E1100W / E1600 / E1606 / E1700

Hillstone E-Pro Series

Next-Generation Firewall

The Hillstone E-Pro Series Next Generation Firewall (NGFW) is designed for comprehensive
security with superior price performance. It provides granular visibility and control of applications.
Advanced system architecture and dedicated hardware acceleration capabilities allow the E-Pro
Series to secure all traffic with fine-grained control without compromising performance. The
Hillstone E-Pro Series NGFW incorporates advanced firewall features, offers excellent energy
efficiency, and a flexible, affordable and easy-to-manage solution that delivers comprehensive
threat protection and improved security posture.

Product Highlights
Multi-Dimensional Granular Control Comprehensive Threat Detection and Prevention
Hillstone’s E-Pro Series provides admins with rich security Hillstone’s E-Pro Series NGFW provides intrusion prevention
features and flexible controls. The E-Pro Series provides based on analysis of attacks and deep inspection of
precise identification and application-aware control through applications and protocols, which secures Layers 2-7 of
deep application inspection to intelligently and accurately the network by effectively filtering security threats such as
identify thousands of applications and help admins identify viruses, Trojan horses, worms, spyware, vulnerability attacks,
security risks across multiple dimensions. It supports a rich and evasion attacks. The E-Pro Series uses an optimized
set of user authentication methods, including local, TACACS+, attack identification algorithm to mitigate DoS/DDoS , which
RADIUS, LDAP, and authentication based on password, SMS, ensures the security of the network and the availability of
certificates, token or email. It allows fine-grained user control business applications. Hillstone’s NGFW offers advanced web
such as access control, application limits, and bandwidth attack protection, which not only prevents web attacks such
guarantees. The E-Pro Series NGFW can accurately identify as SQL injection and cross-site scripting, but also defends
the geographic location of the source/destination IP of an against web page tampering and similar exploits. The stream
attack, which enables access control to block attacks. The scanning based virus detection engine enables low-latency
E-Pro Series provides granular control of data in transit, and high-performance filtering in HTTP/HTTPS, FTP, SMB,
protecting organizations from the leakage of critical, sensitive, various mail transfer protocols and compressed files. URL
or confidential data and files. filtering can help network administrators easily control
browsing of malicious URLs. A variety of management and

www.HillstoneNet.com © 2021 Hillstone Networks All Rights Reserved. | 1

Hillstone E-Pro Series Firewall

Product Highlights (Continued)

controls can prevent malicious activities concealed in Full-concurrence and High-performance Architecture
SSL-encrypted traffic including email. Cloud Sandbox, an
Hillstone’s E-Pro Series NGFW delivers high performance with
advanced threat detection engine, can emulate the execution
a unique approach, allowing organizations to take advantage
environment and analyze all activities related to malicious
of its high throughput, low latency, and high concurrency.
files, identify advanced threats and provide comprehensive
Full-concurrence packet processing technology performs all
threat reports as well as rapid remediation.
security checks and analysis in a single pass, which reduces
processing overhead for complex security features, while
Advanced Networking Capabilities
delivering consistently high performance. The best-of-breed
Hillstone’s E-Pro Series NGFW integrates advanced architecture and proprietary algorithms of Hillstone’s StoneOS
network adaptability with consistent security enforcement optimize the session load across all CPU cores to take full
across diverse network environments. Dynamic detection advantage of multiple cores.
and inbound SmartDNS functions intelligently load balance
traffic across multiple links. It significantly improves link Unified and Centralized Management
utilization and delivers an improved user experience without
Hillstone’s E-Pro Series NGFW supports centralized
compromising security. The routing table can be dynamically
management via the Hillstone Security Management Platform
adjusted according to the network conditions with support of
(HSM). Unified policy management, device configuration
protocols such as RIP, OSPF and BGP. The E-Pro Series also
management, and real-time security monitoring simplifies
enables high VPN performance through the built-in hardware
deployment, reduces response time for security incidents,
acceleration capability for large-scale IPsec/SSL VPN
improves operational efficiency and reduces TCO. Hillstone’s
deployments.
E-Pro Series NGFW also supports the cloud-based Hillstone
CloudView security management and analytics platform,
which provides real-time monitoring, analysis and alarming of
hardware, traffic trends, ranking of apps and users, as well as
threat information via a unified web portal or mobile app.

