Network security
Huawei HiSecEngine AntiDDoS12000 Series DDoS Defense System
Huawei HiSecEngine AntiDDoS12000 series provides up to 2.4Tbps security protection performance and service expansion capabilities, ideal for mitigating heavy-traffic DDoS attacks. It can also effectively defend against and block hundreds of complex attacks in seconds or even milliseconds, ensuring customers' service continuity. View 3D Model
Superb performance
NP-boosted defense acceleration, ensuring up to 2.4Tbps defense for a single device.
Millisecond-level response
Millisecond-level response to attacks, causing no impact to services.
Precise protection
Intelligent mitigation
Specifications · AntiDDoS12004
| Max Defense Bandwidth | 400 Gbps |
|---|---|
| Max Defense Packet Rate | 300 Mpps |
| Expansion Slots | 4 |
| Expansion Interfaces | • 24-port 10GBase-SFP+ + 2-port 40G/100GBase-QSFP28 • 48-port 10GBase-SFP+ |
| Dimensions (H x W x D) | 438 mm × 442 mm × 874 mm (9.8U) |
Specifications · AntiDDoS12008
| Max Defense Bandwidth | 1.2 Tbps |
|---|---|
| Max Defense Packet Rate | 900 Mpps |
| Expansion Slots | 8 |
| Expansion Interfaces | • 24-port 10GBase-SFP+ + 2-port 40G/100GBase-QSFP28 • 48-port 10GBase-SFP+ • 4-port 400GBase-QSFP • 12-port 40G/100GBase-QSFP28 (Only four ports are provided by default. If needed, you can purchase 100G interface expansion RTUs for capacity expansion. Only a maximum of two ports can be added.) |
| Dimensions (H x W x D) | 703 mm x 442 mm × 874 mm (15.8U) |
Specifications · AntiDDoS12016
| Max Defense Bandwidth | 2.4 Tbps |
|---|---|
| Max Defense Packet Rate | 1800 Mpps |
| Expansion Slots | 16 |
| Expansion Interfaces | • 24-port 10GBase-SFP+ + 2-port 40G/100GBase-QSFP28 • 48-port 10GBase-SFP+ • 4-port 400GBase-QSFP • 12-port 40G/100GBase-QSFP28 (Only four ports are provided by default. If needed, you can purchase 100G interface expansion RTUs for capacity expansion. Only a maximum of two ports can be added.) |
| Dimensions (H x W x D) | 1436 mm x 442 mm x 1033 mm (32.3U) |
Specifications
| DDoS Defense Specifications | • Defense against malformed-packet attacks Defense against LAND, Fraggle, Smurf, WinNuke, Ping of Death, Teardrop, and TCP error flag attacks • Defense against scanning and sniffing attacks Defense against port scan and IP sweep attacks, and attacks using Tracert packets and IP options, such as IP source route, IP timestamp, and IP route record options • Defense against network-layer flood attacks Defense against common network-layer flood attacks, such as SYN flood, SYN-ACK flood, ACK flood, FIN flood, RST flood, TCP Fragment flood, TCP Malformed flood, UDP flood, UDP Malformed, UDP Fragment flood, IP flood, ICMP Fragment flood, ICMP flood, Other flood, carpet-bombing flood, and pulse-wave attacks • Defense against session-layer attacks Defense against common session-layer attacks, such as real-source SYN flood, real-source ACK flood, TCP connection exhaustion, sockstress, and TCP null connection attacks • Defense against UDP reflection attacks Static rules for filtering common UDP amplification attacks, such as NTP, DNS, SSDP, CLDAP, Memcached, Chargen, SNMP and WSD Dynamic generation of filtering rules to defend against new UDP amplification attacks • Defense against TCP reflection attacks Static filtering rules that are created based on network-layer characteristics TCP reflection attack filtering rules that are dynamically generated • Defense against TCP replay attacks Static filtering rules that are created based on network-layer characteristics TCP replay attack filtering rules that are dynamically generated • Defense against application-layer attacks (HTTP) Defense against high-frequency application-layer attacks (HTTP and HTTP CC attacks) based on behavior analysis Defense against low-frequency application-layer attacks (HTTP and HTTP CC attacks) based on machine learning Defense against slow-rate HTTP attacks based on behavior analysis, including HTTP slow header, HTTP slow post, RUDY, LOIC, HTTP multi-methods, HTTP Range request amplification, and HTTP null connection attacks • Defense against HTTPS/TLS encrypted application-layer attacks Defense against high-frequency HTTPS/TLS encrypted attacks Defense against slow-rate incomplete TLS session and null connection attacks • Defense against application-layer attacks (DNS) Defense against DNS Malformed, DNS query flood, NXDomain flood, DNS reply flood, and DNS cache poisoning