Integrated Appliance Solution (IAS) Bladed Hardware

©2010 Check Point Software Technologies Ltd. | [Confidential] For Check Point users and approved third parties

Integrated Appliance Solution (IAS)Bladed Hardware

May 13, 2010

22©2010 Check Point Software Technologies Ltd. | [Confidential] For Check Point users and approved third parties |

Agenda

1 Introducing IAS Bladed Hardware

2 X-Series: Carrier-Grade Chassis

3 Linear Scalability Architecture

4 Selling IAS Bladed Hardware


The New Initiative

Check Point and Crossbeam have announced a new partnership

Crossbeam X-Series platform is now an integral part of the Check Point portfolio

The X-Series products are part of the Check Point price list

Hardware/Software/Support all come from Check Point as an integrated package

Professional Services/Training can also be sold with the package; will be delivered by Crossbeam


Introducing: IAS Bladed Hardware

Customized Security Chassis for yourUnique Security Needs

Delivers carrier-grade platform for security

Single SKU integrated solution and single contact for support

Designed to meet specific business needs

NEW!


Carrier-grade Solution Designed for the Most Demanding Environments Integrates essential Check Point Security Gateway

Software Blades Based on Crossbeam X-series chassis

Customer Benefits

PartnerBenefits

► Single SKU ordering and fulfillment► Expanded portfolio with scalable

chassis solution► Software Blade upsell opportunities

► Integrated carrier-grade chassis solution► Meets the needs of the most

demanding networks► Single source of support


VPN-1 Power VSXDedicated gateway for multi-layer, multi-domain virtualized security

IAS Bladed Hardware—2 Bundle Options

The only virtualized security gateway with FW, VPN, IPS, and

URLF

Best virtualized security performance with linear scalability

Conserves power and space by consolidating up to hundreds of gateways on a single platform

Security Gateway SG805Designed for the most demanding, highest-performance environments

Comprehensive, flexible and extensible security

FW, VPN, IPS, Advanced Networking, and Acceleration &

Clustering

Ideal for the large campus and data center


Integrated superior network processing combined with

exceptional application processing on an open architecture

Crossbeam X-Series

Adapt security performance and scaling to fit your business

Lower total cost of ownership with dramatic network consolidation and

energy consolidation

Decrease downtime with self-healing platform

X80

X45


Flexibility: Hardware and Software

firewall bladeIPSec VPN blade

IPS bladeadvanced networking blade

acceleration & clustering blade

X80 X45

X-Series Scalable

architecture AC/DC power NEBS-compliant Fiber NICs Modular NICs

Modular and Scalable Blade Architecture

VPN-1 Power VSX


Customer Benefits

Single SKU and vendor

FW, VPN, IPS, ACCL, ADN

Better TCO (scalability, lower support rate)

Integrated solutions with software blades

An extended global infrastructure with onsite support

V A

L U

E


Agenda






X80

X45

X80Customers choose for scale and performance

40Gbps Today“Change-Ready” to 160G

X45Customers choose when space is a premium

20G Today“Change-ready” to 80G

APMApplication blades run: Security Gateway R70 VSX R65

CPMControl blades Manage and

monitor the chassis

NPMNetwork connectivity 2 - 10G ports 10 - 1G ports

X-Series Components


X-Series—Modules

Internal chassis management

HA monitoring and failover Dynamic load balancing Centralized configuration

database Dedicated mgt/logging/HA

ports Disk sync between dual

CPMs

Control Processing Modules (CPMs)

Network connectivity and flow processing

Multi-link trunking High-speed packet

classification/distribution Intelligent flow sequencing Built in rate-limiting feature

(per flow rule) Fully VLAN capable; > 4000

VLANs per NPM Multiple port density options

Network Processing Modules (NPMs)

Virtual Application Processor (VAP) system

► Best-in-class security engines

► Full hot-swap with no reconfiguration

► Seamless failover► Warm (license-less)

standby Optional local HD, crypto

accelerator

Application Processing Modules

(APMs)


X-Series—Accessories

Optional ExtrasSFP-Q2-LX-2 Two (2) LX SFP 1G Transceiver (LC Connectors) for NPMs

SFP-Q2-SX-2 Two (2) SX SFP 1G Transceiver (LC Connectors) for NPMs

SFP-Q2-T-3Two 10/100/1000 Copper SFP Transceivers (RJ45 Connectors) for use with NPM-8600 or later.