www.HillstoneNet.com © 2021 Hillstone Networks All Rights Reserved. | 2

Hillstone E-Pro Series Firewall

Features
Network Services Attack Defense • URL filter for SSL encrypted traffic
• Dynamic routing (OSPF, BGP, RIPv2) • Abnormal protocol attack defense • SSL encrypted traffic whitelist
• Static and policy routing • Anti-DoS/DDoS, including SYN flood, UDP flood, • SSL proxy offload mode
• Route controlled by application DNS reply flood, DNS query flood defense, TCP • Support application identification, DLP, IPS
fragment, ICMP fragment, etc. sandbox, AV for SSL proxy decrypted traffic of
• Built-in DHCP, NTP, DNS Server and DNS proxy
• ARP attack defense SMTPS/POP3S/IMAPS
• Tap mode – connects to SPAN port
• Allow list for destination IP address
• Interface modes: sniffer, port aggregated, Endpoint Identification and Control
loopback, VLANS (802.1Q and Trunking) URL Filtering • Support to identify endpoint IP, endpoint quantity,
• L2/L3 switching & routing • Flow-based web filtering inspection on-line time, off-line time, and on-line duration
• Multicast(PIM-SSM) • Manually defined web filtering based on URL, web • Support 10 operating systems including Windows,
• Virtual wire (Layer 1) transparent inline content and MIME header iOS, Android, etc.
deployment • Dynamic web filtering with cloud-based real-time • Support query based on IP, endpoint quantity,
categorization database: over 140 million URLs control policy and status etc.
Firewall
with 64 categories (8 of which are security related) • Support the identification of accessed endpoints
• Operating modes: NAT/route, transparent (bridge), quantity across layer 3, logging and interference
• Additional web filtering features:
and mixed mode on overrun IP
- Filter Java Applet, ActiveX or cookie
• Policy objects: predefined, custom, aggregate • Redirect page display after custom interference
policy, object grouping - Block HTTP Post
operation
• Security policy based on application, role and - Log search keywords
• Supports blocking operations on overrun IP
geo-location - Exempt scanning encrypted connections on
• User identification and traffic control for remote
• Application Level Gateways and session support: certain categories for privacy
desktop services of Windows Server
MSRCP, PPTP, RAS, RSH, SIP, FTP, TFTP, HTTP, • Web filtering profile override: allows administrator
dcerpc, dns-tcp, dns-udp, H.245 0, H.245 1, H.323 to temporarily assign different profiles to user/ Data Security
• NAT and ALG support: NAT46, NAT64, NAT444, group/IP • File transfer control based on file type, size and
SNAT, DNAT, PAT, Full Cone NAT, STUN • Web filter local categories and category rating name
• NAT configuration: per policy and central NAT override • File protocol identification, including HTTP, FTP,
table • Support multi-language SMTP, POP3 and SMB
• VoIP: SIP/H.323/SCCP NAT traversal, RTP pin • File signature and suffix identification for over 100
holing Cloud-Sandbox
file types
• Global policy management view • Upload malicious files to cloud sandbox for
• Content filtering for HTTP-GET, HTTP-POST, FTP
analysis
• Security policy redundancy inspection, policy and SMTP protocols
group, policy configuration rollback • Support protocols including HTTP/HTTPS, POP3,
• IM identification and network behavior audit
IMAP, SMTP, FTP and SMB
• Policy Assistant for easy detailed policy • Filter files transmitted by HTTPS using SSL Proxy
deployment • Support file types including PE, ZIP, RAR, Office,