attacks Source-based rate limiting and domain name–based rate limiting • Defense against application-layer attacks (SIP) Defense against SIP flood/SIP methods flood attacks, including Register, Deregistration, Authentication, and Call flood attacks Source-based rate limiting • User-defined filtering rules User-defined filtering rules for local software and hardware, as well as BGP FlowSpec rules for remote filtering. The fields can be customized, including source/destination IP address, packet length, IP protocol, IP payload, source/destination port, TCP flag bit, TCP payload, UDP payload, ICMP payload, DNS domain name, HTTP URI, HTTP field user-agent, as well as caller and callee in the SIP protocol. • Geographical location filtering The blocking policy can be customized. For countries outside china, blocking policies can be customized based on country. In China, blocking policies can be customized based on province. • Dual-stack defense IPv4/IPv6 dual-stack defense against DDoS attacks • Automatic tuning of defense policies Attack traffic snapshot, defense effect evaluation, and automatic tuning of defense policies Automatic attack evidence collection • Baseline learning Support for dynamic traffic baseline learning and learning period configuration • Packet capture-based evidence collection Automatic packet capture based on attack events and user-defined ACLs for packet capture Online parsing and analysis, source tracing, and local analysis after downloading for captured packets |
|---|---|
| Slots of Main Control Unit | 2 |
| Main Control Unit | Supports 1*100GE QSFP28/2*40GE QSFP+/4*25G SFP28/8*10G SFP+ ports |
| Expansion Interfaces | • 16*40GE/100GE QSFP28 + 24*10GE(SFP+) • 8*40GE/100GE QSFP28 + 24*10GE(SFP+) |
| Max Defense Bandwidth | 1.2 Tbps |
| Max Defense Packet Rate | 1200 Mpps |
| Expansion Slots | 6 |
| Dimensions (H x W x D) | 392.12mm×442mm×515.5mm (8.8U) |
Defense against LAND, Fraggle, Smurf, WinNuke, Ping of Death, Teardrop, and TCP error flag attacks
Defense against port scan and IP sweep attacks, and attacks using Tracert packets and IP options, such as IP source route, IP timestamp, and IP route record options
Defense against common network-layer flood attacks, such as SYN flood, SYN-ACK flood, ACK flood, FIN flood, RST flood, TCP Fragment flood, TCP Malformed flood, UDP flood, UDP Malformed, UDP Fragment flood, IP flood, ICMP Fragment flood, ICMP flood, Other flood, carpet-bombing flood, and pulse-wave attacks
Defense against common session-layer attacks, such as real-source SYN flood, real-source ACK flood, TCP connection exhaustion, sockstress, and TCP null connection attacks
Static rules for filtering common UDP amplification attacks, such as NTP, DNS, SSDP, CLDAP, Memcached, Chargen, SNMP and WSDDynamic generation of filtering rules to defend against new UDP amplification attacks
Static filtering rules that are created based on network-layer characteristicsTCP reflection attack filtering rules that are dynamically generated
Static filtering rules that are created based on network-layer characteristicsTCP replay attack filtering rules that are dynamically generated
Defense against high-frequency application-layer attacks (HTTP and HTTP CC attacks) based on behavior analysisDefense against low-frequency application-layer attacks (HTTP and HTTP CC attacks) based on machine learningDefense against slow-rate HTTP attacks based on behavior analysis, including HTTP slow header, HTTP slow post, RUDY, LOIC, HTTP multi-methods, HTTP Range request amplification, and HTTP null connection attacks
Defense against high-frequency HTTPS/TLS encrypted attacksDefense against slow-rate incomplete TLS session and null connection attacks
Defense against DNS Malformed, DNS query flood, NXDomain flood, DNS reply flood, and DNS cache poisoning attacksSource-based rate limiting and domain name–based rate limiting
Defense against SIP flood/SIP methods flood attacks, including Register, Deregistration, Authentication, and Call flood attacksSource-based rate limiting
User-defined filtering rules for local software and hardware, as well as BGP FlowSpec rules for remote filtering. The fields can be customized, including source/destination IP address, packet length, IP protocol, IP payload, source/destination port, TCP flag bit, TCP payload, UDP payload, ICMP payload, DNS domain name, HTTP URI, HTTP field user-agent, as well as caller and callee in the SIP protocol.
