E2300 / E2800 / E2860 / E2868

Hillstone E-2000 Series

Next-Generation Firewall

The Hillstone E-2000 Series Next Generation Firewall (NGFW) provides comprehensive and gran-
ular visibility and control of applications. It can identify and prevent potential threats associated
with high-risk applications while providing policy-based control over applications, users, and user-
groups. Policies can be defined that guarantee bandwidth to mission-critical applications while
restricting or blocking unauthorized or malicious applications. The Hillstone E-2000 Series NGFW
incorporates comprehensive network security and advanced firewall features, provides superior
price performance, excellent energy efficiency, and comprehensive threat prevention capability.

Product Highlights
Granular Application Identification and Control Comprehensive Threat Detection and Prevention
The Hillstone E-2000 Series NGFW provides fine-grained The Hillstone E-2000 Series NGFW provides real-time protec-
control of web applications regardless of port, protocol, or tion for applications from network attacks including viruses,
evasive action. It can identify and prevent potential threats spyware, worms, botnets, ARP spoofing, DoS/DDoS, Trojans,
associated with high-risk applications while providing poli- buffer overflows, and SQL injections. It incorporates a unified
cy-based control over applications, users, and user-groups. threat detection engine that shares packet details with multi-
Security Policies can be defined that guarantee bandwidth ple security engines (AD, IPS, URL filtering, Antivirus, Sandbox
to mission-critical applications while restricting or blocking etc.), which significantly enhances the protection efficiency
unauthorized or malicious applications. and reduces network latency.

[Link] © 2022 Hillstone Networks All Rights Reserved. | 1

Hillstone E-2000 Series Next-Generation Firewall

Features
Network Services Attack Defense • IPS enablement for SSL encrypted traffic
•
Dynamic routing (OSPF, BGP, RIPv2) • Abnormal protocol attack defense • AV enablement for SSL encrypted traffic
•
Static and Policy routing • Anti-DoS/DDoS, including SYN flood, UDP flood, • URL filter for SSL encrypted traffic
• Route controlled by application DNS reply flood, DNS query flood defense, TCP • SSL Encrypted traffic whitelist
fragment, ICMP fragment, etc.

• Built-in DHCP, NTP, DNS Server and DNS proxy • SSL proxy offload mode
• ARP attack defense

• Tap mode – connects to SPAN port • SSL proxy supports IP whitelist and predefined
• Allow list for destination IP address

•
Interface modes: sniffer, port aggregated, whitelist
loopback, VLANS (802.1Q and Trunking) • Support TLS v1.2, TLS v1.3
URL Filtering
• L2/L3 switching & routing • Support application identification, DLP, IPS

• Flow-based web filtering inspection

• Multicast(PIM-SSM) sandbox, AV for SSL proxy decrypted traffic of

• Manually defined web filtering based on URL, web SMTPS/POP3S/IMAPS

• Virtual wire (Layer 1) transparent inline

content and MIME header
deployment • Dynamic web filtering with cloud-based real-time Endpoint Identification and Control
categorization database: over 140 million URLs • Support to identify endpoint IP, endpoint quantity,
Firewall
with 64 categories (8 of which are security related) on-line time, off-line time, and on-line duration
• Operating modes: NAT/route, transparent (bridge),
• Additional web filtering features: • Support 10 operating systems including Windows,

and mixed mode

- Filter Java Applet, ActiveX or cookie iOS, Android, etc.
• Policy objects: predefined, custom, aggregate
- Block HTTP Post • Support query based on IP, endpoint quantity,

policy, object grouping

- Log search keywords control policy and status etc.
• Security policy based on application, role and
• Support the identification of accessed endpoints

geo-location - Exempt scanning encrypted connections on

certain categories for privacy quantity across layer 3, logging and interference
• Application Level Gateways and session support:
on overrun IP

MSRCP, PPTP, RAS, RSH, SIP, FTP, TFTP, HTTP, • Web filtering profile override: allows administrator
dcerpc, dns-tcp, dns-udp, H.245 0, H.245 1, H.323 to temporarily assign different profiles to user/ • Redirect page display after custom interference
group/IP operation
• NAT and ALG support: NAT46, NAT64, NAT444,
• Supports blocking operations on overrun IP

