Barracuda Web App Firewall 660 Vx Virtual Appliance
Protect Applications and Data from Advanced Threats

Overview:

The Barracuda Web Application Firewall blocks an ever-expanding list of sophisticated web-based intrusions and attacks that target the applications hosted on your web servers—and the sensitive or confidential data to which they have access.

Barracuda Web Application Firewall Vx is a virtual appliance providing complete and powerful security for Web applications and Web sites. It offers every capability needed to deliver, secure and manage enterprise Web applications from a single appliance through an intuitive, real-time user interface.

• Single point of protection for inbound and outbound traffic for all Web applications
• Protects Web sites and Web applications against application layer attacks
• Delivers best practices security right out of the box
• Monitors traffic and provides reports about attackers and attack attempts

	Constant Protection from Evolving Threats The Barracuda Web Application Firewall provides superior protection against data loss, DDoS, and all known application-layer attack modalities. Automatic updates provide defense against new threats as they appear. As new types of threats emerge, it will acquire new capabilities to block them.
	Identity and Access Management The Barracuda Web Application Firewall has strong authentication and access control capabilities that ensure security and privacy by restricting access to sensitive applications or data to authorized users.
	Affordable and Easy to Use Pre-built security templates and intuitive web interface provide immediate security without the need for time-consuming tuning or application learning. Integration with security vulnerability scanners and SIEM tools automates the assessment, monitoring, and mitigation process.

Secure Applications On-Premises or in the Public Cloud

The Barracuda Web Application Firewall provides comprehensive, reverse-proxy-based protection for applications deployed in physical, virtual, or public cloud environments data centers. In addition to applications hosted on-premises, Barracuda Web Application Firewall can natively scale and migrate with applications deployed in public cloud platforms like Amazon Web Services (AWS) and Microsoft Azure.

Available with flexible pricing options including bring-your-own-license and pay-as-you-go via AWS Marketplace and Azure Marketplace, the Barracuda Web Application Firewall is built to can help you seamlessly transition from on-premises to cloud infrastructures while maintaining the same familiar experience.

Protect servers, applications, and data from web-based attacks:

Protect Applications and Data from Advanced Threats

The Barracuda Web Application Firewall blocks an ever-expanding list of sophisticated web-based intrusions and attacks that target the applications hosted on your web servers—and the sensitive or confidential data to which they have access.

Benefits:

Provides Constant Protection from Evolving Threats The Barracuda Web Application Firewall Vx provides superior protection against data loss, application-layer DDoS, and known and previously unknown zero day application-layer attack modalities. As new types of threats emerge, the Barracuda Web Application Firewall Vx will acquire new capabilities to block them. These definitions are automatically updated and will “virtually patch” automatically on units in the field, ensuring the highest security posture for critical applications at all times. This greatly reduces the time between vulnerability disclosure and vulnerability patching. Key Features: Application Attack & DDoS Protection, Automatic Security Updates, Adaptive Profiling, Server Cloaking, XML Firewall, Data Loss Prevention

Simplified Deployment, Automated Security, Greater Agility Time-consuming security audits following every change can slow application development cycles. Barracuda Vulnerability Remediation Service makes managing security policies as easy as 1-2-3: Scan your web applications for vulnerabilities. Instantly remediate all vulnerabilities at the click of a button. Automatically secure code in development with scheduled and on-demand scans. Barracuda Vulnerability Remediation Service generates a report that can be used to automatically configure the Barracuda Web Application Firewall Vx. You can then automate vulnerability scanning to maintain your security posture as your web presence evolves. Key Features: Vulnerability Remediation Service

Granular Identity and Access Management The Barracuda Web Application Firewall Vx has strong authentication and access control capabilities that ensure security and privacy by restricting access to sensitive applications or data to authorized users. Integrated identity access and management pre-authenticates on the perimeter before access is allowed to critical web applications. User access control can be offloaded from multiple applications on a single consolidated device. Detailed audit logging provides clear visibility into user activity across all protected applications. Key Features: Logging & Reporting, LDAP & RADIUS Authentication, Two-Factor Authentication

