Default-Deny Rules
A rule set that reflects what each zone needs, not a broad allow that grew over time.
Next-generation firewallNetwork segmentation
Protect Offices and Data Centers With Next-Generation Firewall
Customer problem
Port Rules Don't Match Today's Traffic
Many firewalls are still built around ports and IP addresses. Today, much traffic runs over a few common ports, much of it is encrypted, and users and applications move around.
Rules allow more than they should because tightening them breaks something, and a flat internal network lets one compromised device reach many others.
Offices and data centres need control inside the boundary as well as at it.
- Rules that allow far more than they should
- Little insight into which applications are in use
- Encrypted traffic passing through uninspected
- Flat internal networks open to lateral spread
- Separate consoles and policy sets per product
- Devices that cannot protect themselves
THE COSGRID SOLUTION
Control the Edge and the Inside
NexusShield combines firewalling, intrusion prevention, application control, web filtering, SSL/TLS inspection and segmentation in one product. It shares policy objects with other COSGrid products, so users, groups and applications defined once are reused across your estate.
With NexusShield, organisations can
- Control traffic between zones with default-deny rules
- Block known attack patterns in allowed traffic with IPS
- See and control the applications crossing the firewall
- Inspect encrypted traffic where policy allows
- Segment servers and devices that cannot run an agent
How It Works
Define Zones and Rules
Treat each zone, such as users, servers, guests or management, according to its own risk, with default deny so only explicitly allowed traffic is permitted.
Inspect Allowed Traffic
IDS/IPS checks allowed traffic for known attack patterns, and application control identifies what is actually running.
Apply Web and Encryption Policy
Web filtering applies category and list-based policy, and SSL/TLS inspection decrypts, inspects and re-encrypts traffic where your policy allows.
Reuse Policy Across Products
Users, groups, applications and address sets are authored once in the COSGrid console and reused across firewalls and products.
Key Benefits
Less Exposure to Known Exploits
IPS can detect or block known attack patterns in allowed traffic. It is one layer, not a complete defence.
Application Control
See which applications are in use at each site, and block risky ones such as peer-to-peer file sharing.
Zone Segmentation
Enforce policy between internal zones, which limits lateral spread, including from devices without an agent.
Shared Policy Objects
Define objects once and reuse them across COSGrid products, with less duplication and drift.
Flexible Deployment
Appliance, virtual appliance, cloud or firewall-as-a-service, and self-hostable.
Traditional Firewall vs NGFW with NexusShield
Traditional Firewall
- Rules based on ports and IP addresses
- No view of which applications are in use
- Allowed traffic passes uninspected
- Encrypted traffic passes uninspected
- Mostly placed at the perimeter
- Policy objects rebuilt in each product
- One deployment form
NGFW with NexusShield
- Rules can also refer to applications, users and groups
- Application visibility and control
- IDS/IPS inspects allowed traffic for known attacks
- SSL/TLS inspection where policy allows
- Also enforces segmentation between internal zones
- Policy objects shared across COSGrid products
- Appliance, virtual, cloud or firewall-as-a-service
Use cases
Built for every network scenario
One place to protect the internet edge
NexusShield protects the head office internet edge with firewalling, IPS, application control and web filtering in one place.
Separate server tiers by the traffic they need
Server zones, such as web, application and database tiers, are separated so that each tier only accepts the traffic it needs.
Place agentless devices in their own zones
Cameras, printers, building controllers and legacy servers sit in their own zones. Only defined traffic reaches them, and only defined traffic leaves.
Block risky applications at every office
Peer-to-peer file sharing and unapproved remote-access tools are blocked at each office, using the same application policy objects across sites.
Who Is This For
Want to keep the firewall in your own environment? See "Keep security infrastructure and data in-country, under your control"
- Network Security Teams
- CISOs
- Data Centre Heads
- Multi-Office IT Teams
- Self-Hosting Organisations
FAQs
Have a question about NexusShield and next-generation firewalls?
What is a next-generation firewall?
A next-generation firewall adds application awareness, intrusion prevention, web filtering and encrypted-traffic inspection to traditional port-and-address firewalling.
Where can NexusShield be deployed? NexusShield is designed for deployment as a hardware appliance, a virtual appliance, in a public cloud or as firewall-as-a-service. It can be self-hosted.
What does "shared policy engine" mean? Policy objects, such as users, groups, applications and address sets, are created once and reused across COSGrid products. A change to a group applies wherever that group is used, rather than being repeated in each product.
