Features:
Advanced Threat Detection
While traditional solutions usually detect network threats after they have breached the network, by sending log notifications to the administrator, the Barracuda Advanced Threat Detection (ATD) implements full system emulation, which provides deep visibility into malware behavior. Files are checked against a cryptographic hash database that is constantly updated. In case the file is unknown, it is emulated in a virtual sandbox where malicious behavior can be discovered.
The Barracuda ATD offers Administrators granular, file-type-based control including automatic quarantine and blacklisting features to maintain the highest level of protection for an organization's network.
The Barracuda Advanced Threat Detection is an optional subscription.
Application Control 2.0
The Barracuda CloudGen Firewall provides a powerful and extremely reliable detection and classification of more than 1,200 applications and sub-applications by combining Deep Packet Inspection (DPI) and behavioral traffic analysis – no matter if the protocols are using advanced obfuscation, port hopping techniques, or encryption. It allows the creation of dynamic application policies and facilitates establishing and enforcing acceptable access and use policies for users and groups by application, application category, location, and time of day. Administrators can now:
- Block unwanted applications for certain users or groups
- Control and throttle acceptable traffic
- Preserve bandwidth and speed-up business-critical applications to ensure business continuity
- Enable or disable specific application sub-functions (e.g., Facebook Chat, YouTube Postings, or MSN file transfers)
- Intercept SSL-encrypted application traffic
The Barracuda CloudGen Firewall features advanced application-based routing path selection and Quality of Service (QoS) capabilities. These provide additional business value in addition to security by significantly improving network quality and availability, as well as reducing direct line cost due to bandwidth saved.
For rich reporting and drill-down capabilities, the Barracuda CloudGen Firewall comes with real-time and historical application visibility that shows application traffic on the corporate network, thus providing a basis for deciding which connections should be given bandwidth prioritization, crucial for QoS optimization for business-critical applications. Furthermore, it allows adjusting and refining the corporate application use policies.
Deep Application Context
The deep application context analysis allows for deeper inspection of the application data stream by continually evaluating the actual intention of applications and the respective users. By this means administrators can gain detailed insight into what a specific application was used for or if a user was trying to circumvent the corporate application usage policy.
Personalized Application Control
On top of the 1,400+ applications that are delivered out of the box and constantly updated, the Barracuda CloudGen Firewall provides a way to easily create user-defined application definitions for best-in-class application control customized and tailored to an organization's specific needs.
User Identity Awareness
Different network users may need different bandwidth-use rules. Most often, access to certain network resources is limited to certain users or user groups. Preferential allocation of more bandwidth to certain users or user groups and a limitation of available bandwidth for others is a common requirement. It requires the network device to know what user an IP actually belongs to. Barracuda CloudGen Firewalls are fully user-identity aware by linking a user to one or several IP addresses. Any role assignments that result from identity and device posture checks communicated to the firewall by our health agents can be used within the firewall to facilitate role-based access control (RBAC). Barracuda CloudGen Firewalls support authentication of users and enforcement of user-aware firewall rules, web filter settings, and Application Control 2.0 using Active Directory, NTLM, MS CHAP, RADIUS, RSA SecurID, LDAP/LDAPS, TACACS+, as well as authentication with x.509 certificates.
Reporting
The Barracuda NG Report Creator is a free tool that allows administrators to collect and consolidate traffic and application usage statistics from multiple Barracuda CloudGen Firewall units and to create easy-to-read reports in pdf format. Report tasks can be scheduled at various times during the day or week and distributed automatically via email. Besides predefined out-of-the-box reports such as Top Applications, Top Blocked URL Categories and Websites, Top Users by Bandwidth, as well as activity reports for specific users, the reporting engine provides customizable granular reports on user activity, activities during last day/week/month, etc.
For auditing reasons IP addresses can be anonymized.
Intrusion Detection and Prevention
The Barracuda CloudGen Firewall Intrusion Detection and Prevention System (IDS/IPS) strongly enhances network security by providing complete and comprehensive real-time network protection against a broad range of network threats, vulnerabilities, exploits, and exposures in operating systems, applications, and databases preventing network attacks such as:
- SQL injections and arbitrary code executions
- Access control attempts and privilege escalations
- Cross-Site Scripting and buffer overflows
- Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks
- Directory traversal and probing and scanning attempts
- Backdoor attacks, Trojans, rootkits, viruses, worms, and spyware
By providing advanced attack and threat protection features such as stream segmentation and packet anomaly protection, TCP split handshake protection, IP and RPC defragmentation, FTP evasion protection, as well as URL and HTML decoding, the Barracuda CloudGen Firewall is able to identify and block advanced evasion attempts and obfuscation techniques that are used by attackers to circumvent and trick traditional intrusion prevention systems.
As part of the Barracuda Energize Updates subscription, automatic signature updates are delivered on a regular schedule or on an emergency basis to ensure that the Barracuda CloudGen Firewall is constantly up-to-date. If the firewall unit is centrally managed, the pattern updates are conveniently distributed by the Barracuda NG Control Center.