SNAT, DNAT, PAT, Full Cone NAT, STUN • Web filter local categories and category rating
• NAT configuration: per policy and central NAT override • User identification and traffic control for remote
desktop services of Windows Server

table • Support multi-language

• VoIP: SIP/H.323/SCCP NAT traversal, RTP pin
• URL allow / block list configuration Data Security
holing
Cloud-Sandbox • File transfer control based on file type, size and
• Global policy management view

name
• Security policy redundancy inspection, policy • Upload malicious files to cloud sandbox for

analysis • File protocol identification, including HTTP, FTP,

group, policy configuration rollback SMTP, POP3 and SMB
• Policy Assistant for service based or application • Support protocols including HTTP/HTTPS, POP3,

IMAP, SMTP, FTP and SMB • File signature and suffix identification for over 100
based policy generation file types
• Policy analyzing and invalid policy cleanup • Support file types including PE, ZIP, RAR, Office,
PDF, APK, JAR, SWF and Script • Content filtering for HTTP-GET, HTTP-POST, FTP
• Comprehensive DNS policy and SMTP protocols
• File transfer direction and file size control
• Schedules: one-time and recurring • Content filtering for predefined keywords and file
• Provide complete behavior analysis report for
contents
Intrusion Prevention malicious files
• IM identification and network behavior audit
• Protocol anomaly detection, rate-based detection, • Global threat intelligence sharing, real-time threat
blocking • Filter files transmitted by HTTPS using SSL Proxy
custom signatures, manual, automatic push or
and SMB
pull signature updates, integrated threat encyclo- • Support detection only mode without uploading
pedia files Application Control
• IPS Actions: default, monitor, block, reset • Over 4,000 applications that can be filtered by
(attackers IP or victim IP, incoming interface) with Botnet C&C Prevention
name, category, subcategory, technology and risk
expiry time • Discover intranet botnet host by monitoring C&C
connections and block further advanced threats • Each application contains a description, risk
• Packet logging option factors, dependencies, typical ports used, and
such as botnet and ransomware
• Filter Based Selection: severity, target, OS, appli- URLs for additional reference
cation or protocol • Regularly update the botnet server addresses
• Actions: block, reset session, monitor, traffic
• IP exemption from specific IPS signatures • Prevention for C&C IP and domain
shaping
• IDS sniffer mode • Support TCP, HTTP, and DNS traffic detection
• Identify and control cloud applications in the cloud
• IPv4 and IPv6 rate based DoS protection with • Allow and block list based on IP address or
• Provide multi-dimensional monitoring and
threshold settings against TCP Syn flood, TCP/ domain name
statistics for cloud applications, including risk
UDP/SCTP port scan, ICMP sweep, TCP/UDP/ • Support DNS sinkhole and DNS tunneling category and characteristics
SCIP/ICMP session flooding (source/destination) detection
• Active bypass with bypass interfaces • DGA Domain detection Quality of Service (QoS)
• Predefined prevention configuration • Max/guaranteed bandwidth tunnels or IP/user
IP Reputation basis
Antivirus • Identify and filter traffic from risky IPs such as • Tunnel allocation based on security domain,
• Manual, automatic push or pull signature updates botnet hosts, spammers, Tor nodes, breached interface, address, user/user group, server/server
hosts, and brute force attacks group, application/app group, TOS, VLAN
• Manually add or delete MD5 signature to the AV
database • Logging, dropping packets, or blocking for • Bandwidth allocated by time, priority, or equal
different types of risky IP traffic bandwidth sharing
• MD5 signature support uploading to cloud
sandbox, and manually add or delete on local • Periodical IP reputation signature database • Type of Service (TOS), Differentiated Services (
database upgrade DiffServ) and traffic-class support
• Flow-based Antivirus: protocols include HTTP, SSL Decryption • Prioritized allocation of remaining bandwidth
SMTP, POP3, IMAP, FTP/SFTP, SMB • Maximum concurrent connections per IP
• Application identification for SSL encrypted traffic
• Compressed file virus scanning