and SMB
PDF, APK, JAR, SWF and Script
• Policy analyzing and invalid policy cleanup
• File transfer direction and file size control Application Control
• Comprehensive DNS policy
• Provide complete behavior analysis report for • Over 4,000 applications that can be filtered by
• Schedules: one-time and recurring malicious files name, category, subcategory, technology and risk
Intrusion Prevention • Global threat intelligence sharing, real-time threat • Each application contains a description, risk
blocking factors, dependencies, typical ports used, and
• Protocol anomaly detection, rate-based detection,
custom signatures, manual, automatic push or • Support detection only mode without uploading URLs for additional reference
pull signature updates, integrated threat encyclo- files • Actions: block, reset session, monitor, traffic
pedia • URL allow / block list configuration shaping
• IPS Actions: default, monitor, block, reset • Identify and control cloud applications in the cloud
(attackers IP or victim IP, incoming interface) with Botnet C&C Prevention
• Provide multi-dimensional monitoring and
expiry time • Discover intranet botnet host by monitoring C&C statistics for cloud applications, including risk
• Packet logging option connections and block further advanced threats category and characteristics
such as botnet and ransomware
• Filter Based Selection: severity, target, OS, appli-
cation or protocol • Regularly update the botnet server addresses Quality of Service (QoS)
• Prevention for C&C IP and domain • Max/guaranteed bandwidth tunnels or IP/user
• IP exemption from specific IPS signatures
• Support TCP, HTTP, and DNS traffic detection basis
• IDS sniffer mode
• Allow and block list based on IP address or • Tunnel allocation based on security domain,
• IPv4 and IPv6 rate based DoS protection with interface, address, user/user group, server/server
threshold settings against TCP Syn flood, TCP/ domain name
group, application/app group, TOS, VLAN
UDP/SCTP port scan, ICMP sweep, TCP/UDP/ • Support DNS sinkhole and DNS tunneling
detection • Bandwidth allocated by time, priority, or equal
SCIP/ICMP session flooding (source/destination)
bandwidth sharing
• Active bypass with bypass interfaces
IP Reputation • Type of Service (TOS) and Differentiated Services
• Predefined prevention configuration (DiffServ) support
• Identify and filter traffic from risky IPs such as
Antivirus botnet hosts, spammers, Tor nodes, breached • Prioritized allocation of remaining bandwidth
hosts, and brute force attacks • Maximum concurrent connections per IP
• Manual, automatic push or pull signature updates
• Logging, dropping packets, or blocking for • Bandwidth allocation based on URL category
• Manually add or delete MD5 signature to the AV different types of risky IP traffic
database • Bandwidth limit by delaying access for user or IP
• Periodical IP reputation signature database
• MD5 signature support uploading to cloud • Automatic expiration cleanup and manual cleanup
upgrade
sandbox, and manually add or delete on local of user used traffic
database SSL Decryption
• Flow-based antivirus: protocols include HTTP,
Server Load Balancing
• Application identification for SSL encrypted traffic
SMTP, POP3, IMAP, FTP/SFTP, SMB • Weighted hashing, weighted least-connection, and
• IPS enablement for SSL encrypted traffic weighted round-robin
• Compressed file virus scanning
• AV enablement for SSL encrypted traffic

