Check Point 13500 Appliance | Datasheet

CHECK POINT
13500 APPLIANCE
(Last Time to Buy: 30 June 2017)

CHECK POINT INSIGHTS

13500 APPLIANCE Large data centers have uncompromising needs for performance, uptime and
scalability. High end security gateway solutions must perform network access control
within the unique requirements of these environments while supporting the latest
High data center cyber security
networking standards like IPv6. With the increase in sophisticated attacks, additional
performance
security layers such as Identity Awareness, IPS, Application Control, URL Filtering,
Antivirus and others are required.

Product Benefits
 Security of data center assets In addition to their vast performance and security needs, data center environments are
 Modular, serviceable platform fits characterized by rigid requirements for high reliability of its various systems. All of
easily into complex networking these requirements drive the need for redundant, serviceable and highly available
environments components and systems.
 High availability and redundant
components eliminates down time
SOLUTION
 Centralize control with unified security
The 13500 Appliance delivers exceptional Next Generation Firewall performance in its
management and LOM
class and offers unmatched scalability, serviceability and port density. Benefiting from
 Ideal for applications that require
Check Point's advanced SecureXL, CoreXL and ClusterXL technologies, the 13500
Next Generation security
Appliance is capable of delivering stunning performance in a compact 2 rack -unit
physical footprint. With up to 23.6 Gbps firewall throughput and 5.7 Gbps of IPS
Product Features throughput the 13500 Appliance is designed to secure the most demanding network
 3,200 SecurityPower™ Units environment.
 Maximum security and performance
The 13500 Appliance is designed from the ground up for unmatched flexibility for even
 High availability and serviceability
the most demanding enterprise and data center network environments. The 13500
 Lights-Out-Management
Appliance has 3 expansion slots supporting a wide range of network options. The
 Optimized for Next Generation standard configuration includes two onboard 1 Gigabit copper ports for Management.
security
and Sync and twelve 1 Gigabit Ethernet copper ports. A maximally configured 13500
Appliance provides up to twenty-six 1 Gigabit copper ports, up to twelve 1 Gigabit fiber
ports or up to twelve 10 Gigabit fiber ports. The 13500 Appliances also have hot-
swappable redundant disk drives, fans and power supply units. Lights-Out-
Management (LOM) provides remote support and maintenance capabilities. Order the
appliance with an AC or DC power option to meet your datacenter requirements.

©2017 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non -confidential content | February 3, 2017
1
 Check Point 13500 Appliance | Datasheet

13500
1 2 x 500 GB RAID1 HDD 1 2 3 4 5 6
Lights-Out Management port
2
Management 10/100/1000Base-T port
3
4 Sync 10/100/1000Base-T port
Console port
5
USB ports for ISO installation
6
7 Graphic LCD display
8x10/100/1000Base-T port card
8
4/10/100/1000Base-T port card 7 8 9
9 7

ALL-INCLUSIVE SECURITY SOLUTIONS INTEGRATED SECURITY MANAGEMENT

The Check Point 13500 Appliances offer a complete and The appliance can either be managed locally with its
consolidated security solution available in five Next available integrated security management or via central
Generation Security Software Blade packages. unified management. Using local management, the appliance
can manage itself and one adjacent appliance for high
Next Generation Firewall (NGFW): identify and control availability purposes.
applications by user and scan content to stop threats.
Next Generation Secure Web Gateway (SWG): enables A RELIABLE SERVICEABLE PLATFORM
secure use of Web 2.0 with real time protection. The Check Point 13500 Appliances deliver business
Next Generation Data Protection (NGDP): preemptively continuity and serviceability through features such as hot-
protect sensitive information from unintentional loss and swappable redundant power supplies, hard disk drives and
educate users on proper data handling policy in real-time. fans and includes an advanced LOM card for out-of-band
Next Generation Threat Prevention (NGTP): prevent management. Combined together, these features ensure a
sophisticated cyber-threats with IPS, Application Control, greater degree of business continuity and serviceability when
Antivirus, Anti-Bot, URL Filtering and Email Security. these appliances are deployed in the customer’s networks.
Next Generation Threat Extraction (NGTX): advanced
next-gen zero-day threat prevention, NGTP with Threat
REMOTE MANAGEMENT AND MONITORING
Emulation and Threat Extraction.
A Lights-Out-Management (LOM) card provides out-of-band
remote management to remotely diagnose, start, restart and
PREVENT UNKNOWN THREATS manage the appliance from a remote location. Administrators
Check Point provides complete zero-day threat prevention can also use the LOM web interface to remotely install an OS
and alerts when under attack. Threat Extraction delivers image from an ISO file.
zero-malware documents in zero seconds. Threat Emulation
inspects files for malicious content in a virtual sandbox.
GAIA—A UNIFIED SECURE OS
When Threat Emulation discovers new threats, a signature is
Check Point GAiA™ is the next generation Secure Operating
sent to the Check Point ThreatCloud database which
System for all Check Point appliances, open servers and
documents and shares information on the newly identified
virtualized gateways. GAiA secures IPv4 and IPv6 networks
malware with other Check Point customers — providing
utilizing the Check Point Acceleration & Clustering
immediate protection against zero-day threats.
technology and it protects the most complex network
environments by supporting dynamic routing protocols like
INCLUSIVE HIGH PERFORMANCE PACKAGE RIP, OSPF, BGP, PIM (sparse and dense mode) and IGMP.
Customers with high connection capacity requirements can As a 64-Bit OS, GAiA increases the connection capacity of
purchase the affordable High Performance Package (HPP) select appliances.
with the Next Generation security package of their choice.
This includes the appliance plus a 4x10Gb SFP+ interface GAiA simplifies management with segregation of duties by
card, transceivers and 64 GB of memory for high connection enabling role-based administrative access. Furthermore,
capacity. GAiA greatly increases operation efficiency by offering
Automatic Software Updates. The intuitive and feature-rich
Web interface allows for instant search of any commands or
properties.