XFP-Q2-LRTwo (2) LR XFP 10G Transceiver (LC Connector) for NPM-8600 (RoHS Compliant). Use Single Mode fiber

XFP-Q2-SRTwo (2) SR XFP 10G Transceiver (LC Connector) for NPM-8600 (RoHS Compliant). Use Multi-mode fiber

XOS-ARM-710CD

X-Series Routing Software version 7.1 on DVD. Requires XOS 8.5.0 or higher. Includes PIM Sparse Mode, OSPFv2, RIP-II, and BPG-4. Licensed per X-Series Chassis.


The Virtual Infrastructure

What are we solving? How do we solve it? Why is it important? Real use cases

FW

Internet

IPS

L2

L2

LB

LB

LB

LB

Typical multi-box architectures have a lot of duplication

and inefficiency

Security changes require network

changes causing increased time

to change

Difficult to add a new security

service quickly



R70 Blades

Internet

R70 Blades

L2

L2

LB

LB

LB

LB

Crossbeam creates a “Network in a Box” Network Processor Modules Application Processor Modules consolidate

Security Gateway Software Blades or VSX Control Processing ModulesThe X-Series Platform becomes a “virtual

infrastructure” integrating both network processing and application processing within a

single operating system


http://images.google.com/imgres?imgurl=www.trendmicro.co.uk/corporate/images/crlogo1dir.gif&imgrefurl=http://www.trendmicro.co.uk/corporate/directions.htm&h=273&w=260&prev=/images?q=trend+micro&svnum=100&hl=en&lr=&ie=UTF8&oe=UTF8&safe=off

http://images.google.com/imgres?imgurl=www.trendmicro.co.uk/corporate/images/crlogo1dir.gif&imgrefurl=http://www.trendmicro.co.uk/corporate/directions.htm&h=273&w=260&prev=/images?q=trend+micro&svnum=100&hl=en&lr=&ie=UTF8&oe=UTF8&safe=off


Network Processing Module (NPM)

Provides switching fabric for data plane Switching fabric connects all NPMS and APMs 5 Gb/s throughput per NPM-8620 Provides 10 Gb/s throughput per NPM-8650 Provides 40 Gb/s throughput per chassis (4 NPM-8650)

Provides physical network interfaces NPM-8620 has 10 x 1GbE SFP interfaces NPM-8650 has 10 x 1GbE SFP and 2 x 10GbE XFP interfaces

Load balancing distributes traffic Scales throughput by distributing traffic across APMs Re-distributes traffic around failed APMs

Consolidates network infrastructure Virtualizes switches, load balancers, patch and power cords Eliminates common network devices



Application Processing Module (APM)

Hosts applications Supports “Virtual Application Processor” (VAP) Application runs within each VAP

Scales performance Multiple APMs allow multiple VAPs These application instances share the traffic load

Allows layered security Different APMs can run different applications NPM’s network virtualization provides connectivity

between layers

Provides application redundancy VAPs can run on any APM APMs can be re-provisioned on-the-fly Un-provisioned APMs automatically assume warm-

standby role



Control Processing Module (CPM)

System management Provides out-of-band management of chassis Centralized configuration of all elements in the system

Provision applications based on configuration Ensures desired configuration

Health monitoring Continuously checks health of APMs, and NPMs Failover control Collects statistics (CPU, I/O, etc) from all other modules Routes around failures



