SonicWALL Gateway Anti-Virus (SonicWALL GAV) is part of the EDI Sourcing Anti-Virus/Intrusion Prevention Service solution that provides unified threat management. The integration of gateway anti-virus and intrusion prevention delivers intelligent, real-time network security protection against sophisticated application layer and content-based attacks. Utilizing a configurable, high-performance deep packet inspection architecture, secures the network from the core to the perimeter against a comprehensive array of dynamic threats including viruses, worms, Trojans, and software vulnerabilities, such as buffer overflows, as well as peerto-peer and instant messenger applications, backdoor exploits, and other malicious code.
SonicWALL GAV delivers real-time virus protection directly on the SonicWALL security appliance by using SonicWALL’s IPS-Deep Packet Inspection v2.0 engine to inspect all traffic that traverses the SonicWALL gateway. Building on SonicWALL’s reassembly-free architecture, SonicWALL GAV inspects multiple application protocols, as well as generic TCP streams, and compressed traffic. Because SonicWALL GAV does not have to perform reassembly, there are no file-size limitations imposed by the scanning engine. Base64 decoding, ZIP, LHZ, and GZIP (LZ77) decompression are also performed on a single-pass, per-packet basis.
SonicWALL GAV delivers threat protection directly on the SonicWALL security appliance by matching downloaded or e-mailed files against an extensive and dynamically updated database of threat virus signatures. Virus attacks are caught and suppressed before they travel to desktops. New signatures are created and added to the database by a combination of SonicWALL’s SonicAlert Team, third-party virus analysts, open source developers and other sources.
SonicWALL GAV can be configured to protect against internal threats as well as those originating outside the network. It operates over a multitude of protocols including SMTP, POP3, IMAP, HTTP, FTP, NetBIOS, instant messaging and peer-to-peer applications and dozens of other stream-based protocols, to provide administrators with comprehensive network threat prevention and control. Because files containing malicious code and viruses can also be compressed and therefore inaccessible to conventional anti-virus solutions, SonicWALL GAV integrates advanced decompression technology that automatically decompresses and scans files on a per packet basis.
• Integrated Deep Packet Inspection Technology - Service features a configurable, high-performance deep packet inspection architecture that uses parallel searching algorithms up through the application layer to deliver increased application layer, Web and e-mail attack prevention. Parallel processing reduces the performance impact on the firewall and maximizes available memory for exceptional throughput on SonicWALL integrated security gateways.
• Real-Time Anti-Virus Gateway Scanning - Service delivers intelligent file-based virus and malicious code prevention by scanning in real-time for decompressed and compressed files containing viruses, Trojans, worms and other Internet threats over the corporate network.
• Powerful Intrusion Prevention - Service provides complete protection from a comprehensive array of network-based application layer threats by scanning packet payloads for worms, Trojans, software vulnerabilities such as buffer overflows, peer-to-peer and instant messenger applications, backdoor exploits, and other malicious code.
• Ultimate Scalability and Performance - Service utilizes a per packet scanning engine, making SonicWALL’s solution unique in its ability to handle unlimited file size and virtually unlimited concurrent downloads, offering ultimate scalability and performance for today’s networked environment.
• Day Zero Protection - Service ensures incredibly fast time-to-protection by employing a dynamically-updated database of signatures created by a combination of SonicWALL’s SonicAlert Team, third-party virus analysts and developers, and open source databases of known threats.
• Extensive Virus Signature List - Service utilizes an extensive database of thousands of attack and vulnerability signatures written to detect and prevent intrusions, viruses, worms, Tojans, application exploits, and malicious applications.
• Distributed Enforcement Architecture - Service utilizes a distributed enforcement architecture to deliver automated signature updates, providing real-time protection from emerging threats and lowering total cost of ownership.
• Inter-zone Protection - Service provides application layer attack protection against malicious code and other threats originating from the Internet or from internal sources. Administrators have the ability to enforce intrusion prevention and anti-virus scanning not only between each network zone and the Internet, but also between internal network zones for added security
• Advanced File Decompression Technology - Service includes advanced decompression technology that can automatically decompress and scan files on a per packet basis to search for viruses, Trojans, worms and malware. Supported compression formats include: ZIP, Deflate and GZIP.
• File-Based Scanning Protocol Support - Service delivers protection for high threat viruses and malware by inspecting the most common protocols used in today’s networked environments, including SMTP, POP3, IMAP, HTTP, FTP, NETBIOS, instant messaging and peer-to-peer applications, and dozens of other stream-based protocols. This closes potential backdoors that can be used to compromise the network while also improving employee productivity and conserving Internet bandwidth.
• Application Control - Service provides the ability to prevent instant messaging and peer-to-peer file sharing programs from operating through the firewall, closing a potential back door that can be used to compromise the network while also improving employee productivity and conserving Internet bandwidth.
• Simplified Deployment and Management - Service allows network administrators to create global policies between security zones and group attacks by priority, simplifying deployment and management across a distributed network.