www.HillstoneNet.com © 2021 Hillstone Networks All Rights Reserved. | 3

Hillstone E-Pro Series Firewall

Features (Continued)
• Session protection, session persistence and • VTEP for VxLAN static unicast tunnel • Support IP-based and MAC-based user authenti-
session status monitoring cation
• Server health check, session monitoring and IPv6
session protection • Management over IPv6, IPv6 logging and HA Administration
• IPv6 tunneling: DNS64/NAT64, IPv6 ISATAP, IPv6 • Management access: HTTP/HTTPS, SSH, telnet,
Link Load Balancing console
GRE, IPv6 over IPv4 GRE
• Bi-directional link load balancing • Central Management: Hillstone Security Manager
• IPv6 routing including static routing, policy routing,
• Outbound link load balancing: policy based routing ISIS, RIPng, OSPFv3 and BGP4+ (HSM), web service APIs
including ECMP, time, weighted, and embedded • System Integration: SNMP, syslog, alliance
• IPS, Application identification, URL filtering,
ISP routing; Active and passive real-time link partnerships
Antivirus, Access control, ND attack defense, iQoS
quality detection and best path selection
• IPv6 jumbo frame support • Rapid deployment: USB auto-install, local and
• Inbound link load balancing supports SmartDNS remote script execution
and dynamic detection • IPv6 Radius support
• Dynamic real-time dashboard status and drill-in
• Automatic link switching based on bandwidth, • IPv6 support on the following ALGs: TFTP, FTP,
monitoring widgets
latency, jitter, connectivity, application etc. RSH, HTTP, SIP
• Language support: English
• Link health inspection with ARP, PING, and DNS • IPv6 support on distributed iQoS
• Track address detection Logs & Reporting
VPN
• Logging facilities: local log storage with storage
• IPsec VPN VSYS
models for up to 6 months, multiple syslog
- IPsec Phase 1 mode: aggressive and main ID • System resource allocation to each VSYS servers and multiple Hillstone Security Audit (HSA)
protection mode • CPU virtualization platforms
- Peer acceptance options: any ID, specific ID, ID in • Non-root VSYS support firewall, IPsec VPN, • Encrypted logging and log integrity with HSA
dialup user group SSL VPN, IPS, URL filtering, app monitoring, IP scheduled batch log uploading
- Supports IKEv1 and IKEv2 (RFC 4306) reputation, QoS • Reliable logging using TCP option (RFC 3195)
- Authentication method: certificate and • VSYS monitoring and statistic, app monitoring, IP • Detailed traffic logs: forwarded, violated sessions,
pre-shared key reputation, AV, QoS local traffic, invalid packets, URL etc.
- IKE mode configuration support (as server or High Availability • Comprehensive event logs: system and adminis-
client) trative activity audits, routing & networking, VPN,
• Redundant heartbeat interfaces user authentications, WiFi related events
- DHCP over IPsec
• Active/Active and Active/Passive mode • IP and service port name resolution option
- Configurable IKE encryption key expiry, NAT
traversal keep alive frequency • Standalone session synchronization • Brief traffic log format option
- Phase 1/Phase 2 Proposal encryption: DES, • HA reserved management interface • Three predefined reports: Security, Flow and
3DES, AES128, AES192, AES256 • Failover: Network reports
- Phase 1/Phase 2 Proposal authentication: - Port, local & remote link monitoring • User defined reporting
MD5, SHA1, SHA256, SHA384, - Stateful failover • Reports can be exported in PDF, Word and HTML
SHA512 - Sub-second failover via Email and FTP
- IKEv1 support DH group 1,2,5,19,20,21,24 - Failure notification
- IKEv2 support DH group Statistics and Monitoring
• Deployment options:
1,2,5,14,15,16,19,20,21,24 • Application, URL, threat events statistic and
- HA with link aggregation monitoring
- XAuth as server mode and for dialup users
- Full mesh HA • Real-time traffic statistic and analytics
- Dead peer detection
- Geographically dispersed HA • System information such as concurrent session,
- Replay detection
CPU, memory and temperature
- Autokey keep-alive for Phase 2 SA Twin-mode HA (only available on E3960P and
• iQOS traffic statistic and monitoring, link status
• IPsec VPN realm support: allows multiple custom above models) monitoring
SSL VPN logins associated with user groups (URL • High availability mode among multiple devices
paths, design) • Support traffic information collection and
• Multiple HA deployment modes forwarding via Netflow (v9.0)
• IPsec VPN configuration options: route-based or
• Configuration and session synchronization among
policy based CloudView
multiple devices
• IPsec VPN deployment modes: gateway-to- • Cloud-based security monitoring
• Dual HA data link ports
gateway, full mesh, hub-and-spoke, redundant
• 24/7 access from web or mobile application
tunnel, VPN termination in transparent mode User and Device Identity • Device status, traffic and threat monitoring
• One time login prevents concurrent logins with the • Local user database
same username • Cloud-based log retention and reporting
• Remote user authentication: TACACS+, LDAP,
• SSL portal concurrent users limiting Radius, Active Directory IoT Security
• SSL VPN port forwarding module encrypts client • Single-sign-on: Windows AD • Identify IoT devices such as IP Cameras and
data and sends the data to the application server Network Video Recorders
• 2-factor authentication: 3rd party support,
• Supports clients that run iOS, Android, and integrated token server with physical and SMS • Support query of monitoring results based on
Windows XP/Vista including 64-bit Windows OS filtering conditions, including device type, IP
• User and device-based policies
• Host integrity checking and OS checking prior to address, status, etc.
SSL tunnel connections • User group synchronization based on AD and
LDAP • Support customized whitelists
• MAC host check per portal
• Support for 802.1X, SSO Proxy
• Cache cleaning option prior to ending SSL VPN Wireless
session • WebAuth: page customization, force crack
• Multi-SSID and wireless traffic control (only on
prevention, IPv6 support
• L2TP client and server mode, L2TP over IPsec, E1600WP)
and GRE over IPsec • Interface based authentication
• View and manage IPsec and SSL VPN connec- • Agentless ADSSO (AD Polling)
tions • Use authentication synchronization based on
• PnPVPN SSO-monitor