Intuitive Administration and Management Barracuda Web Application Firewall Vx is designed to be easy and fast to deploy, configure, and manage. Integrations with best-of-breed security tools ensure easy deployments into existing environments while providing granular logging, alerting, and reporting for management, compliance, or early warning detection. It can be deployed in High Availability clusters to ensure maximum application uptime thanks to redundancy and seamless failover capabilities. Key Features: Pre-Built Security Templates, Vulnerability Scanner Integration, Automatic Security Updates, Application Load Balancing and Monitoring

Delivers Maximum Application Uptime and Performance The Barracuda Web Application Firewall Vx can also be deployed in high availability clusters to provide redundancy and seamless failover capabilities in response to outages. It can also monitor application server status and intelligently distribute traffic to ensure high application performance and maximum uptime.

Discover Existing Web Application Vulnerabilities Web application development is a dynamic process, and with features to implement and timelines to meet, security vulnerabilities will inevitably occur. The Barracuda Vulnerability Manager is a non-invasive, web-based scanning tool that quickly discovers application security flaws such as those on the OWASP Top 10, including SQL injection, cross-site scripting, and others. It is provided at no charge by Barracuda. The detailed output of the scan lists all vulnerabilities discovered, ranks them from most to least critical, and provides additional insights to help you address them.

Why Barracuda Web Application Firewall Vx? When selecting security technology, it is critical that your products are supported by people who take your data security as seriously as you do. The Barracuda Web Application Firewall Vx is supported by our award-winning 24x7 technical support staffed by in-house security engineers with no phone trees. Help is always a phone call away. Hundreds of thousands of organizations around the globe rely on Barracuda to protect their applications, networks, and data. The Barracuda Web Application Firewall Vx is part of a comprehensive line of data protection, network firewall, and security products and services designed for organizations seeking robust yet affordable protection from ever-increasing cyber threats.

Features:

Application Attack and DDoS Protection

The Barracuda Web Application Firewall provides robust security against targeted and automated attacks. OWASP Top 10 attacks like SQL Injections and Cross-Site Scripting (XSS) are automatically identified and logged. Administrators have the ability to set granular controls on response, allowing them to block, throttle, redirect, or perform a number of other actions.

Advanced DDoS protection capabilities allow administrators to distinguish real users from botnets through the use of heuristic fingerprinting and IP reputation, thereby allowing them to block, throttle, or challenge suspicious traffic. It is the only product in the industry to offer integrated IP reputation intelligence that combines real-time situational insights and historical intelligence to secure against application DDoS using a variety of risk assessment techniques such as application-centric thresholds, protocol checks, session integrity, active and passive client challenges, historical client reputation blacklists, geo-location, and anomalous idle-time detection.

Adaptive Profiling

Adaptive profiling enables administrators to build positive security profiles of their applications by sampling web traffic from trusted hosts. Once enabled, the positive security profiles allow administrators to enforce granular whitelist rules on sensitive parts of the application. This greatly reduces the risk of attacks and helps prevent zero-day vulnerabilities by restricting input only to inputs that meet strict standards.

Server Cloaking

Often the first step of any targeted attack is to probe public-facing applications to find out details about the underlying servers, databases, and operating systems. Cloaking prevents attack reconnaissance of protected applications by suppressing server banners, error messages, HTTP headers, return codes, debug information, or backend IP addresses from leaking to a potential attacker. Without any details of the underlying infrastructure, it is much more difficult to target attacks, thereby reducing the risk of breach.

Protection for Mobile Applications, REST APIs and AJAX

Mobile application and REST APIs today rely on JSON (JavaScript Object Notation) to transfer data. However, this opens a whole new attack surface which is often overlooked and hard to secure by traditional scan-testing or pen-testing approaches. The Barracuda Web Application Firewall secures the entire attack surface of mobile applications and REST APIs, filters malicious inputs in requests with JSON payloads, helps ensure API SLAs to partners, and provides anti-pharming protection from rogue consumers. Interactive web applications using JSON with AJAX are similarly protected.

