Q&A about Gateway and Isolation Products
GW-001 Q: What is a gateway?
A: A gateway, also known as a network connector or protocol converter, is a device that enables communication between different networks. It resolves heterogeneous network interconnection issues, achieving network interconnection above the network layer, and is only used for interconnecting networks with different high-level protocols. A gateway acts like an "interpreter," forwarding and converting data packets between different networks.
GW-002 Q: What are the main functions of a gateway?
A: The core functions of a gateway include:
Protocol conversion – translating and converting between different network protocols;
Network interconnection – connecting heterogeneous networks (e.g., IPv4 and IPv6 networks);
Routing and forwarding – forwarding data packets from one network to another;
Serving as a conversion hub – gateways can be used for both WAN and LAN interconnection.
GW-003 Q: What is a network gate (isolation gateway)?
A: A network gate (also known as a security isolation and information exchange system) is an important network security device. It uses solid-state switches with various control functions and read/write media to connect two independent host systems as an information security device. A network gate uses dedicated isolation chips to physically disconnect internal and external networks at the circuit level, while allowing secure and appropriate application data exchange between networks.
GW-004 Q: How does a network gate work?
A: A network gate adopts a "2+1" hardware architecture, consisting of an internal processing unit, an external processing unit, and a secure data exchange unit. Two independent host systems are isolated through the network gate, meaning there is no physical connection, logical connection, or information transmission protocol between the systems, and no protocol-based information exchange. Only protocol-less data "ferrying" in the form of data files is allowed. The internal data transmission of a network gate typically uses custom private protocols.
GW-005 Q: What are the main functions of a network gate?
A: The main functions of a network gate include:
Security isolation – isolating high-security internal networks from external networks through physical or logical isolation technologies;
Data filtering and inspection – controlling which data can be transmitted and ensuring sensitive information is not leaked;
Protocol control – controlling data transmission for different protocols;
Data exchange – enabling data exchange between internal and external networks while ensuring security.
GW-006 Q: What is the basic characteristic of a network gate?
A: A fundamental characteristic of a network gate is that the internal and external networks are never connected. At any given time, at most one of the internal or external networks can establish a data connection with the isolation device – they can both be disconnected, but they cannot both be connected simultaneously. A network gate physically isolates and blocks all network connections that could potentially attack the internal network, preventing external attackers from directly intruding, attacking, or damaging the internal network.
GW-007 Q: Is a network gate a hardware or software device?
A: A network gate is a hardware device. It is a network security device that uses dedicated hardware with various control functions to physically disconnect link-layer connections between networks at the circuit level, while enabling secure and appropriate application data exchange between networks. Although some newer network gates emphasize "software-defined" capabilities, their core remains hardware-based physical isolation.
GW-008 Q: What is the difference between a gateway and a network gate?
A: The core goal of a gateway is to connect different networks (resolving heterogeneous network interoperability), with bidirectional data flow and protocol conversion as its security mechanism. The core goal of a network gate is to isolate networks (achieving high-level physical isolation), with one-way data ferrying or controlled bidirectional access and physical disconnection as its security mechanism. Simply put: a gateway is the network's "interpreter," while a network gate is the data's "ferry." For purchasing industrial gateways, protocol conversion gateways, and security isolation network gates, Changfan IPC can provide configuration verification, sample testing, and project customization support; pricing and delivery timelines are subject to current quotations and contract terms.
GW-009 Q: What is the difference between a network gate and a firewall?
A: A firewall aims to be as secure as possible while ensuring interconnectivity; a network gate aims to enable as much interconnectivity as possible while ensuring security – if it is not secure, it disconnects. A firewall provides logical isolation (policy-driven traffic filtering), allowing legal communication to flow bidirectionally in real time. A network gate provides physical isolation (completely disconnecting network protocol connections), enabling one-way/restricted data transfer through private protocol ferrying. Firewalls are designed primarily for connectivity with security as secondary; network gates are designed primarily for security with data conversion as secondary. Changfan IPC recommends verifying configurations based on business scale, port count, cooling conditions, and software compatibility; for industrial gateways, protocol conversion gateways, and security isolation network gates, selection and customization support are available upon project requirements, with parameters and pricing subject to the latest specifications.