www.HillstoneNet.com © 2021 Hillstone Networks All Rights Reserved. | 4

Hillstone E-Pro Series Firewall

Specifications
SG-6000-E1600P SG-6000-E1600WP SG-6000-E1700P SG-6000-E2800P SG-6000-E3662P SG-6000-E3668P SG-6000-E3960P SG-6000-E3968P

FW Throughput (1) 4.7 Gbps 4.7 Gbps 4.75 Gbps 8 Gbps 10 Gbps 10 Gbps 10 Gbps 10 Gbps
IPsec
850 Mbps 850 Mbps 850 Mbps 3 Gbps 3 Gbps 3 Gbps 4 Gbps 4 Gbps
Throughput (2)
AV Throughput (3)
890 Mbps 890 Mbps 890 Mbps 2.1 Gbps 2.1 Gbps 2.1 Gbps 2.2 Gbps 2.2 Gbps
IPS Throughput (4) 1.2 Gbps 1.2 Gbps 1.2 Gbps 3.3 Gbps 3.3 Gbps 3.3 Gbps 3.9 Gbps 3.9 Gbps
IMIX Throughput (5) 1.7 Gbps 1.7 Gbps 1.7 Gbps 5.3 Gbps 5.3 Gbps 5.3 Gbps 7 Gbps 7 Gbps
NGFW
470 Mbps 470 Mbps 470 Mbps 1.25 Gbps 1.25 Gbps 1.25 Gbps 1.5 Gbps 1.5 Gbps
Throughput (6)
Threat Protection
360 Mbps 360 Mbps 400 Mbps 860 Mbps 900 Mbps 900 Mbps 1.1 Gbps 1.1 Gbps
Throughput (7)
New Sessions/s (8)
27,000 27,000 28,000 80,000 120,000 120,000 150,000 150,000
Maximum Concur-
0.2M 0.2M 0.6M 1M 3M 3M 3.2M 3.2M
rent Sessions (9)
IPsec Tunnel
512 512 2000 2000 6000 6000 6000 6000
Number
SSL VPN Users
8 / 128 8 / 128 8 / 500 8 / 1000 8 / 4000 8 / 4000 8 / 6000 8 / 6000
(Default/Max)
Virtual Systems
N/A N/A 1/5 1/5 1/ 50 1/ 50 1/ 100 1/ 100
(Default/Max)

Storage N/A N/A N/A N/A N/A 256G SSD N/A 256G SSD

1 x Console Port, 1 x Console Port, 1 x Console Port, 1 x Console Port,

1 x AUX Port, 1 x AUX Port, 1 x AUX Port, 1 x AUX Port,
1 x Console Port, 1 x Console Port, 1 x Console Port, 1 x Console Port,
Management Ports 1 x USB Port, 1 x USB Port, 1 x USB Port, 1 x USB Port,
1 x USB Port 1 x USB Port 1 x USB Port 1×USB port
1 x HA, 1 x HA, 1 x HA, 1 x HA,
1x MGT 1x MGT 1x MGT 1x MGT