©2017 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non -confidential content | February 3, 2017
2
 Check Point 13500 Appliance | Datasheet

SPECIFICATIONS
PERFORMANCE NETWORK
1
Production Performance Network Connectivity
 3,200 SecurityPower  IPv4 and IPv6
 23.6 Gbps firewall throughput  1024 interfaces or VLANs per system
 5.7 Gbps firewall and IPS throughput  4096 interfaces per system (in Virtual System mode)
RFC 3511, 2544, 2647, 1242 PERFORMANCE  802.3ad passive and active link aggregation
(LAB)  Layer 2 (transparent) and Layer 3 (routing) mode
 77 Gbps of firewall throughput, 1518 byte UDP
High Availability
 17 Gbps of VPN throughput, AES-128
 Active/Active - L3 mode
 7.8 Gbps of IPS throughput, Recommended IPS profile,  Active/Passive - L3 mode
IMIX traffic blend
 Session synchronization for firewall and VPN
 7/28 million concurrent connections
2
 Session failover for routing change
 178,000 connections per second, 64 byte HTTP response
 Device failure detection
EXPANSION OPTIONS  Link failure detection
Base Configuration  ClusterXL or VRRP
 2 onboard 10/100/1000Base-T RJ45 ports PHYSICAL
 4 x 10/100/1000Base-T RJ45 interface card (1 of the 3
Power Requirements
expansion slots)
 8 x 10/100/1000Base-T RJ45 interface card (1 of the 3  Input Voltage: 90 - 264VAC (47-63HZ), -36 to -72 VDC
expansion slots)  Inrush Current: 35A/70A@115VAC, 70A@230VAC, 35A@-
 16 GB memory 48VDC
 Redundant dual AC or DC hot-swappable power supplies  Single Power Supply Rating: 600W
 Redundant dual hot-swappable 500GB HDD RAID1  Power Consumption Maximum: 431W
 LOM card  Maximum thermal output: 1,730 BTU
 Slide rails (22” to 32”) Dimensions
Network Expansion Slot Options (3 slots)  Enclosure: 2RU
 Standard (W x D x H): 17.4 x 23.6 x 3.5 in.
 4 x 10/100/1000Base-T RJ45 interface card
 Metric (W x D x H): 442 x 600 x 88 mm
 8 x 10/100/1000Base-T RJ45 interface card
 Weight: 17.5 kg (38.6 lbs.)
 2 x 1000Base-F interface card
 4 x 1000Base-F interface card Operating Environmental Conditions
 2 x 10GBase-F SFP+ interface card  Temperature: 32°to104°F / 0° to 40°C
 4 x 10GBase-F SFP+ interface card  Humidity: 5%-95% (non-condensing)
 4 x 10/100/1000Base-T Fail-Open NIC Storage Conditions
 4 x 1000Base-F SX or LX Fail-Open NIC
 Temperature: –40° to 158°F / –40° to 70°C
 2 x 10GBase-F SR or LR Fail-Open NIC
 Humidity: 5% to 95% at 60°C (non-condensing)
Max Configuration
Certifications
 Up to 26 x 10/100/1000Base-T RJ45 ports
 Safety: CB,UL/cUL, CSA, TUV
 Up to 12 x 1000Base-F SFP ports
 Emissions: FCC, CE, VCCI, C-Tick
 Up to 12 x 10GBase-F SFP+ ports
 Environmental: RoHS
 32, 48 or 64 GB memory
1
Virtual Systems Check Point's SecurityPower is a new benchmark metric that allows customers
to select security appliances by their capacity to handle real-world network traffic,
 Max VSs: 150 (w/16GB), 250 (w/64GB) multiple security functions and a typical security policy.
2
With GAiA OS and 64 GB memory upgrade

