, and debugging only. End-users need to access the device by the networking interface and logging in to the console.

AF 8.0.39