Trellix NX 2500
Network Security 5th Generation 1U Appliance

Overview

The Trellix NX 2500 stops the cyber attacks that use zero-day Web exploits and multiprotocol malware callbacks to compromise the majority of today's networks.

When used as a standard (or integrated) appliance, the NX Series appliance performs both monitoring and analysis functions. When used as a sensor within the FireEye Network Security, the NX 2500 only monitors traffic, extracting objects and URLs and sending them to an MVX cluster for analysis. This allows a flexible approach to your security solution.

Trellix Network Security

Trellix Network Security is an effective cyberthreat protection solution that helps your organization minimize the risk of costly breaches by accurately detecting and immediately stopping advanced, targeted, and other evasive attacks hiding in internet traffic. It facilitates efficient resolution of detected security incidents in minutes with concrete evidence, actionable intelligence, and response workflow integration.

With Trellix Network Security, you’re effectively protected against today’s threats whether they:

• Exploit Microsoft Windows, Apple OS X operating systems, or application vulnerabilities
• Are directed at the headquarters or branch offices
• Are hidden in a large volume of inbound internet traffic that must be inspected in real time

Trellix Network Security is available in a variety of form factors and deployment and performance options. It is typically placed in the path of internet traffic behind traditional network security appliances such as next generation firewalls, intrusion prevention systems (IPSs), and secure web gateways (SWGs).

Trellix Network Security supplements these solutions by rapidly detecting both known and unknown attacks with high accuracy and a low rate of false positives, while facilitating an efficient response to each alert.

Typical configuration of Network Security solutions

Features

Benefits

Designed to meet the needs of single-site and distributed multisite organizations, Trellix Network Security delivers several benefits.

Minimizes risk of cyberbreaches

Network Security is a highly effective cyberdefense solution that:

• Prevents intruders from breaking into an organization to steal valuable assets or disrupt business by stopping advanced, targeted, and other evasive attacks
• Stops attacks and contains intrusions faster with concrete evidence, actionable intelligence, inline blocking, and response workflow automation
• Eliminates weak points from an organization’s cyberdefenses with consistent protection for various operating systems, application types, branches, and central sites

Short payback period

Network Security gives you a return on your investment in several ways:

• Focuses security team resources on real attacks to reduce operational expenses
• Optimizes capital spend with a shared MVX service and a large variety of performance points to rightsize deployment to meet requirements
• Reduces future capital outlay with modular and extensible architecture
• Future-proofs security investment by scaling smoothly when the number of branches or the amount of internet traffic grows
• Protects existing investments by allowing cost-free migration from an integrated to a distributed deployment

Technical Advantages

Accurate and actionable threat detection and insights

Network Security uses multiple analysis techniques to detect attacks with high accuracy and a low rate of false alerts.

• The MVX engine detects zero-day, multiflow, and other evasive attacks with dynamic, signature-less analysis in a safe, virtual environment. It stops infection and compromise phases of the cyberattack kill chain by identifying never-before-seen exploits and malware.
• Multiple dynamic machine learning, AI, and correlation engines detect and block obfuscated, targeted, and other customized attacks with contextual, rule-based analysis from real-time insights gathered on the front lines from thousands of hours of incident response experience. Network Security stops the infection, compromise, and intrusion phases of the cyberattack kill chain by identifying malicious exploits, malware, phishing attacks, and command and control callbacks. It also extracts and submits suspicious network traffic to the MVX engine for a definitive verdict analysis. In addition to client-side protection, engines support server-side detection, lateral movement detection, and detection of post-exploitation traffic.
• Alerts generated by Network Security include concrete real-time evidence to quickly respond to, prioritize, and contain targeted and newly discovered attacks. When operating in Evidence Collector mode, Network Security generates Layer 7 metadata, which is sent to Trellix Helix for analysis to provide further security context for your SOC team. In addition, detected threats can also be mapped to the MITRE ATT&CK framework for contextual evidence.