[Link] © 2022 Hillstone Networks All Rights Reserved. | 2

Hillstone E-2000 Series Next-Generation Firewall

Features (Continued)
• Bandwidth allocation based on URL category • MAC host check per portal • Interface based authentication
• Bandwidth limit by delaying access for user or IP • Cache cleaning option prior to ending SSL VPN • Agentless ADSSO (AD Polling)
• Automatic expiration cleanup and manual cleanup session
• Use authentication synchronization based on
of user used traffic • L2TP client and server mode, L2TP over IPSEC, SSO-monitor
and GRE over IPSEC
Server Load Balancing • Support IP-based and MAC-based user authenti-
• View and manage IPSEC and SSL VPN connec- cation
• Weighted hashing, weighted least-connection, and tions
weighted round-robin • PnPVPN Administration
• Session protection, session persistence and • VTEP for VxLAN static unicast tunnel • Management access: HTTP/HTTPS, SSH, telnet,
session status monitoring console
• Server health check, session monitoring and IPv6 • Central Management: Hillstone Security Manager
session protection • Management over IPv6, IPv6 logging, HA and and (HSM), web service APIs
HA peermode, twin-mode AA and AP • System Integration: SNMP, syslog, alliance
Link Load Balancing
• IPv6 tunneling: DNS64/NAT64, IPv6 ISATAP, IPv6 partnerships
• Bi-directional link load balancing GRE, IPv6 over IPv4 GRE • Rapid deployment: USB auto-install, local and
• Outbound link load balancing: policy based routing • IPv6 routing including static routing, policy routing, remote script execution
including ECMP, time, weighted, and embedded ISIS, RIPng, OSPFv3 and BGP4+
ISP routing; Active and passive real-time link • Dynamic real-time dashboard status and drill-in
quality detection and best path selection • IPv6 support on LLB monitoring widgets
• Inbound link load balancing supports SmartDNS • IPS, Application identification, URL filtering, • Language support: English
and dynamic detection Antivirus, Access control, ND attack defense, iQoS, • Administrator authentication: Active Directory and
SSL VPN LDAP
• Automatic link switching based on bandwidth,
latency, jitter, connectivity, application etc. • Track address detection
• IPv6 jumbo frame support Logs & Reporting
• Link health inspection with ARP, PING, and DNS
• IPv6 Radius and sso-radius support • Logging facilities: local log storage with storage
VPN models for up to 6 months, multiple syslog
• IPv6 is supported in Active Directory whitelist servers and multiple Hillstone Security Audit (HSA)
• IPSec VPN • IPv6 support on the following ALGs: TFTP, FTP, platforms
- IPSEC Phase 1 mode: aggressive and main ID RSH, HTTP, SIP, SQLNETv2, RTSP, MSRPC, • Encrypted logging and log integrity with HSA
protection mode SUNRPC scheduled batch log uploading
- Peer acceptance options: any ID, specific ID, ID in • IPv6 support on distributed iQoS • Reliable logging using TCP option (RFC 3195)
dialup user group
VSYS • Detailed traffic logs: forwarded, violated sessions,
- Supports IKEv1 and IKEv2 (RFC 4306) local traffic, invalid packets, URL etc.
- Authentication method: certificate and • System resource allocation to each VSYS
• Comprehensive event logs: system and adminis-
pre-shared key • CPU virtualization
trative activity audits, routing & networking, VPN,
- IKE mode configuration support (as server or • Non-root VSYS support firewall, IPSec VPN, user authentications, WiFi related events
client) SSL VPN, IPS, URL filtering, app monitoring, IP
• IP and service port name resolution option
- DHCP over IPSEC reputation, QoS
• Brief traffic log format option
- Configurable IKE encryption key expiry, NAT • VSYS monitoring and statistic
• Three predefined reports: Security, Flow and
traversal keep alive frequency network reports
High Availability
- Phase 1/Phase 2 Proposal encryption: DES, • User defined reporting
• Redundant heartbeat interfaces
3DES, AES128, AES192, AES256
• Active/Active and Active/Passive mode • Reports can be exported in PDF, Word and HTML
- Phase 1/Phase 2 Proposal authentication: via Email and FTP
MD5, SHA1, SHA256, SHA384, • Standalone session synchronization
SHA512 • HA reserved management interface Statistics and Monitoring
- IKEv1 support DH group 1,2,5,19,20,21,24 • Failover: • Application, URL, threat events statistic and
- IKEv2 support DH group - Port, local & remote link monitoring monitoring
1,2,5,14,15,16,19,20,21,24 - Stateful failover • Real-time traffic statistic and analytics
- XAuth as server mode and for dialup users - Sub-second failover • System information such as concurrent session,
- Dead peer detection - Failure notification CPU, Memory and temperature
- Replay detection • Deployment options: • iQOS traffic statistic and monitoring, link status
- Autokey keep-alive for Phase 2 SA - HA with link aggregation monitoring
• IPSEC VPN realm support: allows multiple custom - Full mesh HA • Support traffic information collection and
SSL VPN logins associated with user groups (URL forwarding via Netflow (v9.0)
- Geographically dispersed HA
paths, design)
CloudView
• IPSEC VPN supports configuration guide. User and Device Identity
Configuration options: route-based or policy based • Cloud-based security monitoring
• Local user database
• IPSEC VPN deployment modes: gateway-to- • 24/7 access from web or mobile application
• Remote user authentication: TACACS+, LDAP,
gateway, full mesh, hub-and-spoke, redundant Radius, Active Directory • Device status, traffic and threat monitoring
tunnel, VPN termination in transparent mode • Cloud-based log retention and reporting
• Single-sign-on: Windows AD
• One time login prevents concurrent logins with the
• 2-factor authentication: 3rd party support, IoT Security
same username
integrated token server with physical and SMS
• SSL portal concurrent users limiting • Identify IoT devices such as IP Cameras and
• User and device-based policies Network Video Recorders
• SSL VPN port forwarding module encrypts client
• User group synchronization based on AD and • Support query of monitoring results based on
data and sends the data to the application server
LDAP filtering conditions, including device type, IP
• Supports clients that run iOS, Android, Microsoft
• Support for 802.1X, SSO Proxy address, status, etc.
Windows, macOS and Linux
• WebAuth: page customization, force crack • Support customized whitelists
• Host integrity checking and OS checking prior to
prevention, IPv6 support
SSL tunnel connections