6 x GE (1 bypass 6 x GE (1 bypass
Fixed I/O Ports 9 x GE 9 x GE 9 x GE 5 x GE, 4 x Combo 6 x GE, 4 x SFP 6 x GE, 4 x SFP pair), 4 x SFP, pair), 4 xSFP,
2 x SFP+ 2 x SFP+
Available Slots
for Expansion N/A N/A N/A N/A 2 x Generic Slot 2 x Generic Slot 2 x Generic Slot 2 x Generic Slot
Modules
IOC-4GE-B-P, IOC-4GE-B-P, IOC-4GE-B-P, IOC-4GE-B-P,
Expansion Module
N/A N/A N/A N/A IOC-8GE-P, IOC-8GE-P, IOC-8GE-P, IOC-8GE-P,
Option
IOC-8SFP-P IOC-8SFP-P IOC-8SFP-P IOC-8SFP-P
Twin-mode HA N/A N/A N/A N/A N/A N/A Yes Yes
45W, Dual AC 150W, Dual AC 150W, Dual AC 150W, Dual AC 150W, Dual AC
30W, Single AC 30W, Single AC 45W, Single AC
Power Redundant Redundant Redundant Redundant Redundant
AC 100-240 V AC 100-240 V AC 100-240 V
Specification AC 100-240 V AC 100-240 V AC 100-240 V AC 100-240 V AC 100-240 V
50/60 Hz 50/60 Hz 50/60 Hz
50/60 Hz 50/60 Hz 50/60 Hz 50/60 Hz 50/60 Hz
desktop desktop 1U 1U 1U 1U 1U 1U
Dimension
12.6×5.91×1.7 in 12.6×5.91×1.7 in 17.4x9.5x1.7 in 17.4x9.5x1.7 in 17.2x14.4x1.7 in 17.2x14.4x1.7 in 17.2x14.4x1.7 in 17.2x14.4x1.7 in
(W×D×H, mm)
(320×150×44 mm) (320×150×44 mm) (442x241x44 mm)  (442x241x44 mm) (436x366x44 mm) (436x366x44 mm) (436x366x44 mm) (436x366x44 mm)

Weight 3.3 lb (1.5 kg)  3.3 lb (1.5 kg)  5.5 lb (2.5 kg)  5.5 lb (2.5 kg)  12.3 lb (5.6 kg)  12.3 lb (5.6 kg)  12.3 lb (5.6 kg)  27.1 lb (11.8 kg) 
Temperature 32-104°F (0-40°C)  32-104°F (0-40°C)  32-104°F (0-40°C)  32-104°F (0-40°C)  32-104°F (0-40°C)  32-104°F (0-40°C)  32-104°F (0-40°C)  32-104°F (0-40°C) 
Relative Humidity 10-95% (no dew)  10-95% (no dew)  10-95% (no dew)  10-95% (no dew)  10-95% (no dew)  10-95% (no dew)  10-95% (no dew)  10-95% (no dew) 

Module Options
IOC-8GE-P IOC-8SFP-P IOC-4GE-B-P

Names 8GE Expansion Module  8SFP Expansion Module  4GE Bypass Expansion Module 
I/O Ports 8 x GE  8 x SFP, SFP module not included  4 x GE Bypass (2 pair bypass ports) 
Dimension ½U (Occupies 1 generic slot)  ½U (Occupies 1 generic slot)  ½U (Occupies 1 generic slot) 
Weight 1.8 lb (0.8 kg)  2.0 lb (0.9 kg)  1.8 lb (0.8 kg) 

www.HillstoneNet.com © 2021 Hillstone Networks All Rights Reserved. | 5

Hillstone E-Pro Series Firewall

Specifications
SG-6000-E5260P SG-6000-E5268P SG-6000-E5560P SG-6000-E5568P SG-6000-E5760P SG-6000-E5960P SG-6000-E6368P

FW Throughput (1) 20 Gbps 20 Gbps 20 Gbps 20 Gbps 40 Gbps 40 Gbps 90 Gbps

IPsec
8.4 Gbps 8.4 Gbps 12 Gbps 12 Gbps 18.8 Gbps 25.6 Gbps 64 Gbps
Throughput (2)
AV Throughput (3) 3.8 Gbps 3.8 Gbps 4.9 Gbps 4.9 Gbps 7.9 Gbps 14 Gbps 28 Gbps
IPS Throughput (4) 8.9 Gbps 8.9 Gbps 9.3 Gbps 9.3 Gbps 18.5 Gbps 18.8 Gbps 37 Gbps
IMIX Throughput (5) 15.5 Gbps 15.5 Gbps 20 Gbps 20 Gbps 36.5 Gbps 40 Gbps 90 Gbps
NGFW
3.9 Gbps 3.9 Gbps 5.6 Gbps 5.6 Gbps 8.9 Gbps 14 Gbps 26 Gbps
Throughput (6)

