The Nokia IP Firewall line is served in multiple models targeted to small office through Enterprise core deployments. Based on software from Check Point (Check Point VPN-1 Power, Check Point VPN-1 UTM, and Check Point VPN-1 VSX) the appliances include IPv6 support, VRRP redundancy and IP clustering, and remote Web based management capabilities, among other features.

Included with and driving each appliance is the vendor's hardened IPSO operating system, which includes built-in IP routing functionality and IPv6 standard compliance. Additionally, the appliances can be managed remotely through the Web via the vendor's Network Voyager software; and multiple appliances can be centrally managed via Nokia Horizon Manager software. CLI management is also supported.

Key features shared by each of the appliances include:

- Stateful inspection engine for traffic inspection from the data to the application layer

- IPv6 support

- HA features including support for VRRP (Virtual Router Redundancy Protocol), an active-active configuration that automatically and transparently maintains a hot-standby appliance should one of the appliances fail; and IP clustering which allows up to 4 appliances to be clustered and managed via a single IP address.

On top of the base firewall offerings, the vendor offers additional features for selected models of the firewalls; providing virtual firewall or intrusion prevention specific capabilities.

The virtual firewall line consists of the 390, 560, 1220, 1260, and 2255 models as of this writing and allow multiple firewalls--each with independent policy settings--to be implemented within a single physical appliance. This virtual firewall capability is enabled via Check Point VPN-1 VSX.

For Intrusion Prevention, the vendor combines their IP firewalls with Sourcefire Intrusion Prevention software (Sourcefire Intrusion Sensor, Sourcefire RNA Sensor and Sourcefire Defense Center) and a specialized version of their OS (IPSO-LX). Currently, the 290, 390, and 690 models (the 290 and 690 are new) are offered in the Intrusion Prevention line.

A sampling of the currently available Nokia firewall appliances:

- IP45: Supporting firewall traffic throughput of 70 Mb/sec and VPN (3DES) traffic at 15 Mb/sec. The IP45 is offered in four licensing flavors, supporting from 8 to an unlimited number of firewall nodes and up to 10 VPN tunnels.

- IP1220: Supporting firewall traffic at up to 2.4 Gb/sec and VPN forwarding at 750 Mb/sec.

- IP560: Delivering over 6 Gb/sec of firewall throughput and 1.9 Gb/sec encrypted VPN traffic via a four port 1000Base-T Ethernet card (up to 16 GbE ports optionally supported). The IP560, as are several other models in the IP line, is available in disk or disk-less (flash-based) versions for storage and logging. The IP560 supports up to 58,000 connections per second.

- IP690: With firewall throughput of up to 7 Gb/sec and VPN (AES/256) performance up to 1.85 Gb/sec. The base system ships with a 4-port 1000Base-T card; while 2-port 1000Base-LX, 1000Base-SX, and 1000Base-T; and 4-port 10/100Base-TX and 1000Base-TX interfaces are listed as optional.

- IP2255: The top of the line model, with firewall forwarding throughput listed at 8.9 Gb/sec and VPN forwarding listed at 2.3 Gb/sec. The IP2255 is a modular offering, supporting the addition of up to 4 cards (available card options include 8-Port 10/100 Ethernet, 4-port GigE (1000Base-T, 1000BaseSX MMF), 1-port 10 Gig Fiber MMF, and an encryption card).

The Nokia IP firewalls are available now. The new IP290 and IP690 Intrusion Prevention models are priced at $3,995 and $29,995, respectively.

Visit the Nokia Web site for further information.