[Link] © 2022 Hillstone Networks All Rights Reserved. | 3

Hillstone E-2000 Series Next-Generation Firewall

Specifications

SG-6000-E2300 SG-6000-E2800 SG-6000-E2860 SG-6000-E2868

FW Throughput (1) 2.5 Gbps / 4 Gbps 4.5 Gbps / 6 Gbps 6 Gbps 6 Gbps
IPSec Throughput (2) 1 Gbps 3 Gbps 3 Gbps 3 Gbps
AV Throughput (3) 700 Mbps 1.2 Gbps 1.2 Gbps 1.2 Gbps
IPS Throughput (4) 1 Gbps 1.8 Gbps 1.8 Gbps 1.8 Gbps
IMIX Throughput (5) 800 Mbps 2 Gbps 2 Gbps 2 Gbps
NGFW Throughput (6) 650 Mbps 850 Mbps 1 Gbps 1 Gbps
Threat Protection Throughput (7) 500 Mbps 700 Mbps 800 Mbps 800 Mbps
New Sessions/s (8) 50,000 80,000 80,000 80,000
Maximum Concurrent Sessions
1 Million / 2 Million 1 Million / 2 Million 2 Million 2 Million
(Standard/Maximum) (9)
IPSec Tunnel Number 2,000 2,000 4,000 4,000
SSL VPN Users (Default/Max) 8 / 1,000 8 / 1,000 8 / 2,000 8 / 2,000
Virtual Systems (Default/Max) 1/5 1/5 1/5 1/5