Denial of Service (DoS) and Distributed Denial of Service (DDoS) Protection
In today’s world of omnipresent botnets, one of the main tasks of perimeter protection is to ensure ongoing availability of the network for legitimate requests and to detect and repel malicious denial of service attacks. With TCP SYN Flood Protection, the Barracuda CloudGen Firewall effectively functions as a generic TCP proxy, forwarding only legitimate TCP traffic to the inside of the network. Additionally, the Barracuda CloudGen Firewall allows the definition of a rate limit that is applied to the maximum number of sessions per source address to be handled by the firewall. Packets arriving at a rate faster than allowed will simply be dropped. In a massive DDoS attack, the attackers may simply aim for saturating the link by transmitting vast numbers of UDP packets. The integrated environmental monitoring feature of the Barracuda CloudGen Firewall diagnoses such conditions by link and target address monitoring. Once the response of a remote target address to regular ICMP probing fails, the system can be configured to activate different routes and uplinks (for example backup line, ISDN, xDSL). Using this feature, traffic will be unimpeded across unaffected lines and crucial site-to-site and site-to-Internet connectivity remains operational.
Web Filtering
The Barracuda Web Filter enables highly granular, real-time visibility into online activity, broken down by individual users and applications, letting administrators create and enforce effective Internet content and access policies. It protects user productivity, blocks malware downloads and other web-based threats, and enables compliance by blocking access to unwanted websites and servers, providing an important additional layer of security alongside application control.
Malware Protection
Barracuda Malware Protection shields the internal network from malicious content by scanning web content (HTTP and HTTPs), email (SMTP, POP3), and file transfers (FTP) via two fully integrated antivirus engines. Malware protection is based on regular signature updates as well as advanced heuristics to detect malware or other potentially unwanted programs even before signatures are available. Barracuda Malware Protection covers viruses, worms, trojans, malicious java applets, and programs using known exploits on PDF, picture and office documents, macro viruses, and many more, even when using stealth or morphing techniques for obfuscation.
Application-Based Link Selection
The combination of next-generation security and adaptive WAN routing allows the Barracuda CloudGen Firewall to dynamically assign available bandwidth for several links not only based on protocol, user, location, and content, but also based on applications, application categories and web filter categories. This keeps expensive, highly available lines free for business and mission-critical applications, while significantly reducing response times and freeing up additional bandwidth.
Traffic Shaping and Quality of Service
Limited network resources make bandwidth prioritization a necessity. The Barracuda CloudGen Firewall provides strong Quality of Service (QoS) that lets the administrator apply quality aspects and service guarantees to selected traffic flows within the WAN. QoS is often used to prioritize the network traffic of applications that are critical and must not be affected by the network traffic of other applications. The Barracuda CloudGen Firewall provides a large set of QoS techniques, such as traffic shaping, traffic prioritization, and bandwidth partitioning, which assigns a bandwidth limit to certain types of traffic. To select traffic for different priority classes, the available real-time traffic analysis can be used to identify whether network traffic was sent by business-critical applications or by potentially unwanted applications.
Failover and Link Balancing
To ensure the best and most cost-efficient connectivity, the Barracuda CloudGen Firewall provides a wide range of built-in uplink options such as unlimited leased lines, up to four xDSL uplinks, etc. By eliminating the need to purchase additional devices for link balancing, security conscious customers will have access to a WAN connection that never goes down, even if one or two of the existing WAN uplinks are severed. Further, traffic intelligence mechanisms make sure the next defined uplink is activated on the fly and all traffic is rerouted to make full use of the remaining lines. In the event that backup lines provide less bandwidth, intelligent traffic shaping automatically prioritizes business-critical applications, networks, or distinct endpoints.
WAN Optimization
The Barracuda CloudGen Firewall can significantly enhance the WAN performance of distributed network environments by improving availability, performance, and response time of business-critical applications by lowering throughput and transmission delays, affecting time-sensitive decisions and enterprise profitability. The next-generation networking concept of the Barracuda CloudGen Firewall provides a set of powerful features to efficiently reduce and offset the negative effects of high line latencies and response times. By implementing enterprise-grade WAN acceleration features such as data deduplication, traffic compression, and protocol optimization, the Barracuda CloudGen Firewall can significantly improve site-to-site WAN traffic and increase productivity by accelerating the delivery of business applications - at no extra charge. WAN traffic can be effectively compressed up to 95 percent, significantly reducing the bandwidth needed at remote locations while increasing network responsiveness.
Microsoft Azure
Besides VMware, KVM, and XenServer, the Barracuda CloudGen Firewall is fully compatible for use in Windows Azure for establishing site-to-site and/or client-to-site connections to Azure and creating a DMZ in Azure to implement an additional high-security layer.
As organizations have adopted virtualization for their server infrastructures, there has been a corresponding trend to extend the benefits of virtualization to the security layer. Barracuda’s award-winning security solutions are available as virtual appliances to help organizations.
Barracuda CloudGen Firewall virtual appliances are complete solutions, eliminating the need for installing, configuring, and integrating disparate operating systems, databases, system management, and application software. In addition, Barracuda virtual appliances come “locked down” from a security perspective, built from the ground up on the Barracuda OS, a hardened Linux operating kernel and optimized to run seamlessly within virtualized environments.
