Requirement Analysis

    Nowadays, more and more companies and people use web-based and cloud-hosted application in work and daily life. As these web and cloud-based applications become more popular, attacks become increasingly complicated and frequent, which result in threatening data. Traditional firewall can’t resist attack of application layer effectively. Intrusion prevention system (IPS) can’t fundamentally protect the application layer from attack. That’s why we need another system to protect data and business.

Function Description

    A WAF (Web Application Firewall) helps to protect web-based and cloud-hosted application by filtering and monitoring HTTP traffic between a web application and the Internet. It typically protects web applications from attacks such as cross-site forgery, corss-site-scripting (XXS), file inclusion, and SQL injection among others. A WAF is a protocol layer 7 defense (in the OSI model), and is not designed to defend against a range of attack vectors.

How Does It Work

    By deploying a WAF in front of a web application, a shield is placed between the web application and the Internet. While a proxy server protects a client machine’s identity by using an intermediary, a WAF is a type of reverse-proxy, protecting the server from exposure by having clients pass through the WAF before reaching the server.

    A WAF operates through a set of rules often called policies. These policies aim to protect against vulnerabilities in the application by filtering out malicious traffic. The value of a WAF comes in part from the speed and ease with which policy modification can be implemented, allowing for faster response to varying attack vectors; during a DDoS attack, rate limiting can be quickly implemented by modifying WAF policies.

    Below is the application architecture:

EVOC Solution

    NPC-8220 is a standard 2U rackmount performance network appliance, features with strong CPU computing, greater network throughput and richer network ports. NPC-8220 adopts Intel® C612 chipset, supports 2 x Intel® LGA2011 Xeon® E5-2600 V3/V4 series CPU. With modular design, NPC-8220 supports up to 8 x network module (ENS) or 4 x network module/4 x hard drive bay which realize 64 x Gb LAN RJ45 or 32 x 10Gb LAN SFP, ensuring high efficient network throughput.

• ● Intel® C612 chipset, support 2 x Intel® Xeon® E5-2600 V3/V4
• ● Support 16 x DDR4 up to 1TB RAM
• ● EVOC RAM rugged technology
• ● Support 1 x CF card and 4 x hard drive optional
• ● 8 x ENS bay support up to 64 x Gb LAN RJ45 or 32 x 10Gb LAN SFP
• ● 2 x USB, 2 x Gb LAN RJ45, 1 x Console, 1 x IPMI optional
• ● Support ATX and redundant power supply
• ● Optional 5th Gen Bypass function with switch
• ● Support hard drive encryption, intrusion detection, status monitoring and one-key recovery

More info