Threat Protection
2.2 Gbps 2.2 Gbps 3.1 Gbps 3.1 Gbps 5.2 Gbps 8.2 Gbps 18 Gbps
Throughput (7)
New Sessions/s (8) 200,000 200,000 300,000 300,000 500,000 600,000 1,100,000
Maximum Concur-
6M 6M 10M 10M 12M 15M 30M
rent Sessions (9)

IPsec Tunnel
20,000 20,000 20,000 20,000 20,000 20,000 20,000
Number

SSL VPN Users

8 / 10,000 8 / 10,000 8 / 10,000 8 / 10,000 8 / 10,000 8 / 10,000 8 / 10,000
(Default/Max)

Virtual Systems
1 / 250 1 / 250 1 / 250 1 / 250 1 / 250 1 / 250 1 / 500
(Default/Max)
Storage N/A 256G SSD N/A 256G SSD N/A N/A 512G SSD

1 x Console Port, 1 x Console Port, 1 x Console Port, 1 x Console Port, 1 x Console Port, 1 x Console Port, 1 x Console Port,
1 x AUX Port, 1 x AUX Port, 1 x AUX Port, 1 x AUX Port, 1 x AUX Port, 1 x AUX Port, 1 x AUX Port,
Management Ports 1 x USB Port, 1 x USB Port, 1 x USB Port, 1 x USB Port, 1 x USB Port, 1 x USB Port, 1 x USB Port,
1 x HA, 1 x HA, 1 x HA, 1 x HA, 1 x HA, 1 x HA, 1 x HA,
1x MGT 1x MGT 1x MGT 1x MGT 1x MGT 1x MGT 1x MGT

4 x GE (1 bypass pair), 4x GE (1 bypass pair), 4 x GE (1 bypass pair), 4 x GE (1 bypass pair),

2 x GE, 8 x SFP+,
Fixed I/O Ports 4 x SFP, 4 x SFP, 4 x SFP, 4 x SFP, 4 x GE, 4x SFP 4 x GE, 4x SFP 
2×QSFP+
2 x SFP+ 2 x SFP+ 2 x SFP+ 2 x SFP+
Available Slots for 2 x Generic Slot
4 x Generic Slot 4 x Generic Slot  4 x Generic Slot 4 x Generic Slot  4 x Generic Slot 4 x Generic Slot 
Expansion Modules 1 x Bypass Slot

IOC-4GE-B-P IOC-4GE-B-P IOC-4GE-B-P IOC-4GE-B-P IOC-4GE-B-P IOC-4GE-B-P

IOC-8GE-P IOC-8GE-P IOC-8GE-P IOC-8GE-P IOC-8GE-P IOC-8GE-P
Expansion Module IOC-8SFP-P IOC-8SFP-P IOC-8SFP-P IOC-8SFP-P IOC-8SFP-P IOC-8SFP-P IOC-8GE-P,
Option IOC-4SFP+-P IOC-4SFP+-P IOC-4SFP+-P IOC-4SFP+-P IOC-4SFP+-P IOC-4SFP+-P IOC-8SFP-P
IOC-8SFP+-P IOC-8SFP+-P IOC-8SFP+-P IOC-8SFP+-P IOC-8SFP+-P IOC-8SFP+-P
IOC-2SFP+-Lite-P IOC-2SFP+-Lite-P IOC-2SFP+-Lite-P IOC-2SFP+-Lite-P IOC-2SFP+-Lite-P IOC-2SFP+-Lite-P