Amazon EC2
Besides VMware, KVM, and XenServer, the Barracuda CloudGen Firewall is fully compatible for use in Amazon Elastic Compute Cloud (EC2).
As organizations have adopted virtualization for their server infrastructures, there has been a corresponding trend to extend the benefits of virtualization to the security layer. Barracuda’s award-winning security solutions are available as virtual appliances.
Barracuda CloudGen Firewall virtual appliances are complete solutions, eliminating the need for installing, configuring and integrating disparate operating systems, databases, system management, and application software. In addition, Barracuda Networks virtual appliances come “locked down” from a security perspective, built from the ground up on the Barracuda OS, a hardened Linux operating kernel and optimized to run seamlessly within virtualization environments.
BYOD (Bring Your Own Device)
The influx of private computing devices, from smartphones to laptops and tablets, into the workplace may help increase productivity, flexibility, and convenience. However, BYOD adds new security challenges and risks, such as enabling and controlling access, as well as preventing data loss. The Barracuda CloudGen Firewall provides strong capabilities to give users the full advantage of their devices while reducing possible risks to the business. Unwanted applications can be blocked, LAN segmentation can protect sensitive data, and network access control can check the health state of each device connecting to the corporate network.
Secure Remote Access
The Barracuda CloudGen Firewall incorporates advanced site-to-site and client-to-site VPN capabilities, using both SSL and IPsec protocols to ensure remote users can easily and securely access network resources without complex client configuration and management. Every Barracuda CloudGen Firewall unit supports an unlimited number of VPN clients at no extra cost. The Barracuda VPN client also provides the ability to enforce Windows Security Center settings on client machines running Windows. This allows administrators to centrally enforce the usage of Windows Security settings on PCs. The enforced policies can include enabling the Microsoft Network Firewall, Windows Updates, Windows Virus Protection, Windows Spyware Protection, and Internet Security Settings.
Barracuda VPN Clients are available for Microsoft Windows, Mac OS, and various Linux systems.
Network Access Control
The optional Barracuda CloudGen Firewall SSL VPN and NAC subscription adds a customizable and easy-to-use portal-based SSL VPN as well as sophisticated Network Access Control (NAC) functionality.
The Barracuda Network Access Client, when used with the Barracuda CloudGen Firewall, provides centrally managed Network Access Control (NAC) and an advanced personal firewall. This allows enforcement of minimum Windows client security prerequisites before being allowed access to the network or access to a quarantine network. Security posture can be specified according to available Windows patch level, availability of antivirus and/or anti-spyware, and user ID. Access restrictions are enforced locally on the client by the centrally managed personal Windows firewall as well as at the gateway. Using existing Barracuda CloudGen Firewall appliances, Barracuda Networks offers a ready-to-use Network Access Control framework without expensive investments into the basic network infrastructure. All Barracuda Network Access Clients as well as all Barracuda CloudGen Firewall units acting as policy servers can be administered, monitored, and reviewed from a single Barracuda NG Control Center.
Scalable Deployment
Managing the security issues in a widely distributed enterprise network can be painful and extremely time-consuming. Managing a system may take only 15 minutes per day. But having 20 firewall systems in place results in five hours per day – just to manage the existing system. With the Barracuda NG Control Center, managing mulitple Barracuda CloudGen Firewalls takes the same amount of time as managing one.
- Create pre-configured templates for easy-rollout.
- Have all information about the enterprise security deployment available in real time.
- Create reports of either one or all Barracuda CloudGen Firewalls.
Lifecycle Management
Scalable Barracuda CloudGen Firewalls offer companies sustainable investment protection. Energize Updates automatically provide the latest firmware and threat definitions to keep the appliance up to date. With a maintained Instant Replacement subscription, organizations receive a new appliance with the latest specs every four years.
Revision Control System, Audit, and Reporting
The integrated revision control system increases auditing ease for the infrastructure and cuts overhead.
Additionally, the revision control system for all changes provides compliance with governmental and company policy requirements.
Comprehensive reporting makes bandwidth usage and all other security-related information visible, reportable, and easy to read.
Mobile Portal
Gain easy access to your organization’s applications via SSL VPN connections. Barracuda‘s Mobile Portal enables you to set up shortcuts on the home screen of devices such as smartphones or tablets. When accessing the portal via the web browser on a mobile device, users can browse apps, network folders and files as if they were connected to the office network.
The Mobile Portal supports most commonly used devices, e.g., Apple iOS, Android, and Blackberry devices.
Barracuda’s Mobile Portal is an optional feature included with an “SSL VPN and NAC” subscription.
CloudGen Firewall Technology:
The first Cloud-Generation Firewall
More and more companies all over the world adopt and integrate public cloud offerings into their network. But “before you can work in the cloud, you have to get to cloud” has never been more true than today. Shifting workloads to cloud based services, regardless if Software as a Service (SaaS), Platform as a Service (PaaS) or Infrastructure as a service (IaaS) exposed a different set of requirements WAN Edge and network security devices today need to address: Optimizing connectivity for business critical applications, enforcing higher security levels than ever and reducing cost by moving away from expensive MPLS lines. Because traditional WAN edge and security products did not adapt to these new challenges, a new set of solutions enabling cost efficient connectivity across the cloud-enabled WAN has emerged: SD-WAN. However, SD-WAN typically does not adress security-related aspects. It is considered more like a connectivity solution that works besides the security solution - at best. Just like different species.