XOS


Broad support of best-in-class security applications

Optimizes data flow between the network and application processors

Protects and ensures optimum network processing

Optimizes and controls flows between apps

Provides Superior Network Performance

NetworkProcessing Environment

Chassis ResourceProtection

Secure Flow Processing

Switched Data PathManagement

Ensures Exceptional Application Processing

Automatic performance capacity restoration

Allows application performance to scale

independently

Provides a responsive system to application

processing needs

Application Processing

Environment

Self-Healing

Virtual Application Processor / Grouping

Dynamic Resource Allocation

Open Secure OS



A virtual infrastructure Creates a very responsive on-demand architecture Move, add, remove applications without impacting the

network Create logical application groups that can be scaled or

changed depending upon performance demands Self-healing architecture

Green Zone►Reduces waste by removing network inefficiencies►Reduce # Ethernet connections to a single “virtual infrastructure”



Simplifying the Complex


Which Network Rack can be Upgraded Faster?

The X-Series Platform is the entire infrastructure—a single management interface for all security and network changes

Firmware and system software upgrades only need to be applied once using the Automated Workflow System




Solving the Problem Crossbeam collapsed 800 Cisco ASA Firewall appliances into 4 X80

chassis running Check Point VSX National Communications Co. now scales without adding additional

hardware

Business Outcome National Telco was able to reduce the staff required for manage this service

from 12 to just 3

Crossbeam Validation Crossbeam was able to validate up to 250 virtual firewalls running on each

X80 Chassis

The Technical Problem Current managed firewall service to local government education agency

was overly complex, requiring 12 operational staff to maintainNationalCommunicationsNationalCommunications


Agenda






Linear Scalability Architecture

Networking Platforms

Application Server

Platforms


Excellent for controlling the flow of data packets

Poor at actually processing the data

Excellent for processing the data

Poor at controlling the flow of latency-sensitive data

Need to Maintain a Perfect Relationship Between Network and Application Processing in Order to Optimize a System



System Performance

Connections per Second

Total Connections

LatencyMixed Packet

Size Throughput

Application Inspection

Throughput

Application Throughput Under Load


True system scalability demands that every performance factor

scales linearly


Networking Platforms

Integrated network and application processing facilitates true linear scalability

Application Server

PlatformsX-Series

Architecture




APM 8650

Up to 8 CPU Cores per Module

Up to 80 CPU Cores per Chassis

Up to 12.8Gbps of Backplane Connectivity

Up to 16 GB of Memory

Diskless Design• Optional up to 2 HDD‘s available with Raid 1/0

Fully Hot-Swappable

NPM 8650 NPM 8620

Up to 10 GbpsProcessing

Up to 5Gbps Processing

10 Million Flows 8 Million Flows

105,000 Connections per

second

45,000 Connections per

second

320,000 Connections per second / Chassis

Switched Data Paths (SDP)

NPM APM

What are we solving? How do we solve it? Why is it important? Real Use-Cases


Traffic flow controlled down to the individual

processor core


Check Point R70 Performance

The X-Series can scale to 40Gbps firewall throughput with iMIX UDP traffic The X-Series also is the fastest firewall platform on the market in small packet

performance, capable of scaling to 18M Packets Per Second with 64 byte packets


1 APM 2 APM 3 APM 4 APM 5 APM 6 APMs 7 APM 8 APM0

5

10

15

20

25

30

35

40

45

1518Byte ThroughputIMIX Throughput64Byte ThroughputG

bps


Throughput…Think Real WorldG

igab

its

Per S

econ

d

Packet Size

X80 with NPM and APM 8650 Modules Running Check Point R70

1518 1280 1024 768 512 256 128 640.0

5.0

10.0

15.0

20.0

25.0

30.0

35.0

40.0


The X80 Achieves the Maximum Throughput of 40Gbps with Real-World Packet Sizes, Not Just with Large Packets

iMIX Performance


X80 SRX0

20

40

60

80

100

120

Large Packet (1518)

X80 SRX0

20

40

60

80

100

120

iMIX

Platform Performance – Real World

X80 SRX0

20

40

60

80

100

120

Firewall + IPS

X80 iMIX performance doesn’t budge from our max throughput of 40Gbps

SRX throughput for iMIX traffic plummets by nearly 65% Clear demonstration of how

unrealistic the 120Gb claim is

Gig

abits

per

Se

cond

SRX performance drops even further when IPS is turned on

Check Point Firewall + IPS on X80 has always outperformed SRX

The X80 Matches SRX in Real World Performance


At 18 Million Packets per Second,the X-Series is the Fastest Firewall on the Market!