XML Firewall

Applications that rely on XML can now be secured with an XML Firewall capability that secures applications against schema and WSDL poisoning, highly-nested elements, recursive parsing, and other XML-based attacks. This secures communications between client and application or between applications from different systems closing an often overlooked attack vector.

Web Scraping Protection

Web Scraping involves copying large amounts of data from a website or application using automated tools. This is often done for commercial advantages that are to the detriment of the organisation that owns the web application. Typically, the motivation of the attacker is to undercut competition, steal leads, hijack marketing campaigns, and appropriate data via the web application. Examples include theft of intellectual property from digital publishers, scraping products and pricing information from e-commerce sites, and stealing listings on real estate, auto dealers and travel sites.

The Barracuda Web Application Firewall protects against web scraping by detecting and blocking malicious bots from accessing the website. Advanced detection techniques include the ability to set honeytraps to identify malicious bots and headless browser detection. Site administrators can also set whitelists for allowing specific bots, such as search engine crawlers to access the website. The Barracuda Web Application Firewall validates all bot traffic against known signatures before allowing them access to the website.

Data Loss Prevention

Deployed as a reverse-proxy, the Barracuda Web Application Firewall inspects all inbound traffic for attacks and outbound traffic for sensitive data. Content such as credit card numbers, U.S. social security numbers, or any other custom patterns can be identified by the Barracuda Web Application Firewall and either blocked or masked without administrator intervention. Best of all, the information is logged and can be used by administrators to find potential leaks.

Iron-clad URL Tamper Prevention via URL Encryption

Attacks on a web-based application often start by analyzing and tampering with its URLs. Barracuda Web Application Firewalls, models 660 and above, come with a unique URL Encryption feature that allows administrators to encrypt URLs before they are sent to clients. The original URLs or the directory structure are never exposed externally to prying eyes. Users of the web applications interact and navigate the site using only encrypted URLs, which are decrypted by the WAF on the way back in. The decryption process immediately identifies URL query or parameter tampering, malicious content injection or blind forceful browsing attacks.

Compliance

The Barracuda Web Application Firewall is designed to provide easy, cost-effective assistance to help administrators comply with major application-specific requirements like PCI-DSS, HIPAA, FISMA, and SOX. It is certified by a number of third-party testing labs including ICSA Labs as an effective Web Application Firewall solution. The Barracuda Web Application Firewall directly satisfies section 6.6 of PCI-DSS and assists compliance with built-in PCI compliance reports. Its robust identity and access management and data loss prevention (DLP) capabilities ensure privacy of sensitive data. A FIPS 140-2 HSM model ensures that applications it protects meet the highest cryptographic standards.

Integrations: Cavium Networks

Vulnerability Scanner Integration

Security organizations often use vulnerability scanners to look for exploitable weaknesses in their applications. Barracuda has the ability to integrate with popular scanners like IBM AppScan and Cenzic Hailstorm to automatically configure an application's security template to protect against identified issues. All of this is automatically configured using the output of the scanners without any administrator intervention.

Integrations: Barracuda Vulnerability Manager, Cenzic Hailstorm, HPE Security WebInspect , HPE Security Fortify On Demand , IBM AppScan.

In addition, the Barracuda Web Application Firewall integrates with over 20 vulnerability scanners via Denim Threadfix integration

Advanced Threat Detection

The Barracuda Web Application Firewall seamlessly integrates with Barracuda Advanced Threat Detection (BATP) to provide security against advanced threats. Simply add BATP to the Barracuda WAF to block advanced zero-hour threats. By analyzing files in a CPU-emulation based sandbox, it can detect and block malware embedded deep inside files uploaded to your web site or web application. At a time when advanced threats like ransomware are causing havoc, BATP ensures defense in depth against malicious threats.

Web-Based Identity and Access Management

The Barracuda Web Application Firewall fully integrates Active Directory or any other RADIUS or LDAP-compatible authentication services. Combined with the strong access control capabilities, administrators can provide granular control over which users or groups are able to access specific resources. For securing Kerberos-enabled environments, it can also perform authentication to the protected web application on behalf of the user, including single-sign-on to multiple Kerberos services.