Detection

Capabilities	Benefits
Accurate detection of advanced, targeted, and other evasive attacks	Minimizes risk of costly cyberbreaches
Visibility and detection of post-breach lateral movement	Decreases time to detect post-breach activities and reduces attacker dwell time
Modular and scalable security architecture	Provides investment protection and supports business growth
Consistent level of protection for multi-OS environments and all internet access points	Creates a strong defense across the entire organization for all types of devices
Integrated, distributed, physical, virtual, on-premises, and cloud deployment options	Offers flexibility to align with organizational preferences and resources
Multivector correlation with email and content security	Provides visibility across a wider attack surface

Prevention

Capabilities	Benefits
Immediate blocking of attacks at line rates from 250 Mbps to 10 Gbps	Gives real-time protection against evasive attacks
Visibility into encrypted traffic	Delivers optional built-in TLS 1.3 decryption support on appliances without an additional license fee

Response

Capabilities	Benefits
Low rate of false alerts, riskware categorization, and mapping to MITRE ATT&CK framework	Reduces operational cost of triaging unreliable alerts
Pivot to investigation and alert validation, endpoint containment, and incident response	Automates and simplifies security workflows
Execution evidence and actionable threat intelligence	Accelerates prioritization and resolution of detected security incidents

Comprehensive visibility into suspicious lateral movements

Network Security includes the SmartVision advanced correlation and analytics engine that detects suspicious lateral internal network traffic across the entire network, from the data center to remote branch office locations. With more than 180 rules for lateral movement detection, SmartVision provides full kill-chain detection that targets east-west, server-facing deployments.

SmartVision also includes a machine learning framework with data-exfiltration detection, JA3 detection for identifying encrypted communication, web shell detection (visibility into attacks on web servers), and detection of malware lateral movement. It provides Layer 7 context around every real-time alert and maps adversarial techniques based on the MITRE ATT&CK framework.

Immediate and resilient protection

Network Security offers flexible deployment modes, including out-of-band monitoring via test access point (TAP)/switched port analyzer (SPAN), inline monitoring, or inline active blocking. Inline blocking mode automatically blocks inbound exploits and malware and outbound multiprotocol callbacks. In inline monitoring mode, your organization decides how to respond to generated alerts. In out-of-band prevention mode, Network Security issues TCP resets for out-of-band blocking of TCP or HTTP connections.

Selected models offer an active high-availability option to provide resilience in case of network or device failures.

Wide attack surface coverage

Network Security delivers a consistent level of protection for today’s diverse network environments, providing:

• Support for most common Microsoft Windows, Apple Mac OS X, and Linux operating systems
• Analysis of over 160 different file types, including portable executables, active web content, archives, images, Java, Microsoft, and Adobe applications and multimedia
• Execution of suspicious network traffic against thousands of operating systems, service pack, IoT application type, and application version combinations
• Protection against advanced attacks and malware types that are difficult to detect via signatures: web shell uploads, existing web shells, ransomware, and cryptominers

Validated and prioritized alerts

In addition to detecting genuine attacks, MVX technology is also used to validate alerts detected by conventional signature-matching methods and to identify and prioritize critical threats. Your organization gets these efficiencies:

• IPS with MVX engine validation reduces the time required to triage signature-based detection that’s traditionally prone to false alerts.
• Riskware categorization separates genuine breach attempts from undesirable but less malicious activity (such as adware and spyware) to prioritize alert response.

Response workflow integration

Network Security can be augmented in several ways to automate alert response workflows. For example:

• Trellix Central Management System correlates alerts from both Network Security and Trellix Email Security for a broader view of an attack and to set blocking rules that prevent the attack from spreading further.
• Trellix Network Forensics integrates with Network Security to provide detailed packet captures associated with an alert and enable in-depth investigations.
• Trellix Endpoint Security identifies, validates, and contains compromises detected by Network Security to simplify containment and remediation of affected endpoints.

Flexible Deployment Options

Network Security offers various deployment options to match your organization’s needs and budget.

Integrated Network Security

Standalone, all-in-one hardware appliances with integrated MVX service secure an internet access point at a single site. Network Security is an easy-to-manage, clientless solution that deploys quickly without requiring rules, policies, or tuning.

Distributed Network Security

Extensible appliances with centrally shared MVX service secure internet access points within organizations using the following features and capabilities:

• Network Smart Node physical or virtual appliances analyze internet traffic to detect and block malicious traffic and submit suspicious activity over an encrypted connection to the MVX service for definitive verdict analysis.
• MVX Smart Grid on-premises, centrally located, elastic MVX service offers transparent scalability, built-in N+1 fault tolerance, and automated load balancing.
• Trellix Cloud MVX service subscription ensures privacy by analyzing traffic on the Network Smart Node; only suspicious objects are sent over an encrypted connection to the MVX service, where objects revealed as benign are discarded.
• Protection options on-premises or in the cloud, in addition to standalone and virtual appliances. Trellix offers Network Security in the public cloud with availability in both AWS and Azure.

