L3 Box S* VPN Gateway for RESTRICTED Communication - Secunet

( Box S)
L3 Box S*
VPN Gateway for RESTRICTED
Communication
As a VPN gateway, the SINA L3 Box is a key component of the central IT infrastructure
in high-security networks. The data exchanged between the SINA components is securely
transmitted via encrypted VPN tunnels. SINA L3 Boxes connect public authority
or corporate networks via public lines such as the Internet. Additionally, SINA L3 Boxes
can be configured as cryptographic network access points for SINA clients to (terminal)
servers.
The SINA L3 Box S and its predecessors, SINA Box LE, SINA Box 1U
(5xLAN) and SINA Box 1000, are IP-based encryption systems approved
by the German Federal Office for Information Security (BSI) for transmitting
classified information for both RESTRICTED and NATO RESTRICTED
classification levels. Just like its predecessors, the SINA L3 Box S also
serves national and international high security networks.
Due to the increased temperature ranges, integrated touch display and a
more modest power consumption the new SINA L3 Boxes S 30M, 200M
and 1G are more flexible than the predecessors. Additionally the new SINA
Boxes S 200M, 1G and 3G are substantially lighter. The network interfaces
can be fitted with SFP modules according to specific needs. This allows
for a flexible adaption to the customer’s network infrastructure. Compared
with the SINA Box 1000 the new SINA L3 Box S 1G has a more compact
design (19” 1U). Both models of the SINA L3 Box S 3G are equipped with
Benefits:
» » Approved up to RESTRICTED
and NATO RESTRICTED
» » High data throughput
» » High availability
» » Increased temperature ranges
» » State-of-the-art technology
in complex security networks
» » Network interfaces can
be fitted with SFP modules
according to customer
requirements
ten network interfaces each which makes them most suitable for use in
complex central network nodes. A crypto performance of up to 3 GBit/s
makes it the most powerful device of the SINA L3 Boxes S.
The SINA L3 Box S software version 3.3 (planned for Q4 2012) ensures
the IPv6 ability.
IT security concept
The SINA L3 Box S is based on an integrated IT security concept.
In particular, this concept includes:
▀▀ A▀hardened▀and▀intensively▀evaluated▀Linux▀system▀platform
▀▀ Smart▀card▀technology
▀▀ IPsec-based▀virtual▀private▀networks
▀▀ Hardware▀and▀software▀scaled▀and▀configured▀according▀to▀approval▀
requirements

L3 Box S
Secure system boot and operation
Depending on the actual conditions of the IT infrastructure and projectspecific
communications requirements, it is possible to use the SINA L3
Boxes S with thousands of simultaneous security associations. Upon
system start-up, the SINA L3 Box S software is securely loaded from flash
memory. All initial configuration data and security associations for the
SINA L3 Box are stored in a protected area of the SINA smart card. When
a SINA L3 Box is started, the security associations to the SINA Management
and the communications-related SINA L3 Boxes are set up as IPsec
VPN tunnels. If necessary, additional security associations or configuration
data can be downloaded from the SINA Management. This greatly
simplifies configuration, installation and hardware replacement with the
SINA L3 Box.
Systems monitoring
The SINA L3 Boxes log all system-monitoring relevant data during operation.
The syslog data can be imported into network management systems
for further processing and/or displayed as required. The new SINA L3 Box S
software version 3.3 (planned for Q4 2012) supports SNMP v2c.
High availability
Using redundant configurations it is possible to increase availability and
safeguard against failure of SINA L3 Boxes. An automatic switchover
mode triggers a second SINA L3 Box to take over the functions of the
failed SINA L3 Box. The SINA L3 Boxes S 1G and 3G are equipped with
redundant power supply units.
Additional details and performance data
* For further information about the new naming concept refer to: www.secunet.com/en/sina.
** For German national use only.
*** Due to several different producer-specific product variations SFP modules are not included in the scope of delivery. E. g. the following modules can be loaded:
Finisar FTLF8519P2BNL (optic fibre, Short Range, Multi Mode), Source SP-GB-LX-CDFH (optic fibre, Long Range, Single Mode) or 3COM 3CSFP93 RJ45.
More information:
www.secunet.com/en/sina
SINA_L3BoxS_V1_04/12_GB
Satellite communication
The use of SINA L3 Boxes requires IP-enabled transport networks, including
satellite communication lines. Satellite optimisers support the effective
use of the available bandwidth of the satellite lines.
Management
The SINA Management is used for central configuration of all SINA L3
Boxes in the network. An integrated public key infrastructure (PKI) with
the corresponding user management supports the main administrative
processes, particularly the personalisation, generation and/or updating of
keys and cryptographic parameters as well as the administration of associated
PINs and PUKs on the smart cards.
Approval-related construction classes
SINA L3 Box S
Approval level RESTRICTED, NATO RESTRICTED, RESTREINT UE**
Software versions 2.2
3.3 (planned for Q4 2012)
Authentication token SINA smart card
SINA L3 Box S 30M SINA L3 Box S 200M SINA L3 Box S 1G SINA L3 Box S 3G 10Cu SINA L3 Box S 3G 6Cu 4SFP
General technical data
Size 228 x 165 x 44,45 mm 19” 1 U 19” 1 U 19” 2 U 19” 2 U
Weight 1.8 kg 7.8 kg 9 kg 12.5 kg 12.5 kg
Power consumption
Crypto hardware
18 W 85 W 105 W 256 W 256 W
Encryption performance approx. 30 MBit/s approx. 200 MBit/s approx. 1000 MBit/s approx. 3000 MBit/s approx. 3000 MBit/s
Symmetric
cryptography
AES AES AES AES AES
Asymmetric
cryptography
LAN connections
EC-GDSA, EC-DH EC-GDSA, EC-DH EC-GDSA, EC-DH EC-GDSA, EC-DH EC-GDSA, EC-DH
Network interfaces*** 4 x 10/100/1000 MBit Cu 4 x 10/100/1000 MBit Cu 4 x 10/100/1000 MBit Cu 10 x 10/100/1000 MBit Cu 6 x 10/100/1000 MBit Cu
Temperature
2 x 1000 MBit SFP
2 x 1000 MBit SFP
4 x 1000 MBit SFP
Operation +5 °C to +40 °C +5 °C to +40 °C +5 °C to +40 °C +5 °C to +40 °C +5 °C to +40 °C
Transport -20 °C to +60 °C -20 °C to +60 °C -20 °C to +60 °C -20 °C to +60 °C -20 °C to +60 °C
Item number SB50.04 SB50.23 SB50.24 SB50.05 SB50.22
secunet▀Security▀Networks▀AG
Kronprinzenstraße▀30
45128▀Essen,▀Germany
Phone:▀ +49▀-▀201-▀54▀54▀-▀0▀
Fax:▀ +49▀-▀201-▀54▀54▀-1000
E-mail:▀ info@secunet.com▀
www.secunet.com