网络安全

下一代防火墙 (NGFW)

可识别应用和用户的防火墙，具备 IPS、网页过滤、HTTPS 检测和 VPN，按全功能开启的实际性能选型。

现场常见问题

A basic router or old firewall only sees IPs and ports. It misses web-borne malware and anything hiding inside HTTPS. When something does happen, there are no logs to show how it got in.

An NGFW stacks several layers of protection in one box: stateful firewalling, application control, IPS, anti-malware/sandboxing, web/DNS filtering, SSL/TLS inspection and VPN (IPsec, SSL or ZTNA). Rules can be written per user and group (via Active Directory/Entra ID), not just per IP. "Finance can't use Facebook during work hours" becomes one rule.

Sizing it properly

Datasheets put "firewall throughput" in big type. Ignore it. The numbers that matter are threat protection throughput (IPS + anti-malware + app control on) and SSL inspection throughput, which are often several times lower. We size to your internet bandwidth, headcount and 3–5 years of growth.

A warning when buying through Thailand: confirm the security licence can be registered and the warranty honoured for use in Laos. A cheap box you can't renew is the most expensive one you can buy.

Can't stop? Buy two

Banks, hospitals and anyone who can't go offline should run an active-passive HA pair with two ISPs. All logs go to a reporting platform or SIEM, so you can investigate when something happens and spot trends before they turn into incidents.

功能

Application control

Identifies and controls thousands of apps, whatever port they use.

IPS and anti-malware

Stops exploits and malicious files, with sandboxing.

Web and DNS filtering

Blocks phishing, gambling and malicious domains.

SSL/TLS inspection

Looks inside HTTPS, with exemptions for banking and health sites.

VPN and ZTNA

IPsec between sites, MFA for remote users.

High availability

Active-passive pair that fails over on its own.

Logs and reports

For incident investigation and management reporting.

设计与实施

1
Review network, bandwidth and existing rules
2
Size on threat-protection throughput and design zones
3
Migrate and clean up old rules; connect AD/Entra ID
4
Turn on security profiles in stages: monitor first, then block
5
Set up HA, VPN and log forwarding
6
Review rules and update firmware regularly

适用场景

Banks and insurers separating core systems and keeping logs
Government agencies running online public services
Factories keeping OT networks away from the internet
Schools filtering content for students

常见系统规模

Small Business

适用于: Up to 50 users, up to 300 Mbps internet

Desktop NGFW with security subscription
Web filtering, IPS and remote-access VPN
Monthly report

获取报价

Mid-size

适用于: 50–500 users, several sites

HA NGFW pair at head office
SSL inspection and identity-based rules
Branch VPN and central logging

获取报价

Enterprise / Data Center

适用于: 500+ users or a data center

Edge plus internal segmentation firewalls
Central management and SIEM integration
Quarterly rule-base review

获取报价

我们供货并安装的品牌

Fortinet Palo Alto Networks Check Point Sophos Cisco WatchGuard SonicWall Huawei Cisco Meraki Juniper Networks H3C Zyxel Networks

所有品牌名称和商标归其各自所有者所有。除非另有明确说明，提及某品牌并不代表与其存在合作关系。产品均通过正规分销渠道采购。

常见问题

What's the difference between UTM and NGFW?

Today the two terms mostly overlap and depend on each vendor's marketing. Ask three questions instead: does it know applications, does it know users, and is it still fast enough with everything turned on?

Does the licence need renewing every year?

Yes. Without the security subscription the IPS, anti-malware and web-filter databases stop updating. The box keeps running but protects very little. We remind you 60 days before expiry.

Does SSL inspection slow the internet?

It uses a lot of firewall CPU, so size for it from the start. Sized correctly, users won't notice. Undersized, they'll notice on day one.

Is a firewall on its own enough?

No. It's the front door. You still need EDR on devices, MFA, backups in more than one location, an incident response plan and staff training. Firewall logs help a lot when investigating.