Distributed deployment models for Network Security

Specifications

	NX 1500	NX 2500	NX 2550	NX 3500	NX 4500	NX 5500	NX 6500
IPS Performance
Max IPS performance	Up to 50 Mbps	Up to 100 / 250 Mbps	Up to 500 Mbps	Up to 1 Gbps	Up to 2 Gbps	Up to 5 Gbps	Up to 10 Gbps
Max concurrent connections	15K	80K	160K	500K	1 M	2 M	4 M
New connections per second	750/Sec	4K/Sec	8K/Sec	10K/Sec	20K/Sec	40K/Sec	80K/Sec
Specifications
OS support	Linux macOS X Microsoft Windows	Linux macOS X Microsoft Windows	Linux macOS X Microsoft Windows	Linux macOS X Microsoft Windows	Linux macOS X Microsoft Windows	Linux macOS X Microsoft Windows	Linux macOS X Microsoft Windows
Performance	Up to 50 Mbps	Up to 100 Mbps or250 Mbps	Up to 500 Mbps	Up to 1 Gbps	Up to 2 Gbps	Up to 5 Gbps	Up to 10 Gbps
SmartVision mode performance	N/A	Up to 200 Mbps or 500 Mbps	Up to 1 Gbps	Up to 2 Gbps	Up to 4 Gbps	Up to 10 Gbps	Up to 16 Gbps
Network monitoring ports	4x 10/100/1000 BASE-T ports	4x 1GigE bypass	4x 10GigE SFP+ 4x 1GigE bypass	4x 10GigE SFP+ 4x 1GigE bypass	8x 10GigE SFP+ 4x 1GigE bypass	8x 10GigE SFP+ 4x 1GigE bypass	8x 10GigE SFP+ 2x 40GigE QSFP
Network ports mode of operation	In-line monitor, fail-close or TAP	In-line monitor, fail-open, fail-close (HW bypass) or TAP/SPAN					In-line monitor, fail-close or TAP
High availability (HA)	Not available	Not available	Not available	Not available	Not available	Not available	Not available
Management ports (rear panel)	2x 10/100/1000 BASE-T Ports	2x 1GigE	2x 1GigE	2x 1GigE	2x 1GigE	2x 1GigE	2x 1GigE
IPMI port	Not available	Front panel	Rear panel	Rear panel	Rear panel	Rear panel	Rear panel
Front LCD & keypad	Not available	Not available	Not available	Not available	Not available	Not available	Not available
VGA port	Not available	Not available	Yes	Yes	Yes	Yes	Yes
USB ports	2x Type A USB ports	2x Type A USB ports (front panel)	4x Type A USB ports (all rear)	4x Type A USB ports (2 front, 2 rear)	4x Type A USB ports (2 front, 2 rear)	4x Type A USB ports (2 front, 2 rear)	2x Type A USB ports
Serial port (rear panel)	115,200 bps, No Parity, 8 bits, 1 Stop Bit (RJ45 connector; RJ45-to-Dsub adapter cable is included)	115,200 bps, No Parity, 8 bits, 1 Stop Bit (RJ45 connector; RJ45-to-Dsub adapter cable is included)	115,200 bps, No Parity, 8 Bits, 1 Stop Bit	115,200 bps, No Parity, 8 Bits, 1 Stop Bit	115,200 bps, No Parity, 8 Bits, 1 Stop Bit	115,200 bps, No Parity, 8 Bits, 1 Stop Bit	115,200 bps, No Parity, 8 Bits, 1 Stop Bit