Streamline Identity Federation with Identity Providers, including Azure AD

The Barracuda Web Application Firewall supports the SAML v2 protocol for authentication and web based single sign-on (SSO), which means that it can act as a SAML Service Provider (SP) to SAML-compliant Identity Providers (IdP), saving you from the complexities of implementing SAML on your web servers. This facilitates SSO between the cloud and on-premise web applications as well as interoperability with Azure AD which supports SAML 2.0.

Two-Factor Authentication

The Barracuda Web Application Firewall integrates with a number of two-factor authentication technologies including client certificates, SMS PASSCODES, and hardware tokens such as RSA SecurID to provide strong user authentication.

Integrations: SMS PASSCODES, RSA SecurID

Client IP Reputation & User Access Control
Using client source addresses, organizations can control access to web resources. The Barracuda Web Application Firewall can control access based on GeoIP to limit access only to specified regions. It is also integrated with the Barracuda Reputational Database and can identify suspicious IP addresses, bots, TOR networks and other anonymous proxies that are often used by attackers to hide their identity and location. Once an IP address is identified as a risk, administrators have the ability to block, limit, throttle, or issue a CAPTCHA challenge before allowing access.

Integrations: MaxMind

Pre-Built Security Templates

Pre-built security templates and an intuitive web interface provide immediate security without the need for time-consuming tuning or learning how to use a new application. Included out of the box are common application templates including Exchange, SharePoint, Oracle Financials, PHP, and more.

Automate and Scale with a RESTful API

With the advent of cloud-based computing, data centers have become increasingly programmable and DevOps is now a key area of focus in network, compute and security tiers. Barracuda Web Application Firewall comes with a REST API that enables you to configure and monitor the appliance programmatically. The functionality of the device is exposed in Representational State Transfer compliant interfaces which can be exercised via any programming language of your choice. REST API allows you to automate, reduce time-to-market and costs by leveraging economies of scale in a programmable environment.

Custom Templates for Increased Productivity

Managing application security policies across multiple units can quickly become an error-prone hassle. The Barracuda Web Application Firewall features security templates that provide the ability to define baseline security settings to use as a model for security policies. By using templates, you can quickly create security policies designed to safeguard a specific application, web-portal, platform, framework or parts thereof. Templates increase productivity, reduce manual errors and deployment time, and ensure policy compliance.

Intuitive, Drill-down Reporting

Powerful graphical reporting provides immediate insight into compliance, threat activity, web traffic and regulatory compliance. More than 50 different pre-defined reports are available, which can be easily customized further, using numerous filters for attack types, traffic, time range, and more.

Generated reports are interactive, with drill-down capability. Reports span PCI compliance, security, audit, web traffic and geo-location analytics. They can be generated on-demand, or scheduled for periodic delivery to multiple recipients over email or FTP.

Comprehensive Logging & Reporting

All client requests, administrator modifications, and firewall actions are logged. This provides a comprehensive audit log for compliance and security policy tuning. Data from the logs are used by the Web Application Firewall to build graphical reports on attacks, web traffic, compliance or a number of other analytical reports. Logs can also be exported to 3rd party analytics suite via Syslog or FTP.

Proactive Risk Monitoring via Customizable Alerts

Scheduling alert notifications for risk monitoring and analysis is an important requirement for proactive security administrators. However, this can quickly become overwhelming with multiple security appliances in the data center. Without any correlation or consolidation, advanced persistent threat (APT) activity can go unnoticed.

To overcome this, the Barracuda Web Application Firewall provides alert consolidation and correlation. Custom notifications can be defined using multiple elements like severity, attack type, application, threshold and frequency (for example, configuring thresholds for SQL Injection frequency on application X and also monitoring forceful browsing for the same application). This ensures that important threat activity does not get drowned in the noise, lowers risk profile and operational costs, and increases productivity. Alert notifications can also be customized for hardware components and individual system modules like Authentication, Admin Activity, SSL, etc.