The blocking policy can be customized. For countries outside china, blocking policies can be customized based on country. In China, blocking policies can be customized based on province.
IPv4/IPv6 dual-stack defense against DDoS attacks
Attack traffic snapshot, defense effect evaluation, and automatic tuning of defense policiesAutomatic attack evidence collection
Support for dynamic traffic baseline learning and learning period configuration
Automatic packet capture based on attack events and user-defined ACLs for packet captureOnline parsing and analysis, source tracing, and local analysis after downloading for captured packets
Defense against LAND, Fraggle, Smurf, WinNuke, Ping of Death, Teardrop, and TCP error flag attacks
Defense against port scan and IP sweep attacks, and attacks using Tracert packets and IP options, such as IP source route, IP timestamp, and IP route record options
Defense against common network-layer flood attacks, such as SYN flood, SYN-ACK flood, ACK flood, FIN flood, RST flood, TCP Fragment flood, TCP Malformed flood, UDP flood, UDP Malformed, UDP Fragment flood, IP flood, ICMP Fragment flood, ICMP flood, Other flood, carpet-bombing flood, and pulse-wave attacks
Defense against common session-layer attacks, such as real-source SYN flood, real-source ACK flood, TCP connection exhaustion, sockstress, and TCP null connection attacks
Static rules for filtering common UDP amplification attacks, such as NTP, DNS, SSDP, CLDAP, Memcached, Chargen, SNMP and WSD Dynamic generation of filtering rules to defend against new UDP amplification attacks
Static filtering rules that are created based on network-layer characteristics TCP reflection attack filtering rules that are dynamically generated
Static filtering rules that are created based on network-layer characteristics TCP replay attack filtering rules that are dynamically generated
Defense against high-frequency application-layer attacks (HTTP and HTTP CC attacks) based on behavior analysis Defense against low-frequency application-layer attacks (HTTP and HTTP CC attacks) based on machine learning Defense against slow-rate HTTP attacks based on behavior analysis, including HTTP slow header, HTTP slow post, RUDY, LOIC, HTTP multi-methods, HTTP Range request amplification, and HTTP null connection attacks
Defense against high-frequency HTTPS/TLS encrypted attacks Defense against slow-rate incomplete TLS session and null connection attacks
Defense against DNS Malformed, DNS query flood, NXDomain flood, DNS reply flood, and DNS cache poisoning attacks Source-based rate limiting and domain name–based rate limiting
Defense against SIP flood/SIP methods flood attacks, including Register, Deregistration, Authentication, and Call flood attacks Source-based rate limiting
User-defined filtering rules for local software and hardware, as well as BGP FlowSpec rules for remote filtering. The fields can be customized, including source/destination IP address, packet length, IP protocol, IP payload, source/destination port, TCP flag bit, TCP payload, UDP payload, ICMP payload, DNS domain name, HTTP URI, HTTP field user-agent, as well as caller and callee in the SIP protocol.