Drive capacity	Single 500 GB 2.5 inch SATA HDD, internal, fixed	Single 1 TB 3.5 inch SATA HDD, internal, fixed	2 x 4 TB HDD, 3.5”, SAS3, 7.2 krpm, FRU RAID1	2 x 4 TB HDD, 3.5”, SAS3, 7.2 krpm, FRU RAID1	2 x 4 TB HDD, 3.5”, SAS3, 7.2 krpm, FRU RAID1	2 x 4 TB HDD, 3.5”, SAS3, 7.2 krpm, FRU RAID1	2x 10 TB HDD 3.5”, SAS3, 7.2 krpm FRU RAID1
Enclosure	Desktop form factor	1RU, Fits 19 inch rack	1RU, Fits 19 inch rack	2RU, Fits 19 inch rack	2RU, Fits 19 inch rack	2RU, Fits 19 inch rack	2RU, Fits 19 inch rack
Chassis dimension WxDxH	11in (280mm) x 6.9in (175mm) x 1.7in (44mm)	17.2in (437mm) x 19.7in (500mm) x 1.7in (43.2mm)	17.2in (437mm) x 25.6in (650mm) x 1.7in (43.2mm)	17.24in (438mm) x 24.41in (620mm) x 3.48in (88.4mm)	17.24in (438mm) x 24.41in (620mm) x 3.48in (88.4mm)	17.24in (438mm) x 24.41in (620mm) x 3.48in (88.4mm)	17.2in (437mm) x 31.0in (787mm) x 3.5in (89 mm)
AC power supply	External 60 Watt 12V@5A Output AC Adapter, 90–264 VAC, 50–60 Hz, IEC60320-C14, inlet, FRU	Single 250 watt, 90–264 VAC, 3.5–1.5 A, 50–60 Hz, IEC60320-C14, inlet, internal, fixed	Redundant (1+1) 750 watt, 100–240 VAC, 9–4.5A, 50–60 Hz, IEC60320-C14 inlet, FRU	Redundant (1+1) 800 watt, 100–240 VAC, 9–4.5A, 50–60 Hz, IEC60320-C14 inlet, FRU	Redundant (1+1) 800 watt, 100–240 VAC, 9–4.5A, 50–60 Hz, IEC60320-C14 inlet, FRU	Redundant (1+1) 800 watt, 100–240 VAC, 10.5–4.0A, 50–60 Hz, IEC60320-C14 inlet, FRU	Redundant (1+1) 1000 watt, 100–240 VAC, 10.5–4.0A, 50–60 Hz, IEC60320-C14 inlet, FRU
Power consumption maximum (watts)	24 watts	85 watts	265 watts	426 watts	519 watts	658 watts	660 watts
Thermal dissipation maximum (BTU/h)	82 BTU/h	290 BTU/h	904 BTU/h	1,454 BTU/h	1,771 BTU/h	2,245 BTU/h	2,252 BTU/h
MTBF (h)	193,772 h	108,944 h	54,200 h	65,466 h	57,766 h	52,802 h	54,041 h
Appliance alone / as shipped weight in lb. (kg)	3.75 lbs (1.7 kg) / 6.5 lbs (2.95 kg)	16.2 lbs (7.3 kg )/ 28.2 lbs (12.79 kg)	29.8 lbs (13.5 kg) / 40.8 lbs (18.5 kg)	37.4 lbs (17.0 kg) / 58.6 lbs (26.6 kg)	42.4 lbs (19.2 kg) / 63.5 lbs (28.8 kg)	42.7 lbs (19.4 kg) / 63.8 lbs. (29.0 kg)	44 lbs (20 kg) / 71 lbs (32.2 kg)
Regulatory compliance safety	IEC 60950 EN 60950-1 UL 60950 CSA/CAN-C22.2	IEC 60950 EN 60950-1 UL 60950 CSA/CAN-C22.2	IEC 60950 EN 60950-1 UL 60950 CSA/CAN-C22.2	IEC 60950 EN 60950-1 UL 60950 CSA/CAN-C22.2	IEC 60950 EN 60950-1 UL 60950 CSA/CAN-C22.2	IEC 60950 EN 60950-1 UL 60950 CSA/CAN-C22.2	IEC 60950 EN 60950-1 UL 60950 CSA/CAN-C22.2
Security certifications	FIPS 140-2 Level 1 CC NDcPP v2.2e	FIPS 140-2 Level 1 CC NDcPP v2.2e	FIPS 140-2 Level 1 CC NDcPP v2.2e	FIPS 140-2 Level 1 CC NDcPP v2.2e	FIPS 140-2 Level 1 CC NDcPP v2.2e	FIPS 140-2 Level 1 CC NDcPP v2.2e	FIPS 140-2 Level 1 CC NDcPP v2.2e
