QUANTUM 28000 SECURITY GATEWAY

Check Point Quantum 28000 Next Generation Firewalls enables enterprises to deploy the industry’s leading
threat prevention capabilities at all points of their infrastructure, scaling security according to their changing
business needs. This enables enterprises to prevent and block even the most advanced attacks, before they
can disrupt business — greatly increasing the efficiency of their security operations.

Always Protectedagainst Gen V Attacks

Security atHyperscale

EfficientOperations

Highest caliber prevention
with unified security

On-demand expansion
with hyperscalabilityCut operation management
time by up to 80%

PERFORMANCE HIGHLIGHTSGen II Security
FirewallGen III Security

Gen V Security

NGFW 1

Advanced Threat Prevention 2145 Gbps

51.5 Gbps

30 Gbps

Performance measured with enterprise testing conditions. Additional performance details on page 3. 1: Includes Firewall, Application Control,and IPS. 2: Includes Firewall, Application Control, URL Filtering, IPS, Antivirus, Anti-Bot and SandBlast Zero-Day Protection.

© 2023 Check Point Software Technologies Ltd. All rights reserved. | July 7, 2023

1

SPOTLIGHT
28000 SECURITY GATEWAY143256781.
2.
3.
4.
5.

RJ45 and USB Type-C console ports
Lights-out Management port
Sync 10/100/1000 Base-T port
ESD ground point
2x 480GB SSD RAID1

6.
7.
8.

2x USB 3.0 ports
Management 10/100/1000 Base-T port
Eight network card expansion slots
3x redundant power supplies (back view not shown)
4x field replaceable fans (back view not shown)

Prevent Known and Zero-day Threats
Check Point SandBlast Threat
Emulation is an evasion-resistantsandbox that provides zero-day
protection from advanced and unknownthreats. SandBlast Threat Extraction(CDR) ensures quick delivery of safe
email and web content to users.

IoT Security
Quantum IoT Protect now provides
autonomous threat prevention.
Quantum Firewalls discover IoT assets,
feed those to the IoT Cloud Service toautomatically map IoT devices toprofiles and then apply a zero-trust
policy on the firewalls to prevent IoT
threats in 5 minutes.
Next Generation Firewall, Next Generation Threat Prevention andSandBlast packages

100, 40 and 25 GbE Connectivity
If you’re ready to move from 10 to 25, 40or 100 GbE, so is the 28000 Next
Generation Security Gateway. The 28000Security Gateway lets you connect your
10 GbE server uplinks to your corenetwork.

Integrated SD-WAN
Security protects you when you’reconnected. SD-WAN ensures you’re always
connected, and the connection offers thebest user experience for the lowest cost.
Quantum SD-WAN in Quantum firewalls
keeps you secure and connected.

Remote Management and Monitoring
A Lights-Out-Management (LOM) card
provides out-of-band management toremotely diagnose, start, restart, andmanage the appliance from a remotelocation.

DATA CENTER GRADE PLATFORM
1 GbEcopper

1 GbE
fiber

10GbE

100/40/25*
GbEMemory

Base model

204064 GB

Plus model

10012296 GB

Max capacity

6632328128 GB

RedundantPowerRedundantStorage

LOM

optional accessory© 2023 Check Point Software Technologies Ltd. All rights reserved. | July 7, 2023

2

SPECIFICATIONS
PerformanceContent Security (continued)

Enterprise Test Conditions

Dynamic User-based Policy

Threat Prevention (Gbps)

30

NGFW (Gbps)

51.5

IPS (Gbps)

52.2

Firewall (Gbps)

14512• Integrates with Microsoft AD, LDAP, RADIUS, Cisco pxGrid,Terminal Servers and with 3 parties via a Web APIrd• Enforce consistent policy for local and remote users on Windows,macOS, Linux, Android and Apple iOS platforms

RFC 3511, 2544, 2647, 1242 Performance (Lab)Firewall 1518B UDP (Gbps)

316.5

VPN AES-128 (Gbps)

49

Network
Network Connectivity• Integrated SD-WAN network optimization and resilience

615,000

Connections/sec

10/20/32M

Concurrent connections

33• Total physical and virtual (VLAN) interfaces per appliance:
1024/4096 (single gateway/with virtual systems)

1. Includes Firewall, Application Control, URL Filtering, IPS, Antivirus, Anti-Bot and SandBlast Zero-Day Protection• 802.3ad passive and active link aggregation

with logging enabled. 2. Includes Firewall, Application Control and IPS with logging enabled. 3. Performance• Layer 2 (transparent) and Layer 3 (routing) modemeasured with Base/Plus/maximum memory.