Barracuda CloudGen Firewalls F are the first to combine full NextGen Security with the Connectivity optimization and cost savings potentials of a full SD-WAN solution onto one single easy to manage hardware, virtual or cloud based appliance. The F-Series’ cloud-ready firewalls improve site-to-site connectivity and enable uninterrupted access to applications hosted in the cloud all while simplifying the administration of network operations for enterprises and managed services providers.
The Barracuda CloudGen Firewall F-Series achieves this by tightly integrating a comprehensive set of nextgeneration firewall technologies, including Layer 7 application profiling, intrusion prevention, web filtering, advanced threat and malware protection, spam protection and network access control. Yet on top of these cutting-edge next-generation firewall capabilities, the F-Series’ highly resilient VPN technology combined with intelligent traffic management and WAN Compression capabilities allow customers to save line costs and increase overall network availability.
All pieces of the solution are centrally manageble across all platforms and release versions, reducing ongoing adminitrative overhead and ensuring policy compliance and enforcement across the wide area network.
- Consolidated Security without Compromise: All F-Series Firewalls provide comprehensive next-generation firewalling including Application Control and User Awareness, full Mail & Web Security Gateway functionality, Malware Protection, Botnet and Spyware detection, TypoSquatting & Link Protection, Sandboxing (Advanced Threat Protection), URL Filter, and file type policy enforcement. All this combined with unbeatable Network Security and packed into a single, powerful appliance. The tight integration of web security and network security features enables advanced functionalities, such as prioritizing certain application traffic based on user/group info and time information, and allowing certain applications to go out via predefined uplinks only
- Cloud Ready: The ongoing shift of IT workloads to cloud services in order to increase flexibility and reduce costs requires a reliable, cost-effective extension of the company WAN to the cloud. This applies to headquarters as well as direct Internet breakouts at every branch location. Barracuda CloudGen Firewall F-Series models come fully featured for all common cloud IaaS providers, as virtual appliances, and in a variety of hardware appliances for even small offices. Hybrid WAN and cloud-only networks can thereby also benefit from the F-Series.
- Secure SD-WAN Capabilities: Significantly increase uplink and WAN network reliability and performance by using and aggregating up to 24 active, load-sharing connections of any type (broadband, 4G, MPLS between locations). WAN optimization functionality including data deduplication and caching, traffic compression and application acceleration increase available bandwidth far beyond the sum of all available physical uplinks combined. Dynamic, on-the-fly adjustments of QoS and application usage policies depending on dynamic bandwidth measurement make sure there will always be enough bandwidth for business-critical applications. And with Zero Touch Deployment even the largest rollouts are easy to execute.
- Unified Remote Access: Access to applications - regardless if hosted in the cloud or on premises - is commonly expected not only from within the company network but from any remote location or mobile device. Barracuda CloudGen Firewalls include zero-touch for remote access, unified remote-access clients for macOS, Windows, iOS, and Android devices to make sure employees enjoy fast and reliable access to corporate applications from inside the network – and anywhere else, too.
- Once Only Central Management: The entire Barracuda CloudGen Firewall F-Series infrastructure, regardless if only a few devices or a couple thousand distributed across thousands of locations and multiple deployment types, can be deployed, managed and monitored from a single pane of glass through the Barracuda NextGen Control Center. Managing several hundreds of firewalls requires the same effort as managing one firewall.
- Unparalleled Cost Savings: Barracuda CloudGen Firewalls consolidate security, SD-WAN, link balancing, and WAN compression disciplines into a single appliance that provides significant cost savings due to the reduction or elimination of expensive leased lines and consolidation of security devices. Even for small rollouts of only a few devices, customers achieve a return of investment after just a few months, while thousands of dollars can be saved over the course of the next few years.
Next Generation Firewall Functionality: Application and User Identity Awareness
Full Application Awareness
Mobile devices, online applications, social networks, and streaming media have caused an enormous increase in non-business network data traffic, pushing bandwidth capacities to their limits and causing degradation in performance of business-critical applications.
Application Control built into every Barracuda CloudGen Firewall allows admins to accurately identify and control thousands of protocols and applications (like software updates, BitTorrent, Skype, instant messaging etc.) crossing the network and not visible with regular port-based firewalls. The Barracuda CloudGen Firewall F-Series gives administrators granular control over applications. They can define rules for forwarding application traffic using the most suitable uplink based on type of application, user, content, time of day, and even geographical location. Unsanctioned applications can be reliably blocked or bandwidth throttled to an acceptable level.
Deep Application Context
Deep application context analysis enables deeper inspection of the application data stream by continually evaluating the actual intentions of applications and the respective users. For example, if a user attempts to use an application like “hidemyass” to bypass traditional web filtering, Barracuda CloudGen Firewalls cannot only block the application itself, but also report the website the user originally attempted to connect to.