Automatic Security Updates

The attack definitions and signatures on the Barracuda Web Application Firewall are enhanced by an extensive network of more than 150,000 sensors deployed worldwide, which provide Barracuda Labs with data. The information originating from these sensors provide valuable data that is used by Barracuda Labs to create the current security definitions. These definitions are automatically updated and loaded as virtual patches to the Barracuda Web Application Firewall appliances in the field. These updates ensure the highest security posture for critical applications at all times and greatly reduces the time between vulnerability disclosure and repair vulnerabilities. Automatic updates allow administrators to immediately implement real-time security against new threats; they also provide time to the application development teams to exhaustively analyze the issues in the underlying application and fix vulnerabilities when necessary.

High Availability Clustering

Barracuda Web Application Firewalls can be clustered in active / passive or active / active pairs with failover to ensure instant recovery. Security configurations and deployments are automatically synchronized between the clusters, providing instant recovery from any outages.

Application Load Balancing and Monitoring

Barracuda Web Application Firewall supports load balancing of all types of applications. Load balancing ensures that subsequent requests from the same IP address will be routed to the same back-end server as the initial request. This guarantee of persistence requires an awareness of server health so subsequent requests are not routed to a server which is no longer responding. The Barracuda Web Application Firewall can monitor server health by tracking server responses to actual requests and marking the server as out-of-service when errors exceed a user configured threshold. In addition, the Barracuda Web Application Firewall can perform out-of-band health checks, requests created and sent to a server at configured time intervals to verify its health.

Cloud Edition for Microsoft Azure

When migrating data, applications, and/or workloads to the cloud, administrators still need to safely manage both corporate and customer information. In most cases, organizations are still subject to the privacy and compliance directives of their industry, whether HIPAA, SOX, PCI, or others. By integrating the proven application security and data loss prevention capabilities of Barracuda Web Application Firewall (WAF) with Microsoft Azure’s native security features, administrators are in a superior position to deploy secure, reliable, and resilient cloud services in Azure while meeting any regulatory or compliance needs.

Cloud Edition for Amazon Web Services

The Barracuda Web Application Firewall provides proven application security and Data Loss Prevention for applications deployed on Amazon Web Services. AWS Security Competency certified Barracuda Web Application Firewall integrates with AWS Elastic Load Balancer, Cloud Formation Templates and more to support bootstrapped configuration and autoscaling.

Model Comparison:

The Barracuda Web Application Firewall Vx is available in multiple editions that can handle up to 100 Mbps of traffic. For more capacity and performance, the edition 660 Vx can be easily expanded by licensing added CPU cores on the virtual-host cluster.

Model Comparison	V360	V460	V660	V760	V860	V960
Capacity
Backend Servers Supported	1-5	5-10	10-25	25-50	50-150	150-300
CPU Cores Allowed	2	4	6	8	10	12
Throughput	25 Mbps	50 Mbps	200 Mbps	500Mbps	1Gbps	5Gbps
Features	V360	V460	V660	V760	V860	V960
Security
Response Control
Outbound Data Theft Protection
File Upload Control
Vulnerability Scanner Integration
Protection against Application DDoS Attacks
Bot Defense/ Web Scraping Protection
Network Firewall
JSON Protection
XML Firewall
URL Encryption
Adaptive Profiling
AV for File Uploads
Advanced Threat Protection
Access Control	V360	V460	V660	V760	V860	V960
Authentication and Authorization
LDAP/RADIUS
Traffic Management and Availability
Load Balancing
Caching and Compression
Content Routing
High Availability	Active/Passive	Active/Passive	Active/Passive	Active/Passive	Active/Passive	Active/Passive
Networking
Advanced Routing

* Requires separate license
** Copper/Fiber (MM) NIC options and Hard Bypass options available

Barracuda Virtual Appliance FAQ:

What is a "virtual appliance"?

A virtual appliance is a software image designed to run inside a virtual machine. When deployed inside a virtualization platform, such as VMware, multiple virtual appliances can share the physical resources of a single host computer while remaining logically isolated from each other. Barracuda Networks currently offers virtual appliance versions of many of its popular hardware appliance solutions to leverage the benefits of virtualization.