High Availability

Additional Features• Active/Active L2, Active/Passive L2 and L3• Session failover for routing change, device and link failureHighlights• 2x CPUs, 36 physical cores, 72 virtual cores (total)• 1x 480GB SSD, (2x in Plus package)• ClusterXL or VRRP

IPv6

• 3x AC power supplies (DC option)• NAT66, NAT64, NAT46• 64, 96 and 128 GB memory options• CoreXL, SecureXL, HA with VRRPv3• Lights-Out-Management card (optional in Base package)

Unicast and Multicast Routing (see SK98226)• Virtual Systems (base/PLUS/max mem): 125/250/250• OSPFv2 and v3, BGP, RIP

Network Expansion Slot Options (7 of 8 slots open)• Static routes, Multicast routes• 8x 10/100/1000Base-T RJ45 port card, up to 66 ports• Policy-based routing• 4x 1000Base-F SFP port card, up to 32 ports• PIM-SM, PIM-SSM, PIM-DM, IGMP v2, and v3• 4x 10GBase-F SFP+ port card, up to 32 ports• 2x 100/40/25G QSFP28 port double-slot-width card, up to 8 ports

PhysicalPower Requirements

Content Security
First Time Prevention Capabilities• Single Power Supply rating AC: 850W, DC: 1300W• Power input: 100 to 240V (47-63Hz), 40~-72VDC• CPU-level, OS-level and static file analysis• Power consumption avg/max: 472/826W• File disarm and reconstruction via Threat Extraction• Maximum thermal output AC: 2818.4 BTU/hr.

• Average emulation time for unknown files that require fullsandbox evaluation is under 100 seconds

Dimensions• Maximal file size for Emulation is 100 MB• Emulation OS Support: Windows XP, 7, 8.1, 10Applications• Use 10,000+ pre-defined or customize your own applications• Enclosure: 3RU• Dimensions (WxDxH): 17.4 x 24 x 5.2 in. (442 x 610 x 132mm)• Weight: 46.3 lbs. (21 kg)

Environmental Conditions• Accept, prevent, schedule, and apply traffic-shaping• Operating: 0° to 40°C, humidity 5% to 95%

Data Loss Prevention• Storage: –20° to 70°C, humidity 5% to 95% at 60°C• Classify 700+ pre-defined data types• End user and data owner incident handlingCertifications• Safety: UL, CB, CE, TUV GS• Emissions: FCC, CE, VCCI, RCM/C-Tick• Environmental: RoHS, WEEE, REACH , ISO14001
1© 2023 Check Point Software Technologies Ltd. All rights reserved. | July 7, 2023

13

ORDERING QUANTUM 28000 SECURITY GATEWAYSSECURITY APPLIANCE 1SKU

28000 Base configuration: 2x 1GbE copper ports, 4x 10GbE SFP+ ports, 4x SR transceivers, 64 GB RAM, 1x SSD, 3xAC PSUs, telescopic rails, SandBlast (SNBT) Security Subscription Package for 1 Year

CPAP-SG28000-SNBT

28000 Plus configuration: 10x 1GbE copper ports, 12x 10GbE SFP+ ports, 12x SR transceivers, 2x 100GbE QSFP28ports, 2x 40G SR transceivers, 96 GB RAM, 2x 480GB SSD, 3x AC PSUs, Lights-Out Management (LOM), telescopic
rails, 5 Virtual Systems, SandBlast (SNBT) Security Subscription Package for 1 Year

CPAP-SG28000-PLUS-SNBT

Quantum IoT Network Protection for 1 year for 28000 appliances

CPSB-IOTP-28000-1Y

Quantum IoT Network Protection for 1 year for 28000 PLUS appliances

CPSB-IOTP-28000-PLUS-1Y

Quantum SD-WAN subscription for 1 year for 28000 appliances

CPSB-SDWAN-28000-1Y

Quantum SD-WAN subscription for 1 year for 28000 PLUS appliances

CPSB-SDWAN-28000-PLUS-1Y

The Base package includes 2 trial virtual systems (VS). These are not additive or counted when adding additional VS licenses. Plus includes 5 VS licenses which areadditive when adding additional VS licenses. 1 Renewal NGFW, NGTP and SandBlast (SNBT) packages are available in the online product catalog.

Accessories
INTERFACE CARDS AND TRANSCEIVERS
8 Port 10/100/1000 Base-T RJ45 interface card

CPAC-8-1C-C

4 Port 1000Base-F SFP interface card; requires additional 1000Base SFP transceivers

CPAC-4-1F-C

SFP transceiver module for 1G fiber ports - long range (1000Base-LX)

CPAC-TR-1LX-C

SFP transceiver module for 1G fiber ports - short range (1000Base-SX)

CPAC-TR-1SX-C

SFP transceiver to 1000 Base-T RJ45 (Copper)

CPAC-TR-1T-C

4 Port 10GBase-F SFP+ interface card

CPAC-4-10F-C

SFP+ transceiver module for 10G fiber ports - for links up to 40km (10GBASE-ER)

CPAC-TR-10ER-C

SFP+ transceiver module for 10G fiber ports - long range up to 10km (10GBase-LR)

CPAC-TR-10LR-C

SFP+ transceiver module for 10G fiber ports - short range (10GBase-SR)

CPAC-TR-10SR-C

SFP+ transceiver 10GBASE-T RJ45 (Copper) - for links up to 30m over CAT6a/CAT7

CPAC-TR-10T-C

10G Direct Attach Copper (DAC) Cable, (10BASE-CU) 3 meters

CPAC-DAC-10G-3M

2 Port 10/25/40/100G QSFP28 Dual Width interface card *CPAC-2-40/100F-CQSFP28 transceiver module for 100G fiber ports - short range (100GBase-SR4)