Custom Application Definitions
On top of thousands of applications that are delivered out of the box and constantly updated, Barracuda CloudGen Firewalls provide an easy way to create userdefined application definitions. For example, admins can allow just a very limited set of Facebook apps while blocking all others, or assign more bandwidth to homegrown or legacy business systems.
Application-Based Routing
A unique combination of next-generation security and adaptive WAN routing technology allows the Barracuda CloudGen Firewall F-Series to dynamically assign available bandwidth, uplink, and routing information based not only on protocol, user, location, and content, but also on applications, application categories, and even web content categories. This keeps expensive, highly available lines free for business- and missioncritical applications, while significantly reducing response times and freeing up additional bandwidth.
Block unwanted applications, control acceptable traffic, and ensure business continuity
Real-Time Application Reporting and Manipulation
For on-the-fly reporting and drill-down capabilities, Barracuda CloudGen Firewalls come with real-time and historical application visibility that show live and recent application traffic on the corporate network that can be interactively filtered and drilled down. This helps admins to decide which application connections should be given bandwidth prioritization and who is currently violating acceptable use policies.
Application Risk and Usage Report
The Application Usage and Risk Report is one of many predefined reports in the free Barracuda Report Creator tool that provides automated reports and risk analysis based on the network traffic traversing the network. It gives an overview of how effective the currently deployed policies are in detecting and enforcing corporate application usage policies and even provides recommendations of what actions should be taken to improve these policies.
Barracuda CloudGen Firewalls can easily be deployed risk free into existing networks to collect data required for generating such reports by using either a Layer 2 network bridge or SPAN Port / Port Mirroring deployment. No matter what method is used, collecting the traffic has no impact on the firewall performance at all.
Creating reports can be started manually (on-demand) or scheduled (including automated email distribution). And - of course - reports are fully customizable to comply with possible branding requirements.
Full User Identity Awareness
Barracuda CloudGen Firewalls combine application control with seamless support for all commonly used authentication schemes such as Active Directory, RADIUS, and LDAP/S. That means reporting can be done based on user and group membership (instead of source IP addresses), and firewall and application policy rules can easily be created for individual users and groups.
Web Security Gateway
Advanced Threat Protection
Barracuda’s Advanced Threat Protection (ATP) uses nextgeneration sandbox technology including full-system emulation to catch advanced persistent threats, zeroday malware, and all advanced malware designed specifically to evade detection. Advanced Threat Protection on Barracuda CloudGen Firewalls ensures flexible and simple deployment into existing networks because no additional hardware is required. Resourceintensive sandboxing is offloaded to the Barracuda Advanced Threat Protection Cloud with its multiple datacenters in the Americas, mainland Europe, and the UK. A hash fingerprint of each file and the good/bad classification of all sandboxed files are stored and cached for future use, effectively speeding up processing and guaranteeing near instantaneous results. Over 95% of all files checked by the ATP service have typically been seen before and only very few files need processing.
Since the Barracuda Advanced Threat Protection cloud database cache is continuously updated by tens of thousands of Barracuda NextGen Firewalls, Email Security Gateways, Web Security Gateways and Barracuda Essentials, the Barracuda ATP service provides a true worldwide early detection grid for newly emerging malware.
With Advanced Threat Protection on Barracuda NextGen Firewalls, the firewall administrator has full policy control over how PDF documents, Microsoft Office Files, EXEs/MSIs/DLLs, Android APKs, compressed files, and archives are emulated and delivered to the client. Based on identified malware activity, infected users can be automatically quarantined, thereby preventing the malware from spreading within the network. Customizable, on-demand analysis reports for any emulated file provide full insight and details on malicious activities, file behavior, system-registry entries, and evasion and obfuscation techniques. This also enables network activities such as establishing encrypted connections to botnet command and control centers for increased security posture to evade scaled botnet attacks.
Botnet and Spyware Protection
In combination with the Advanced Threat Protection cloud database, all Barracuda Next Gen Firewall F-Series provide protection against botnet infections. The F-Series detects potentially infected clients based on DNS requests. Once an infected client is detected, it can be isolated automatically, and an alert can be created or reported with the Barracuda Report Creator.
TypoSquatting & Link Protection for Email
This important feature of ATP adds protection for two rising threats: uncovering misleading and misspelled links. The link protection component automatically rewrites deceptive URLs in email messages to a Barracuda-validated URL and informs the requesting user on this change via a warning page displaying all the details about the blocked URL. TypoSquatting is a common trick to fool users into clicking on a link to a known source although the link is misspelled (e.g., examlpe.com), comes with a different top-level domain (e.g., example. org), or contains special characters (e.g., greek character rho for “p” - examρle.com), etc.
Web Filtering
Web filtering on the Barracuda CloudGen Firewall F-Series is included with the Energize Updates subscription and enables highly granular, real-time visibility into online activity, broken down by individual users and applications, thereby letting administrators create and enforce effective Internet content and access policies. Web filter functionality with the Barracuda NextGen Firewall F-Series protects user productivity, blocks malware downloads and other web-based threats, enables compliance by blocking access to inappropriate websites and servers, and provides an additional layer of security alongside application control.