What are the benefits of Barracuda Virtual Appliances?

Barracuda Virtual Appliances provide the same technology found in the Barracuda Networks hardware solutions and are ideal for enterprises that are standardizing hardware platforms or with existing virtual environments. Barracuda Virtual Appliances can be deployed on standard virtualization platforms and can co-exist with other virtual machines, thereby enabling optimal usage of hardware resources. As the organization grows, virtual appliances can be scaled for capacity without changing any hardware or software configurations. Also, virtual appliances can be easier to backup and restore using standard mechanisms for disaster recovery.

What are the System requirements to run the Barracuda Virtual Appliance?

Currently, Barracuda Virtual Appliances are supported on VMware ESX/ESXi 3.5 Update 2 and higher with a minimum of 512 Mb RAM (1 Gb recommended) and 40 Gb available hard disk space. For information regarding other hypervisors or virtual infrastructures (like VMware Server, CITRIX XenApp, Microsoft Hyper-V), please contact us.

Are Barracuda Virtual Appliances as easy to deploy as the Barracuda Networks hardware appliances?

Yes. Barracuda Virtual Appliances are specifically designed for ease of deployment in new or existing virtualization environments. The virtual appliances are fully encapsulated with the virtual hardware configuration and the setup process is simple. Once the virtual appliance is installed, configuration and administration is through the same intuitive Web based user interface as that on the appliance. Instructions can be found in the online setup guides available as part of the download or under the Documentation section at www.barracuda.com/virtualization.

Do the Barracuda Virtual Appliances receive Energize Updates?

Yes. The Barracuda Networks Energize Updates subscription provides the latest security updates and is an essential part of purchasing either a Barracuda Networks hardware solution or a virtual appliance.

How does an administrator interact with a Barracuda Virtual Appliance?

Once deployed, Barracuda Virtual Appliances are administered through the same simple Web based user interface found on the hardware equivalents. This makes it very easy for administrators of Barracuda Networks hardware appliances to support Barracuda Virtual Appliances without learning a new usage model.

Can I make copies of my Barracuda Networks virtual appliance and deploy them for redundancy?

Every active instance of a Barracuda Virtual Appliance must be supplied a unique license token that is obtained during the process of requesting an evaluation. If you choose the ZIP deployment method, the same ZIP file can be used for multiple deployments, but each deployment must be provisioned with a unique token. Cold backups, snapshots, host migration and other backup or disaster recovery operations are fully supported.

Can I cluster a Barracuda Virtual Appliance with its hardware counterpart?

Yes. The "Linked Management" feature can be used to cluster a combination of Barracuda Virtual Appliances and hardware equivalents as appropriate.

What is an OVF template?

Open Virtualization Format (OVF) is a standard to package and distribute virtual machines. It is a portable, platform independent file format that is supported by several hypervisors. An OVF file encapsulates the complete specification of a virtual machine including all the virtual disks, virtual hardware configuration (CPU, memory, networking) and storage. Barracuda Virtual Appliances are distributed as OVF templates that facilitate quick provisioning with little or no manual intervention.

How do I update the firmware on a Barracuda Virtual Appliance?

New firmware releases will be available periodically and are included in the Energize Updates subscription. Once the virtual appliance is deployed, administrators can check for available firmware releases and upgrade as appropriate.

How are the Barracuda Virtual Appliances priced?

Barracuda Virtual Appliances do not involve any per user or setup fees. A Barracuda virtual appliance is licensed for a certain number of cores. As the organization grows, administrators can easily expand the capacity of these virtual appliances by licensing them for additional cores as needed without the overhead of provisioning any additional hardware or software.

How can I evaluate a Barracuda Virtual Appliance?

A 30-day evaluation copy of any Barracuda Virtual Appliance can be obtained by filling the evaluation request form online at www.barracuda.com/virtualization. This will generate an email with download and activation instructions.

Where can I get more information?

Please contact us!

Documentation:

Download the Barracuda Web App Firewall Vx Series Data Sheet (PDF).