©2017 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non -confidential content | February 3, 2017
3
 Check Point 13500 Appliance | Datasheet

APPLIANCE PACKAGES
1,2
BASE CONFIGURATION
13500 Next-Gen Firewall (with FW, VPN, ADNC, IA, MOB-5, IPS and APCL) bundled with local CPAP-SG13500-NGFW
management for up to 2 gateways
13500 Secure Web Gateway (with FW, VPN, ADNC, IA, APCL, AV and URLF) bundled with CPAP-SWG13500
local management and SmartEvent for up to 2 gateways
13500 Next-Gen Data Protection (with FW, VPN, ADNC, IA, MOB-5, IPS, APCL, and DLP) CPAP-SG13500-NGDP
bundled with local management for up to 2 gateways
13500 Next-Gen Threat Prevention (with FW, VPN, ADNC, IA, MOB-5, IPS, APCL, URLF, AV, CPAP-SG13500-NGTP
ABOT and ASPM) bundled with local management for up to 2 gateways
13500 Next-Gen Threat Extraction (with FW, VPN, ADNC, IA, MOB-5, IPS, APCL, URLF, AV, CPAP-SG13500-NGTX
ABOT, ASPM, TE and TEX) bundled with local management for up to 2 gateways
13500 Next-Gen Firewall with 20 Virtual Systems CPAP-SG13500-NGFW-VS20
13500 Next-Gen Firewall Bundle, one primary and one HA, with 20 VS CPAP-SG13500-NGFW-VS20-2
1,2
HIGH PERFORMANCE PACKAGES
13500 Next-Gen Firewall High Performance Package with 8x10/100/1000Base-T interface CPAP-SG13500-NGFW-HPP
card, 4x10Gb SFP+ interface card, 4xSR transceivers and 64 GB of memory
13500 Secure Web Gateway High Performance Package with 8x10/100/1000Base-T interface CPAP-SWG13500-HPP
card, 4x10Gb SFP+ interface card, 4xSR transceivers and 64 GB of memory
13500 Next-Gen Data Protection High Performance Package with 8x10/100/1000Base-T CPAP-SG13500-NGDP-HPP
interface card, 4x10Gb SFP+ interface card, 4xSR transceivers and 64 GB of memory.
13500 Next-Gen Threat Prevention High Performance Package with 8x10/100/1000Base-T CPAP-SG13500-NGTP-HPP
interface card, 4x10Gb SFP+ interface card, 4xSR transceivers and 64 GB of memory.
13500 Next-Gen Threat Extraction High Performance Package with 8x10/100/1000Base-T CPAP-SG13500-NGTX-HPP
interface card, 4x10Gb SFP+ interface card, 4xSR transceivers and 64 GB of memory
CPAP-SG13500-NGFW-VS20-
13500 Next-Gen Firewall with 20 Virtual Systems and the High Performance Package
HPP
13500 Next-Gen Firewall Bundle, one primary and one HA, with 20 Virtual Systems and the CPAP-SG13500-NGFW-VS20-
High Performance Package HPP-2
1
SKUs for 2 and 3 years are available, see the online Product Catalog
2
DC power SKUs are also available

SOFTWARE BLADE PACKAGES

1
SOFTWARE BLADE PACKAGES
13500 NGFW Software Blade package for 1 year (IPS and APCL) CPSB-NGFW-13500-1Y
13500 Secure Web Gateway Software Blade package for 1 year (APCL, AV and URLF) CPSB-SWG-13500-1Y
13500 NGDP Software Blade package for 1 year (IPS, APCL, and DLP) CPSB-NGDP-13500-1Y
13500 NGTP Software Blade package for 1 year (IPS, APCL, URLF, AV, ABOT and ASPM) CPSB-NGTP-13500-1Y
13500 NGTX Software Blade package for 1 year (IPS, APCL, URLF, AV, ABOT, ASPM, TE CPSB-NGTX-13500-1Y
and TEX)
1
SOFTWARE BLADES
Check Point Mobile Access Blade for unlimited concurrent connections CPSB-MOB-U
Data Loss Prevention Blade for 1 year (for 1,500 users and above, up to 250,000 mails per CPSB-DLP-U-1Y
hour and max throughput of 2.5 Gbps)
Check Point IPS blade for 1 year CPSB-IPS-XL-1Y
Check Point Anti-Spam & Email Security Blade for 1 year CPSB-ASPM-XL-1Y