IPv4/IPv6 dual-stack defense against DDoS attacks
Attack traffic snapshot, defense effect evaluation, and automatic tuning of defense policies Automatic attack evidence collection
Support for dynamic traffic baseline learning and learning period configuration
Automatic packet capture based on attack events and user-defined ACLs for packet capture Online parsing and analysis, source tracing, and local analysis after downloading for captured packets
Defense against LAND, Fraggle, Smurf, WinNuke, Ping of Death, Teardrop, and TCP error flag attacks
Defense against port scan and IP sweep attacks, and attacks using Tracert packets and IP options, such as IP source route, IP timestamp, and IP route record options
Defense against common network-layer flood attacks, such as SYN flood, SYN-ACK flood, ACK flood, FIN flood, RST flood, TCP Fragment flood, TCP Malformed flood, UDP flood, UDP Malformed, UDP Fragment flood, IP flood, ICMP Fragment flood, ICMP flood, Other flood, carpet-bombing flood, and pulse-wave attacks
Defense against common session-layer attacks, such as real-source SYN flood, real-source ACK flood, TCP connection exhaustion, sockstress, and TCP null connection attacks
Static rules for filtering common UDP amplification attacks, such as NTP, DNS, SSDP, CLDAP, Memcached, Chargen, SNMP and WSDDynamic generation of filtering rules to defend against new UDP amplification attacks
Static filtering rules that are created based on network-layer characteristicsTCP reflection attack filtering rules that are dynamically generated
Static filtering rules that are created based on network-layer characteristicsTCP replay attack filtering rules that are dynamically generated
Defense against high-frequency application-layer attacks (HTTP and HTTP CC attacks) based on behavior analysisDefense against low-frequency application-layer attacks (HTTP and HTTP CC attacks) based on machine learningDefense against slow-rate HTTP attacks based on behavior analysis, including HTTP slow header, HTTP slow post, RUDY, LOIC, HTTP multi-methods, HTTP Range request amplification, and HTTP null connection attacks
Defense against high-frequency HTTPS/TLS encrypted attacksDefense against slow-rate incomplete TLS session and null connection attacks
Defense against DNS Malformed, DNS query flood, NXDomain flood, DNS reply flood, and DNS cache poisoning attacksSource-based rate limiting and domain name–based rate limiting
Defense against SIP flood/SIP methods flood attacks, including Register, Deregistration, Authentication, and Call flood attacksSource-based rate limiting
User-defined filtering rules for local software and hardware, as well as BGP FlowSpec rules for remote filtering. The fields can be customized, including source/destination IP address, packet length, IP protocol, IP payload, source/destination port, TCP flag bit, TCP payload, UDP payload, ICMP payload, DNS domain name, HTTP URI, HTTP field user-agent, as well as caller and callee in the SIP protocol.
The blocking policy can be customized. For countries outside china, blocking policies can be customized based on country. In China, blocking policies can be customized based on province.
IPv4/IPv6 dual-stack defense against DDoS attacks
Attack traffic snapshot, defense effect evaluation, and automatic tuning of defense policiesAutomatic attack evidence collection
Support for dynamic traffic baseline learning and learning period configuration
Automatic packet capture based on attack events and user-defined ACLs for packet captureOnline parsing and analysis, source tracing, and local analysis after downloading for captured packets
Specifications · AntiDDoS12004-F
| Max Defense Bandwidth | 300 Gbps |
|---|---|
| Max Defense Packet Rate | 200 Mpps |
| Expansion Slots | 4 |
| Dimensions (H x W x D) | 352.8mm x 442mm x 515.5mm (8U) |
Specifications · AntiDDoS12008-F
| Max Defense Bandwidth | 600 Gbps |
|---|---|
| Max Defense Packet Rate | 400 Mpps |
| Expansion Slots | 8 |
| Dimensions (H x W x D) | 575mm x 442mm x 515.5mm (13U) |
In the same family
HiSecEngine USG12000 Series AI Firewalls
HiSecEngine USG6800G Series AI Firewalls
HiSecEngine USG6700F Series AI Firewalls
HiSecEngine USG6600F Series AI Firewalls
HiSecEngine USG6500F Series AI Firewalls
HiSecEngine USG6700E Series AI Firewalls
HiSecEngine USG6600E Series AI Firewalls
HiSecEngine USG6500E Series AI Firewalls