CPAC-TR-100SRQSFP28 transceiver module for 100G fiber ports - long range (100GBase-LR4)

CPAC-TR-100LR

100G SWDM4, LC connector, 75m/OM3 fiber

CPAC-TR-100SWDM4100G CWDM4, LC connector, 2Km/ single mode fiber

CPAC-TR-100CWDM4QSFP+ transceiver module for 40G fiber ports - short range (40GBase-SR)

CPAC-TR-40SR-QSFP-300m

QSFP+ transceiver module for 40G fiber ports - long range (40GBase-LR)

CPAC-TR-40LR-QSFP-10Km

Bi-directional QSFP transceiver for 40G fiber ports - short range (40GBase-SR-BD)

CPAC-TR-40SR-QSFP-BIDI

QSFP28 to SFP28 Adapter - 10G/25G fiber adaptor

CPAC-TR-QSFP28-SFP28

SFP28 transceiver module for 25G fiber ports with QSFP28 adaptor - short range (25GBase-SR)

CPAC-TR-25SR-ADP

SFP28 transceiver module for 25G fiber ports with QSFP28 adaptor - long range (25GBase-LR)

CPAC-TR-25LR-ADP

SFP+ transceiver module for 10G fiber with QSFP28 adaptor - for links up to 40km (10GBASE-ER)

CPAC-TR-10ER-ADP

SFP+ transceiver module for 10G fiber with QSFP28 adaptor - long range up to 10km (10GBase-LR)

CPAC-TR-10LR-ADP

SFP+ transceiver module for 10G fiber with QSFP28 adaptor - short range (10GBase-SR)

CPAC-TR-10SR-ADP

SFP+ transceiver 10GBASE-T RJ45 (Copper) with QSFP28 adaptor - for links up to 30m over CAT6a/CAT7

CPAC-TR-10T-ADP

100G Direct Attach Copper cable (QSFP28), 3 meters

CPAC-DAC-100G-3M

40G Direct Attach Copper cable (QSFP28), 3 meters

CPAC-DAC-40G-3M

25G Direct Attach Copper cable (QSFP28), 3 meters

CPAC-DAC-25G-3M

10G Direct Attach Copper cable, (10BASE-CU) 3 meters

CPAC-DAC-10G-3M* CPAC-2-40/100F-C 25G transceivers will be supported in a future Jumbo Hot Fix© 2023 Check Point Software Technologies Ltd. All rights reserved. | July 7, 2023

4ORDERING QUANTUM 28000 SECURITY GATEWAYS (continued)
FAIL-OPEN NETWORK INTERFACE CARDS
4 Port 1GE copper Bypass (Fail-Open) Network interface card (10/100/1000 Base-T)

CPAC-4-1C-BP-C

2 Port 10GE Short-range Fiber Bypass (Fail-Open) Network interface card (10GBase-SR)

CPAC-2-10FSR-BP-C

MEMORY

SKU

Memory upgrade kit from 64GB to 96G or 96GB to 128GB for 28000 Security Gateways

CPAC-RAM32GB-28000

Memory upgrade kit from 64GB to 128GB for 28000 Security Gateways

CPAC-RAM64GB-28000

SPARES AND MISCELLANEOUS

SKU

480GB SSD for 16000/28000 Security Gateways

CPAC-SSD-480G-C

AC power supply for 16600HS, 26000, 28000, 28600HS Security Gateways

CPAC-PSU-AC-26000/28000

Dual DC power supplies for 16000, 26000 and 28000 Security Gateways

CPAC-PSU-DC-Dual-16000/26000/28000

DC power supply for 16000 and 28000 Security Gateways

CPAC-PSU-DC-16000/28000

Replacement Lights-Out Management Module

CPAC-NLOM-C

Replacement Fan

CPAC-FAN-26000/28000

Slide rails for 28000 Security Gateways (22” - 32”)

CPAC-RAIL-L

Telescopic slide rails for 28000 Security Gateways (24” - 36”)

CPAC-RAIL-EXT-L

All-inclusive Security

SNBT(SandBlast)
Prevent known and zeroday attacks

NGFW

NGTP

Basic access control
plus IPS

Prevent known threats








IoT Network Protection

optional

optional

optional

SD-WAN Network Optimization

optional

optional

optional

Firewall
VPN (IPsec)
Mobile Access
Identity AwarenessApplication Control
Content AwarenessIPS
URL Filtering
Anti-Bot
Anti-Virus
Anti-SpamDNS Security
SandBlast Threat Emulation
SandBlast Threat Extraction
Zero Phishing

The first-year purchase includes the SNBT package. Security subscription renewals, NGFW, NGTP and SNBT are available for subsequent years. Optional security
capabilities can be ordered a-la-carte or separately.

CONTACT US

North America - +1-866-488-6691 | International - +44-125-333-5558 | www.checkpoint.com© 2023 Check Point Software Technologies Ltd. All rights reserved. | July 7, 2023

5