Packet forwarding rate directly affects real-world throughput

This performance is achieved with 8-core APM-8650 modules

Utilizing Check Point CoreXL technology

Platform Performance

X80 SRX02468

101214161820

Mill

ions

of

Pack

ets

per

Seco

nd

Packet Forwarding Rate (64 byte packets)


Scaling Against Juniper SRX

X80 SRX(November 2009 Datasheet)

Packet Rate 18 Million PPS 15 Million PPS

iMIX Throughput 40 Gigabit / Second 45 Gigabit / Second

Firewall + IPS Throughput 40 Gigabit / Second 30 Gigabit / Second

Connectionsper Second 320,000 CPS 350,000 CPS

Total Concurrent Connections 10 Million 10 Million

Large Packet Throughput 40 Gigabit / Second 120 Gigabit / Second


X-Series Wins Against the SRX


IAS Bladed Hardware—Performance Bundles

The 5 Gbps solution—

running on an X45

5 Gbit Solution

The 10 Gbps solution—running on

an X45 or X80

10 Gbit Solution


running on an X45 or X80

20 Gbit Solution


running on an X80

40 Gbit Solution


1-2-1 2-2-1 2-4-1 4-6-1




A linear scalable architecture Provides ability to create an accurate performance

budget and planning for future expansion Dedicated resources can be allocated to specific

applications ensuring performance service levels

Green Zone►Crossbeams witched data paths dramaticallyi ncrease the

efficiency of multi-core processor systems




Solving the Problem Crossbeam used 4th-generation blades to scale the O2 Internet-facing

firewalls to accommodate 6.5 million concurrent connections

Business Outcome O2 is now able to continue to service their existing subscriber base of

22 million and expand service to remain competitive in the UK market

Crossbeam Validation Utilized the Linear Scalability validation test plan to show all performance

metrics increased as firewall VAP group members were added

The Technical Problem Critical need to continually increase throughput and concurrent connections

to keep pace with 3G devices on the mobile network


Agenda






Product Solution Examples L

ist

Pric

e

(10G) (20G) (40G)

$185K

$345K

$640K

X45 Chassis2 NPM 8620

2 APM 8650

1 CPM 8600

2 P/S

2-2-1X80 Chassis2 NPM 8650

4 APM 8650

1 CPM 8600

2 P/S

2-4-1

X80 Chassis4 NPM 8650

8 APM 8650

1 CPM 8600

3 P/S

4-8-1

iMIX Performance

Solution Example: CPAP-X45-2B-SG805 : Check Point IAS X45 Bladed Architecture with 2 Security Gateways (FW, VPN, IPS, ACCL, ADN)

NOTE: These are example configurations. Each deal will require some customization


IAS Bladed Hardware—SG805

High-performance Security Gateway for the Most Demanding Environments

Indicates number of APMs


IAS Bladed Hardware—VSX

Dedicated Gateway for Multi-layer, Multi-domain Virtualized Security


Target Markets

► Large enterprises

► Telecommunication and service providers

► Data-centric, service-based businesses

► Examples include: Pfizer, GSK, Accor

► Compliance requirements► Business continuity demands► Large number of corporate users► Lots of data being transacted► Very complex networks

► $3M+ in annual revenue► 5,000+ employees► More than two data centers► Multiple access points

► Examples include: NTT, British Telecom, O2, Verizon

► Business continuity demands► Massive subscriber or user base ► Fast growing bandwidth demands► Lots of data being transacted► Very complex networks

► $500M in annual revenue ► 5,000+ subscribers► 1,000 employees ► Offers voice, data, managed services ► Focus on customer retention

► Examples include: Scottrade, Heartland Payment Systems, FiServ, DTCC

► Compliance requirements► Business continuity demands► Massive subscriber or user base► Fast growing bandwidth demands► Lots of data being transacted

► $500M in annual revenue ► 5,000+ subscribers► 1,000 employees ► Found across most traditional verticals► Service-based business models


Positioning—What to Sell?