Regulatory compliance EMC	FCC Part 15 ICES-003 Class A AS/NZS CISPR 22 CISPR 32 EN 55032 EN 55024 IEC/EN 61000-3-2 IEC/EN 61000- 3-3 IEC/EN 61000- 4-2 V-2/2015 & V-3/2015	FCC Part 15 ICES-003 Class A AS/NZS CISPR 22 CISPR 32 EN 55032 EN 55024 IEC/EN 61000-3-2 IEC/EN 61000- 3-3 IEC/EN 61000- 4-2 V-2/2015 & V-3/2015	FCC Part 15 ICES-003 Class A AS/NZS CISPR 22 CISPR 32 EN 55032 EN 55024 IEC/EN 61000-3-2 IEC/EN 61000- 3-3 IEC/EN 61000- 4-2 V-2/2015 & V-3/2015	FCC Part 15 ICES-003 Class A AS/NZS CISPR 22 CISPR 32 EN 55032 EN 55024 IEC/EN 61000-3-2 IEC/EN 61000- 3-3 IEC/EN 61000- 4-2 V-2/2015 & V-3/2015	FCC Part 15 ICES-003 Class A AS/NZS CISPR 22 CISPR 32 EN 55032 EN 55024 IEC/EN 61000-3-2 IEC/EN 61000- 3-3 IEC/EN 61000- 4-2 V-2/2015 & V-3/2015	FCC Part 15 ICES-003 Class A AS/NZS CISPR 22 CISPR 32 EN 55032 EN 55024 IEC/EN 61000-3-2 IEC/EN 61000- 3-3 IEC/EN 61000- 4-2 V-2/2015 & V-3/2015	Safety: EN 60950; C22.2; UL 60950; IEC 60950; CAN/CSA-C22.2; K 60950; AS/NZS 60950; GB 4943.1; J60950, SI60950 EMC: FCC Part 15 SubPart B Class A; ICES-003; EN55032; VCCI V-3; EN 55024; EN 61000; CNS 13438; CISPR32; KN 32; KN 35
Environmental compliance	RoHS Directive 2011/65/EU REACH WEEE Directive 2012/19/EU	RoHS Directive 2011/65/EU REACH WEEE Directive 2012/19/EU	RoHS Directive 2011/65/EU REACH WEEE Directive 2012/19/EU	RoHS Directive 2011/65/EU REACH WEEE Directive 2012/19/EU	RoHS Directive 2011/65/EU REACH WEEE Directive 2012/19/EU	RoHS Directive 2011/65/EU REACH WEEE Directive 2012/19/EU	RoHS; REACH; WEEE Conflict Minerals
Operating temperature	0–40°C (32–104°F)	0–40°C (32–104°F)	0–40°C (32–104°F)	0–40°C (32–104°F)	0–40°C (32–104°F)	0–40°C (32–104°F)	0–40°C (32–104°F)
Non-operating temperature	-20–80°C (-4–176°F)	-20–80°C (-4–176°F)	-30–70°C (-22–158°F)	-40–70°C (-40–158°F)	-40–70°C (-40–158°F)	-40–70°C (-40–158°F)	-30–70°C (-22–158°F)
Operating relative humidity	10–95% at 40°C non-condensing	5–85% at 40°C non-condensing	10–95% at 40°C non-condensing	10–95% at 40°C non-condensing	10–95% at 40°C non-condensing	10–95% at 40°C non-condensing	10%–90% @ 40ºC non-condensing
Non-operating relative humidity	10–95% at 60°C non-condensing	5–95% at 40°C non-condensing	10–95% at 60°C non-condensing	10–95% at 60°C non-condensing	10–95% at 60°C non-condensing	10–95% at 60°C non-condensing	10%–95% @ 55°C non-condensing
Operating altitude	3,000 m 9,842 ft	3,000 m 9,842 ft	3,000 m 9,842 ft	3,000 m 9,842 ft	3,000 m 9,842 ft	3,000 m 9,842 ft	3,000 m 9,842 ft

Documentation

Download the Trellix Network Security Datasheet (.PDF)

Download the Trellix Network Security NX Series Specifications Datasheet (.PDF)