Safe Search Enforcement
Many search engines have a safe search setting that filters out adult search results such as inappropriate images and videos in search query return traffic. On Barracuda CloudGen Firewalls customers can easily activate Safe Search Enforcement so that the firewall will enforce safe search settings for all common search providers such as Google, Yahoo, and Bing, and even within YouTube. Search engines not supported can easily be blocked. This functionality is even effective within SSL-encrypted search engines like google.com if SSL Inspection (included with all Barracuda CloudGen Firewall F-Series) is activated.
Google Apps Accounts Enforcement
In some cases, users with their own Google Apps account may be able to circumvent Safe Search enforcement settings by logging in from their workstation with their own Google Apps account. To prevent this, all Barracuda CloudGen Firewalls enforce and limit Google Apps Accounts logins only for a list of predefined Apps accounts easily created the administrator.
Mail Security Gateway
Mail is still one of the most common ways of spreading malware. Barracuda CloudGen Firewalls include all necessary means to prevent incoming email to the corporate mail server from being infected.
Barracuda CloudGen Firewall mail security includes malware scanning, Advanced Threat Protection, and basic spam filtering via DNS blacklisting of known mail senders and malware domains.
Malware Protection
The optional Malware Protection shields the internal network from malicious content by scanning web content (HTTP and HTTPs), email (SMTP, POP3), and file transfers (FTP) via two fully integrated antivirus engines. Malware protection is based on regular signature updates as well as heuristics to detect malware or other potentially unwanted programs even before signatures are available. The malware protection covers viruses, worms, Trojans, malicious Java applets, and programs using known exploits on PDF, pictures and office documents, macro viruses, and many more, even when using stealth or morphing techniques for obfuscation.
File Content Enforcement
The Barracuda CloudGen Firewall F-Series includes true file type detection and enforcement capabilities based not only on extension and MIME type, but also on sophisticated true file type detection algorithms. Bypassing executable files by renaming or compressing is detected and blocked. Besides blocking / allowing connections, the CloudGen Firewall F-Series also lets admins change download priorities . For example, if an ISO image started downloading with normal web traffic priority, the admin can increase or decrease the assigned bandwidth for the download, even though the user started downloading via a regular web- browsing session.
Network Security
Intrusion Detection and Prevention
Every Barracuda Next Generation firewall includes a built-in Intrusion Detection and Prevention System (IDS/IPS) that provides complete and comprehensive real-time network protection against a broad range of network threats, vulnerabilities, exploits, and exposures in operating systems, applications, and databases, thereby preventing network attacks such as:
- SQL injections and arbitrary code executions
- Access control attempts and privilege escalations
- Cross-site scripting and buffer overflows
- DoS and DDoS attacks
- Directory traversal and probing and scanning attempts
- Backdoor attacks, Trojans, rootkits, viruses, worms, and spyware
By providing advanced attack and threat protection features such as stream segmentation and packet anomaly protection, TCP split handshake protection, IP and RPC defragmentation, FTP evasion protection, as well as URL and HTML decoding, the Barracuda CloudGen Firewalls can identify and block advanced evasion attempts and obfuscation techniques that are used by attackers to circumvent and trick traditional intrusion prevention systems. As part of Barracuda’s Energize Updates subscription automatic IPS signature updates are delivered on a regular schedule or on an emergency basis to ensure that the Barracuda CloudGen Firewalls are constantly up-to-date.
Dos/DDos Attack protection
Every Barracuda CloudGen Firewall F-Series comes with a host of built-in network protection functionalities beyond firewalling and IPS to protect networks and resources against malicious over-exhaustion. TCP SYN flooding attacks are automatically prevented by predefined connection attempt limits that are configurable separately for outbound and inbound accept policies.
To further guard against regular DoS/DDoS attacks, the maximum number of new sessions and the allowed total number of sessions from a single source can be specified. This protects against resource exhaustion of your firewalls as well as the servers and networks behind them. These settings are configurable on a perrule basis, thereby ensuring that protected servers with higher loads like web servers may be fully utilized.
Cloud Enablement
The exponential growth in cloud computing offerings has driven more and more organizations to consider adopting a hybrid network WAN with new workloads being deployed predominantly to the cloud. Potential cost savings and the ability to scale up and down are attractive cloud propositions, but the real reason companies move to the cloud is the ability to push products to the market much more quickly.
To fully experience cloud computing benefits, Barracuda CloudGen Firewalls help organizations apply the same levels of security and connectivity as if the new network were in the local, on-premises datacenter.
Secure Connectivity to the Cloud
Barracuda CloudGen Firewalls are designed from the ground up to enable access to cloud applications by utilizing a unique combination of link bonding, dynamic application prioritization, application-based uplink selection and WAN Optimization techniques to improve the WAN network performance to the cloud, regardless of office type or remote mobile locations.
Deploying Multi-Tier Architectures
Segmenting cloud networks into multiple tiers provides security, visibility, and compliance for on-premises applications. Additionally, this can be leveraged when the applications are deployed in public cloud environments through the Barracuda CloudGen Firewall F-Series. The Barracuda CloudGen Firewall F secures, restricts, and monitors the communications between these tiers, and limits the potential damage to an organization in the event of an attack. By filling the functional gaps between cloud infrastructure security and a defense-indepth strategy, the Barracuda CloudGen Firewall provides protection between the application and data layers, rather than solely where the cloud network starts.