©2017 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non -confidential content | February 3, 2017
4
 Check Point 13500 Appliance | Datasheet

VIRTUAL SYSTEM PACKAGES

50 Virtual Systems package CPSB-VS-50
50 Virtual Systems package for HA/VSLS CPSB-VS-50-VSLS
25 Virtual Systems package CPSB-VS-25
25 Virtual Systems package for HA/VSLS CPSB-VS-25-VSLS
10 Virtual Systems package CPSB-VS-10
10 Virtual Systems package for HA/VSLS CPSB-VS-10-VSLS
1
SKUs for 2 and 3 years are available, see the online Product Catalog

ACCESSORIES
INTERFACE CARDS AND TRANSCEIVERS
4 Port 10/100/1000 Base-T RJ45 interface card for 13000 and Smart-1 appliances CPAC-4-1C-L
8 Port 10/100/100 Base-T RJ45 interface card for 13000 and Smart-1 appliances CPAC-8-1C-L
2 Port 1000Base-F SFP interface card; requires SFP transceivers per port CPAC-2-1F
4 Port 1000Base-F SFP interface card; requires SFP transceivers per port CPAC-4-1F
SFP transceiver module for 1G fiber ports - long range (1000Base-LX) CPAC-TR-1LX
SFP transceiver module for 1G fiber ports - short range (1000Base-SX) CPAC-TR-1SX
SFP transceiver to 1000 Base-T RJ45 (Copper) CPAC-TR-1T
2 Port 10GBase-F SFP+ interface card; requires 10GBase SFP+ transceivers per port CPAC-2-10F
4 Port 10GBase-F SFP+ interface card; requires 10GBase SFP+ transceivers per port CPAC-4-10F
SFP+ transceiver module for 10G fiber ports - long range ( 10GBase-LR) CPAC-TR-10LR
SFP+ transceiver module for 10G fiber ports - short range ( 10GBase-SR) CPAC-TR-10SR
BYPASS CARD
2 Port 10GE short-range Fiber Bypass (Fail-Open) interface card (1000Base-SR) CPAC-2-10FSR-BP
2 Port 10GE long-range Fiber Bypass (Fail-Open) interface card (1000Base-LR) CPAC-2-10FLR-BP
4 Port 1GE short-range Fiber Bypass (Fail-Open) interface card (1000Base-SX) CPAC-4-1FSR-BP
4 Port 1GE long-range Fiber Bypass(Fail-Open) interface card (1000Base-LX) CPAC-4-1FLR-BP
Port 1GE copper Bypass (Fail-Open) interface card (10/100/1000 Base-T) CPAC-4-1C-BP
SPARES AND MISCELLANEOUS
16 GB RAM memory upgrade for 13500 appliance CPAC-RAM16GB-13000
Replacement parts kit including 1 HDD, one AC power supply and one fan for 13000 Appliance CPAC-SPARES-13000
Replacement AC power supply for 13000 Appliance CPAC-PSU-AC-13000
Replacement DC power supply for 13000 Appliance CPAC-PSU-DC-13000
Replacement 500G Hard Disk Drive for 13000 Appliance CPAC-HDD-500G-13000
Replacement fan for 13000 Appliance CPAC-FAN-13000
Slide rails for 13000 Appliances (22”-32”) CPAC-RAIL-L
Extended slide rails for 13000 Appliances (24”-36”) CPAC-RAIL-EXT-L

Worldwide Headquarters | 5 Ha’Solelim Street, Tel Aviv 67897, Israel | Tel: 972-3-753-4555 | Fax: 972-3-624-1100 | Email: info@checkpoint.com
CONTACT US
U.S. Headquarters | 959 Skyway Road, Suite 300, San Carlos, CA 94070 | Tel: 800-429-4391; 650-628-2000 | Fax: 650-654-4233 | www.checkpoint.com

©2017 Check Point Software Technologies Ltd. All rights reserved. [Protected] Non -confidential content | February 3, 2017
5