Twin-mode HA Yes Yes Yes Yes Yes Yes Yes

450W, Dual AC Redun- 450W, Dual AC Redun- 450W, Dual AC Redun- 450W, Dual AC Redun- 450W, Dual AC Redun- 450W, Dual AC Redun- 450W, Dual AC Redun-
Power
dant, dant, dant, dant, dant, dant, dant,
Specification
AC 100-240 V 50/60 Hz AC 100-240 V 50/60 Hz AC 100-240 V 50/60 Hz AC 100-240 V 50/60 Hz AC 100-240 V 50/60 Hz AC 100-240 V 50/60 Hz AC 100-240 V 50/60 Hz

2U 2U 2U 2U 2U 2U 2.5U
Dimension
17.3x20.9x3.5 in 17.3x20.9x3.5 in 17.3x20.9x3.5 in 17.3x20.9x3.5 in 17.3x20.9x3.5 in 17.3x20.9x3.5 in 17.3×18.1×4.3 in
(W×D×H, mm)
(440x530x88 mm) (440x530x88 mm) (440x530x88 mm) (440x530x88 mm) (440x530x88 mm) (440x530x88 mm) (440×460×110 mm)
Weight 26.0 lb (11.8 kg) 26.0 lb (11.8 kg) 27.1 lb (12.3 kg) 27.1 lb (12.3 kg) 27.1 lb (12.3 kg) 27.1 lb (12.3 kg) 30.4 lb (13.8 kg)
Temperature 32-104°F (0-40°C)  32-104°F (0-40°C)  32-104°F (0-40°C)  32-104°F (0-40°C)  32-104°F (0-40°C)  32-104°F (0-40°C)  32-104°F (0-40°C) 
Relative Humidity 10-95% (no dew)  10-95% (no dew)  10-95% (no dew)  10-95% (no dew)  10-95% (no dew)  10-95% (no dew)  10-95% (no dew) 

Module Options
IOC-4GE-B-P IOC-8GE-P IOC-8SFP-P IOC-2SFP+-Lite-P IOC-4SFP+-P IOC-8SFP+-P

4GE Bypass Expansion

Names 8GE Expansion Module  8SFP Expansion Module  2SFP+ Expansion Module  4SFP+ Expansion Module 8SFP+ Expansion Module
Module 

4 x GE Bypass 8 x SFP, 2 x SFP+, 4 x SFP+, 8 x SFP+,

I/O Ports 8 x GE 
(2 pair bypass ports)  SFP module not included  SFP+ module not included  SFP+ module not included  SFP+ module not included 
Dimension ½U (Occupies 1 generic slot)  ½U (Occupies 1 generic slot)  ½U (Occupies 1 generic slot)  ½U (Occupies 1 generic slot)  1U (Occupies 2 generic slot)  1U (Occupies 2 generic slot) 
Weight 1.8 lbs (0.8 kg)  1.8 lbs (0.8 kg)  2.0 lbs (0.9 kg)  0.7 lbs (0.3 kg)  1.5lbs (0.9 kg) 1.5lbs (0.9 kg)

NOTES:
(1) FW throughput data is obtained under single-stack UDP traffic with 1518-byte packet size;
(2) IPsec throughput data is obtained under Preshare Key AES256+SHA-1 configuration and 1400-byte packet size;
(3) AV throughput data is obtained under HTTP traffic with file attachment;
(4) IPS throughput data is obtained under bi-direction HTTP traffic detection with all IPS rules being turned on;
(5) IMIX throughput data is obtained under UDP traffic mix (64 byte : 512 byte : 1518 byte =5:7:1);
(6) NGFW throughput data is obtained under 64 Kbytes HTTP traffic with application control and IPS enabled;
(7) Threat protection throughput data is obtained under 64 Kbytes HTTP traffic with application control, IPS, AV and URL filtering enabled;
(8) New sessions/s is obtained under TCP traffic;
(9) Maximum concurrent sessions is obtained under HTTP traffic.
Unless specified otherwise, all performance, capacity and functionality are based on StoneOS5.5R8. Results may vary based on StoneOS® version and deployment.

www.HillstoneNet.com
© 2021 Hillstone Networks All Rights Reserved.
Version: EX-08.01-NGFW-E-Pro-Series-5.5R8-0621-EN-01