This architecture provides:
- Comprehensive security enforcement inside the cloud
- Threat detection and traffic monitoring between cloud application components
- Secure integration with on-premises resources
- Restricted and encrypted role-based administrative access to application infrastructure
- A mix of cloud hosted network tiers and on-premises tiers if required by compliance regulations
Enhancing ExpressRoute Security
Azure ExpressRoute allows organizations to establish high-performance private connections between Azure datacenters and on-premises infrastructure and provides low latencies, failure-resilient connectivity and consistent predictable performance. The Barracuda CloudGen Firewall F-Series enhances ExpressRoute security and boosts reliability and performance of Azure session connections:
Security
- Encrypt traffic across ExpressRoute
- Check traffic for network threats and malware
- Prevent unwanted traffic from entering or leaving the cloud
Reliability & Performance
- Provide transparent fallback to Internet VPN in case of MPLS uplink failure while preserving all running sessions
- Bond ExpressRoute with up to 24 Internet uplinks using Barracuda TINA VPN technology for significantly enhanced cloud connection
Intelligence
- Log all traffic for troubleshooting and reporting purposes
- Enforce priorities for protocols and applications utilizing ExpressRoute
- Enforce security policies based on user identity
SD-WAN & Performance
With the increasing adoption of virtualization, softwaredefined networks (a.k.a. SD-WAN) and cloud-native applications in today’s business environment, the role of the firewall has evolved from a gateway-based, securityonly device to a set of distributed solutions that make sure the WAN network is available any time for any type of endpoint. Regardless if the WAN endpoint is a headquarters, a remote office, a network in the IaaS cloud, or a mobile endpoint, CloudGen Firewalls are expected to enable impeccable WAN performance.
CloudGen Firewall units deployed to multiple physical and cloud locations allow an organization to create a fault-tolerant, high-performance WAN network on top of low-cost broadband lines by combining full next-gen deep security inspection, smart policy-based adaptive traffic management, and WAN optimization technology into a single centrally manageable solution. Besides improved fault tolerance against outages and better WAN performance, the solution enables cost optimization strategies when multiple carriers/ISPs are combined to get the required bandwidth at an optimum price. This section highlights of Barracuda CloudGen Firewalls’ WAN reliability and performance technologies.
WAN Compression
All Barracuda CloudGen Firewalls include data deduplication, and traffic compression. With built-in WAN compression, Barracuda NextGen Firewalls significantly improve site-to-site WAN network throughput and accelerate the delivery of business applications - at no extra charge. WAN compression is even included with Barracuda CloudGen Firewall F-Series virtual and cloud-based deployment options, effectively enabling secure, high-performance direct Internet breakouts to cloudhosted networks for every remote location.
Failover and Link Balancing
Barracuda CloudGen Firewalls provide a wide range of built-in uplink options such as leased lines, broadband (DHCP, DSL/cable, PPPoA, PPPoE, PPTP), and 3G/4G/UMTS. Up to 24 uplinks can be combined in load sharing or failover mode, eliminating the need to purchase additional devices for link balancing. F-Series’ unique combination of application awareness and traffic intelligence mechanisms automatically prioritizes business-critical applications, networks, and even distinct endpoints in case overall remaining bandwidth is degraded.
Unlike typical firewall solutions, all uplinks can be utilized to distribute VPN traffic, effectively enabling extremely reliable site-to-site VPN connectivity with only inexpensive broadband or even 4G uplinks.
Dynamic Bandwidth Detection and Performance-based Transport Selection
In order to achieve the highest possible quality of service, all Barracuda CloudGen Firewall F-Series models pro-actively measure the available VPN bandwidths and - automatically - select the best uplink for a VPN connection based on bandwidth, latency, or combined quality metrics.
Adaptive Bandwidth Reservation
If a measured bandwidth is not sufficient for businesscritical traffic (e.g., VoIP), the F-Series can automatically adjust the allocated bandwidths for non-businesscritical traffic to free up bandwidth for redistribution.
Adaptive Session Balancing
Using multiple transports simultaneously might end up in some clogged transports and some hardly used ones. To avoid this inconvenience, the Barracuda CloudGen Firewalls can dynamically balance not only newly created sessions but also already existing ones across the available uplinks.
Traffic Replication
Especially for VoIP traffic it is highly sensitive to paket loss. Barracuda CloudGen Firewall F-Series mirrors VoIP/ Video packets and sends these across multiple uplinks smiltaneously. At the destination, the packets are then again combined to provide best voice and video quality
On-Demand Dynamic Mesh VPN
Barracuda CloudGen Firewall F-Series deployments in a centrally managed WAN network create VPN tunnels dynamically based on remote peer and application. The typical use case for this technology is on-demand VPN tunnels between two branch offices for a VoIP telephone call, thereby improving call quality. For hybrid networks hosted in public cloud infrastructures like Microsoft Azure or Amazon AWS, this technology can easily be used to enable on-the-fly and direct access to cloud applications from remote offices that otherwise do not need a permanent connection to the cloud
Unified Remote Access
The Barracuda CloudGen Firewall F-Series incorporates advanced client-to-site VPN capabilities, using SSL, IPsec, and TINA protocols to ensure remote users can easily and securely access network resources without timeconsuming client configuration and management. The communication protocols used with our clients are optimized to be fully roaming-capable by quickly reconnecting upon loss of communication. Smart pathfinder technology determines the nearest point of entry to the corporate network. By using different ports encapsulated in either TCP or UDP, the advanced NAT traversal technology can easily pass through web proxies.