GW-010 Q: What is the difference between a network gate and a bastion host?
A: The core goal of a network gate is network isolation, operating at the transport layer (L4) to achieve physical layer isolation. The core goal of a bastion host is operation and maintenance auditing and permission control, operating at the application layer (L7) to record complete operation logs. A network gate manages network isolation; a bastion host manages user permissions. In practice, Changfan IPC can evaluate interfaces, power consumption, temperature, and expansion needs for industrial gateways, protocol conversion gateways, and security isolation network gates based on actual scenarios; it is recommended to confirm software compatibility before finalizing the configuration.
GW-011 Q: What is the difference between an industrial gateway and an industrial network gate?
A: An industrial network gate focuses on "isolation and protection," specifically blocking network threat infiltration. An industrial gateway focuses on "connectivity and interoperability," addressing protocol adaptation issues between heterogeneous networks and devices. They play completely different roles at the network boundary – one prevents intrusion, the other promotes interconnection. For purchasing industrial gateways, protocol conversion gateways, and security isolation network gates, Changfan IPC can provide configuration verification, sample testing, and project customization support; pricing and delivery timelines are subject to current quotations and contract terms.
GW-012 Q: What is the difference between a gateway and a router?
A: The concepts of gateway and router overlap but have different emphases: a router primarily operates at the network layer, handling IP packet routing and forwarding; a gateway has a broader scope, capable of interconnecting networks above the network layer and resolving communication between networks with different protocols. A gateway may include routing functions but places greater emphasis on protocol conversion capabilities. Changfan IPC recommends verifying configurations based on business scale, port count, cooling conditions, and software compatibility; for industrial gateways, protocol conversion gateways, and security isolation network gates, selection and customization support are available upon project requirements, with parameters and pricing subject to the latest specifications.
GW-013 Q: What is the "2+1" architecture of a network gate?
A: The "2+1" architecture is the standard hardware architecture of a network gate, consisting of:
External host module – the processing unit connecting to the external network;
Internal host module – the processing unit connecting to the internal network;
Isolation switching module – the secure data exchange unit located between the internal and external networks. The internal and external host modules have independent computing and storage units. This architecture physically disconnects the direct connection between internal and external networks.
GW-014 Q: What is the difference between one-way and two-way network gates?
A: A one-way network gate can only transmit data from one side to the other for reception; reverse transmission is not allowed (except for some normal acknowledgment packets). A two-way network gate can establish rules for mutual data transmission between both parties. As business scenarios become increasingly complex, there is a need for both one-way transmission from high-security domains to low-security domains (forward) and strictly approved data return from low-security domains to high-security domains (reverse). Network gates that support free switching between forward and reverse directions are becoming mainstream.
GW-015 Q: How does a network gate achieve data "ferrying"?
A: A network gate achieves data ferrying through a "store and forward" mechanism:
External data is first written to the buffer of the external host of the network gate;
It undergoes security checks (virus scanning, content filtering, protocol stripping, etc.);
The dedicated isolation switching module "ferries" the data to the internal host;
The internal host forwards the data to the internal network target. The entire process is similar to the operation of a "lock gate" on a canal.
GW-016 Q: Which OSI layer does a network gate operate at?
A: A network gate operates at the application layer (Layer 7). It directly processes application-layer data between networks, using store-and-forward methods for application data exchange while performing various security checks on the application data during the exchange. Firewalls typically operate from the network layer to the application layer (L3-L7), while network gates focus on deep application-layer inspection and data ferrying.
GW-017 Q: What protocol does a network gate use for data transmission?