Over 30Gbps firewall performance, carrier-grade, chassis/bladed

architecture

IAS Bladed Hardware

Up to 30Gbps firewall performance

Power-1 or IP Appliances

Up to 30Gbps firewall performance and

solution customization

IAS Appliances (IBM, Fujitsu, HP)


Strategy for Success

Beating the CompetitionJuniper SRX Real-world performance – Performance hit to firewall when measured

against real world traffic Management interface – Cumbersome interface/menus loosely unifies

ScreenOS and JunOS High availability limitations – Choice between high availability and

performance Inspection performance – Traffic throughput drops when IPS turned on

Cisco ASA Performance – Security technology lags in the industry Complexity and cost – Security embedded in each appliance requiring

many appliances Security – May know the network, but not strong around network security


24/7 Support for the Most Critical Environments

DALLASTAC

TEL AVIVTAC

STOCKHOLMEndpoint escalation

TOKYOTAC

OTTAWATAC

• Award-winning support • Always-on 24 X 7

coverage• Best-in-class electronic

support tools • World-wide material

inventory• Online support in 150

countries / 1,000 metropolitan areas


Ordering

All quotes to be processed through Partner Alliance – contact Eran Orzel [email protected]

All quotes require pre-approval from VP Sales and VP Global Field Operations

mailto:[email protected]


Sales Tools

Sales Tools are available on the Product Wiki Customer presentation Technical presentation At-a-glance sales guides And more…

For additional information please contact Partner Alliance


Frequently Asked Questions

► How is this being communicated?

► What about current pipeline opportunities?

► Can the client purchase the solution from Check Point, and the maintenance through Crossbeam?

► Can I reach out to my Crossbeam counterpart? If no, when?

► There is a comprehensive marketing and communication plan developed to ensure information reaches all parts of the channel. Press Release went out on May 4, 2010. Additional communications including emails, newsletters, webinars, and additional forms of social media will be utilized.

► It should be business as usual; however you may want to engage with Crossbeam at your earliest convenience to help progress the deal.

► No, Check Point will be providing Level 1 and Level 2 support for all the deals that are sold through the Check Point channel. Maintenance and Maintenance Renewals will be managed and sold through Check Point. You cannot split up the support from the product offering.

► Yes. It would beneficial to establish a working relationship with the regional sales and technical sales team from Crossbeam as there may be opportunities in the pipeline that can progressed immediately.


Frequently Asked Questions

► In situations where both Check Point and Crossbeam have a relationship with the client, who has priority when reaching out to the client for additional business?

► What is the discount for Check Point partners?

► Are we able to participate in any additional promotions that Crossbeam introduces?

► There is a fixed list of 33 restricted accounts. Activity in these accounts must be coordinated with Crossbeam and through Eran Orzel. For any other accounts, the best approach is to coordinate the sales efforts with the Crossbeam local sales organization.

► Standard Category III

► No. The discounted pricing established in the reseller agreement between Check Point and Crossbeam will be the only discounts made available to Check Point. Any promotions that go on for Check Point sellers will be designed and supported through the Check Point promotional programs.


Summary: IAS Bladed Hardware

Customized Security Chassis for yourUnique Security Needs

Delivers carrier-grade platform for security

Single SKU integrated solution and single contact for support

Designed to meet specific business needs

NEW!

Documents

Integrated Appliance Solution (IAS) Bladed Hardware