The influx of private computing devices, be they smartphones, laptops, or tablets, into the workplace may help increase productivity, flexibility, and convenience. However, BYOD (Bring Your Own Device) adds new security challenges and risks, such as enabling and controlling access, as well as preventing data loss. The F-Series provides strong capabilities that give users the full advantage of their devices while reducing possible risks to their business. Unwanted applications can be blocked, LAN segmentation can protect sensitive data, and network access control can check the health state of each device connecting to the corporate network.
Browser Remote Access (SSL VPN)
Barracuda’s responsive SSL VPN portal enables you to provide simple browser-based remote access on desktop or mobile devices. When accessing the portal via the web browser on a desktop or mobile device, users can browse apps, network folders, and files as if they were connected to the office network. The responsive portal supports most commonly used devices (Apple iOS, Android, Blackberry, etc.) and is part of the Advanced Remote Access subscription.
CudaLaunch
CudaLaunch is a simple-to-use remote connectivity application specifically designed to securely extend the company network to BYOD and mobile devices. The app is available for Windows, macOS, iOS, and Android, can be downloaded from the App Stores. End users can install the app without elevated privileges on the device. CudaLaunch looks and feels the same on every platform and provides fast, Java-independent access to commonly used applications in the company network, regardless if hosted on-premises or in the cloud. CudaLaunch’s Zero Touch administration features drastically reduce support and administration costs for rapidly changing mobile and BYOD devices.
VPN Clients (Barracuda Network Access Client)
Every Barracuda CloudGen Firewall supports an unlimited number of VPN clients at no extra cost. The Barracuda Network Access VPN Client provides a sophisticated VPN client for Windows, macOS, and Linux that provides richer performance and functionality than standard IPsec client software. Benefits include quick restoration of VPN tunnels, “Always On” VPN connections for PCs, redundant VPN gateway support, selective routing of network traffic through the VPN tunnel, and optimal VPNGateway detection based on location. The Barracuda Network Access Client, when used with a Barracuda CloudGen Firewall F, provides centrally managed Network Access Control (NAC) and an advanced Personal Firewall. This enforces client health and security policies for remote users connecting to the corporate network.
Barracuda VPN Client for Mac OS
Barracuda VPN Client for Windows 7
Once-Only Central Management
To centralize management across many different firewalls and remote access users, the Barracuda NextGen Control Center enables administrators to manage and configure security, content, traffic management, and network access policies from a single interface. Template-based configuration and globally available security objects enable efficient configuration across thousands of locations.
The Barracuda NextGen Control Center helps significantly reduce the cost associated with security management while providing extra functionality both centrally and locally at the managed gateway. Software patches and version upgrades are centrally controlled from within the management console and deployment can be applied to all managed devices.
Highly customizable administrative roles can be defined to delegate administrative capabilities for specific departments or locations.
Barracuda NextGen Control Center’s Status Map displays a drill down status overview of all centrally managed Barracuda CloudGen Firewall F-Series deployments.
Scalable Deployment
Managing the security issues in a widely distributed enterprise network can be painful and extremely time consuming. Managing a system may take only 15 minutes per day. But having 20 firewall systems in place results in five hours per day – just to manage the existing system. With Barracuda NextGen Control Center, managing multiple F-Series deployments takes the same amount of time as managing one.
Lifecycle Management
Scalable Barracuda CloudGen Firewalls offer companies sustainable investment protection. Energize Updates automatically provide the latest firmware and threat definitions to keep the appliance up to date. With a maintained Instant Replacement subscription, organizations receive a new appliance with the latest specs every four years.
Zero Touch Deployment
Especially for large rollouts without having IT personnel on the floor at the remote locations, the NextGen Firewall F-Series in conjunction with NextGen Control Center support Zero Touch Deployment. This feature allows to send appliances to location without having to pre-setup them beforehand. After unpacking the appliance and powering it up, the appliance automatically connects to the Barracuda Cloud Control where it receives are very basic set of information. This Information is just enough to create a high-secure TINA VPN connection to the NextGen Control Center the appliance shall be assigned to. The full configuration is sent to the appliance via the VPN tunnel and the appliance is part of the security infrastructure without the need of dedicated and trained IT security administrators at the location.
Intrusion Detection and Prevention
Advanced Threat Protection
Traffic Intelligence & SD-WAN 
Barracuda Network Module M801
Barracuda Network Module M802
Barracuda Network Module M804
Barracuda Network Module M805
Barracuda Network Module M1001
Barracuda Network Module M1002
Barracuda Network Module M1003
Barracuda Wall Mount Bracket
Barracuda L-shape Rack Mount bracket