Storage Options N/A N/A N/A 256G / 512G SSD

(E2868 / E2868A)
1 x Console Port, 1 x AUX Port, 1 x 1 x Console Port, 1 x AUX Port
Management Ports 1 x Console Port, 1×USB port 1 x Console Port, 1×USB port
USB Port, 1 x HA, 1 x MGT 1 x USB Port, 1 x HA, 1 x MGT
Fixed I/O Ports 5 x GE, 4 x Combo 5 x GE, 4 x Combo 6 x GE, 4 x SFP 6 x GE, 4 x SFP

Available Slots for Expansion N/A N/A 2 x Generic Slot 2 x Generic Slot
Modules
IOC-4GE-B-M, IOC-8GE-M, IOC- IOC-4GE-B-M, IOC-8GE-M, IOC-
Expansion Module Option N/A N/A
8SFP-M 8SFP-M
45W, Single AC or DC, Dual AC 45W, Single AC or DC, Dual AC 150W, Single AC or DC, Dual AC
Power Specification 150W, Single AC, Dual AC Redundant
Redundant Redundant Redundant

Power Supply AC 100-240 V 50/60 Hz AC 100-240 V 50/60 Hz AC 100-240 V 50/60 Hz AC 100-240 V 50/60 Hz
DC -40 ~ -60 V DC -40 ~ -60 V DC -40 ~ -60 V DC -40 ~ -60 V
1U 17.4 x 9.5 x 1.7 in 1U 17.4 x 9.5 x 1.7 in 1U 17.2 x 14.4x 1.7 in 1U 17.2 x 14.4x 1.7 in
Dimension (W×D×H, mm)
(442 x 241 x 44 mm) (442 x 241 x 44 mm) (436 x 366 x 44 mm) (436 x 366 x 44 mm)
Weight 5.5 lb (2.5 kg) 5.5 lb (2.5 kg) 12.3 lb (5.6 kg) 12.3 lb (5.6 kg)
Temperature 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C) 32-104°F (0-40°C)
Relative Humidity 10-95%(no dew) 10-95% (no dew) 10-95% (no dew) 10-95% (no dew)
Compliance and Certificate CE, CB, FCC, UL/cUL, ROHS, IEC/EN61000-4-5 Power Surge Protection, ISO 9001:2015, ISO 14001:2015, CVE Compatibility, IPv6 Ready, ICSA Firewalls

Module Options
IOC-8GE-M IOC-8SFP-M IOC-4GE-B-M

Names 8GE Expansion Module 8SFP Expansion Module 4GE Bypass Expansion Module
I/O Ports 8 x GE 8 x SFP, SFP module not included 4 x GE Bypass (2 pair bypass ports)
Dimension ½U (Occupies 1 generic slot) ½U (Occupies 1 generic slot) ½U (Occupies 1 generic slot)
Weight 1.8 lb (0.8 kg) 2.0 lb (0.9 kg) 1.8 lb (0.8 kg)

NOTES:
(1) FW throughput data is obtained under single-stack UDP traffic with 1518-byte packet size;
(2) IPSec throughput data is obtained under Preshare Key AES256+SHA-1 configuration and 1400-byte packet size;
(3) AV throughput data is obtained under HTTP traffic with file attachment;
(4) IPS throughput data is obtained under bi-direction HTTP traffic detection with all IPS rules being turned on;
(5) IMIX throughput data is obtained under UDP traffic mix (64 byte : 512 byte : 1518 byte =[Link]);
(6) NGFW throughput data is obtained under 64 Kbytes HTTP traffic with application control and IPS enabled;
(7) Threat protection throughput data is obtained under 64 Kbytes HTTP traffic with application control, IPS, AV and URL filtering enabled;
(8) New sessions/s is obtained under TCP traffic;
(9) Maximum concurrent sessions is obtained under HTTP traffic.
Unless specified otherwise, all performance, capacity and functionality are based on StoneOS5.5R9. Results may vary based on StoneOS® version and deployment.

[Link]
© 2022 Hillstone Networks All Rights Reserved.
Version: EX-08.01-NGFW-5.5R9-0122-EN-01