UserGate

UserGate Details FPGA Acceleration to Turbocharge Next-Generation Firewalls

UserGate product manager Pavel Molodan explains why adding security features like IDS/IPS, SSL/TLS inspection, and application control turns a high-performance NGFW into a bottleneck. The company outlines four groups of acceleration methods, with a focus on FPGA-based hardware offloading for packet parsing, firewall rules, NAT, and encryption tasks. Research from 254 respondents shows strong demand for these functions in data center B2E segments at 50-200 Gbit/s. Experimental platforms including Katun-2 PCIe cards and the FG system demonstrate concrete gains, such as scaling IDPS from 5 to 90 Gbit/s and achieving 85 Gbit/s firewall throughput on EMIX profiles. FPGA delivers microsecond latency and better energy efficiency compared with CPU-only designs while preserving full NGFW functionality for elephant flows.

Digital Twins Enable Pre-Deployment Testing and Post-Change Control in Complex Multi-Vendor Networks

UserGate and Hadal Project experts presented a joint approach at Saint HighLoad++ that combines physical labs, emulation, and simulation into a single lifecycle for validating network changes. The method addresses recurring failures such as IPsec tunnel outages after routine software updates that pass vendor checks yet break branch connectivity. Three complexity sources—multi-vendor environments, historical configuration debt, and continuous dynamic updates—are mitigated by maintaining an always-current network model. Physical laboratories provide hardware-level accuracy for critical devices, while uInfraTwin emulation allows rapid, repeatable testing of configuration scenarios with traffic generators. Simulation tools including Batfish, Hadal, Forward Networks, and IP Fabric deliver end-to-end reachability analysis across tens of thousands of nodes without sending test traffic on production networks. The integrated digital twin continuously updates from live infrastructure, feeds selected segments into safe test environments, and verifies policy compliance after deployment.

UserGate Launches Rugged Industrial NGFW uNGFW on X10 Platform Rated for -40 to +60 °C

UserGate has introduced the uNGFW next-generation firewall running on the new X10 hardware platform designed specifically for protecting industrial control systems and OT environments. The appliance replaces the discontinued X1 model and is engineered to operate reliably in harsh conditions ranging from −40 to +60 °C with up to 80 % humidity, allowing direct DIN-rail installation inside automation cabinets at substations, extraction sites, and fuel stations. It provides deep inspection for 35 industrial protocols including Modbus, OPC UA, Profinet IO and S7Comm, with intrusion-prevention rules capable of validating individual commands on six critical protocols to block unauthorized actions without requiring equipment shutdowns. Hardware redundancy features two independent power inputs and a bypass function that maintains network connectivity during device failure, while maximum power draw remains at 24 W. Throughput reaches 1780 Mbit/s with support for up to 500 000 concurrent connections, and centralized management via UserGate’s existing console enables unified policies across distributed sites. The platform was developed by UserGate’s own design bureau and is manufactured in Saint Petersburg; it is already available for ordering and testing through company partners.

Read-Only Utility Automates Detailed Audits of UserGate NGFW Firewall Policies

A cybersecurity specialist at Gazprom CPS developed a read-only utility to analyze large-scale UserGate NGFW firewall policies without making any configuration changes. The tool connects via the UserGate XML-RPC API to collect rules, statistics, zones, network lists, services, users, and groups, then normalizes the data into a unified model for analysis. It performs eleven independent checks grouped into lifecycle, overly permissive access, observability, and documentation categories, flagging rules that have not fired recently, allow management ports broadly, lack logging, or have empty descriptions. Results are exported to a navigable Excel report featuring a rules-by-checks matrix, human-readable object names, and editable manual verdicts such as OK, requires attention, or false positive. The first full run on a production policy with over 1000 rules and 4500 related objects took 24 minutes and highlighted 39 percent of rules for review, with more than half showing multiple red flags. The approach preserves the original snapshot in JSON for repeatable offline analysis and comparison over time.