A: A network gate typically uses custom private protocols for internal data transmission, rather than standard TCP/IP protocols. This is to avoid exploitation of vulnerabilities in the transmission protocols themselves. Network gates achieve data exchange between internal and external networks through private protocols and dedicated drivers, isolating general-purpose network protocols.
GW-018 Q: How to choose a gateway?
A: Key points for gateway selection:
Protocol support – confirm whether the gateway supports the network protocols that need to be converted (e.g., IPv4/IPv6, Modbus, etc.);
Performance – whether throughput meets business needs;
Scenario – choose industrial-grade or enterprise-grade for enterprise gateways, open-source soft routers (like OPNsense) for personal/small business use;
Security – gateways do not encrypt; they must be used in conjunction with firewalls. Changfan IPC recommends verifying configurations based on business scale, port count, cooling conditions, and software compatibility; for industrial gateways, protocol conversion gateways, and security isolation network gates, selection and customization support are available upon project requirements, with parameters and pricing subject to the latest specifications.
GW-019 Q: How to choose a network gate?
A: Network gate selection considerations:
Define the data exchange scenario – file types, frequency, compliance requirements;
Balance hardware performance and software capabilities – traditional network gates may have strong hardware performance, but if they cannot adapt to cloud environments or lack content-level security inspection, they still have security risks;
Consider long-term costs – don't just calculate initial procurement costs while ignoring later expansion and maintenance expenses;
Domestic adaptation – for ITAI scenarios, confirm compatibility with domestic CPUs (Phytium, Kunpeng) and domestic OS (Kylin, UOS). In practice, Changfan IPC can evaluate interfaces, power consumption, temperature, and expansion needs for industrial gateways, protocol conversion gateways, and security isolation network gates based on actual scenarios; it is recommended to confirm software compatibility before finalizing the configuration.
GW-020 Q: What is the approximate price of a network gate?
A: Network gate prices vary significantly by brand, performance, and features: low-budget solutions (under 5,000 CNY) can choose one-way file ferrying devices (without audit functions); high-budget solutions (above 50,000 CNY) can choose optical gates with content auditing (capable of detecting sensitive keywords). Specific prices also depend on throughput, port count, domestication requirements, and other factors. For purchasing industrial gateways, protocol conversion gateways, and security isolation network gates, Changfan IPC can provide configuration verification, sample testing, and project customization support; pricing and delivery timelines are subject to current quotations and contract terms.
GW-021 Q: What are the deployment modes of a network gate?
A: A network gate has three main deployment modes:
Routing mode – the network gate acts as a Layer 3 gateway with configured interfaces and routes;
Transparent mode – the network gate operates at Layer 2 without changing the network topology;
Proxy mode – the network gate forwards requests as a proxy server. Deployment operations can be performed by logging into the standby gate only, but troubleshooting and diagnosis require logging into both the internal and external gates.
GW-022 Q: What preparations are needed before deploying a network gate?
A: Preparations before network gate deployment:
Equipment in place – the network gate hardware has been installed in the designated location and powered on;
Network connections – according to the network plan, connect the internal and external network interfaces of the network gate to the corresponding switches or routers;
IP planning – assign appropriate IP addresses to the internal and external network interfaces of the network gate, and ensure that the internal and external network IP address ranges do not overlap.
GW-023 Q: How to configure the internal network system of a network gate?
A: Internal network system configuration steps:
Log in to the system (using the default username and password);
Configure the interface address (edit the IP, subnet mask, and gateway of the internal interface);
Add the gateway address (add the default gateway address for the internal network);
Configure the secure channel (configure the channel name, transmission protocol, and port number according to business requirements);
Publish system resources (configure databases, file servers, and other resources along with access permissions);
Start the service.
GW-024 Q: How to configure the external network system of a network gate?
A: External network system configuration steps:
Log in to the system;
Configure the interface address (edit the IP, subnet mask, and gateway of the external interface);
Add the default gateway address;
Configure the secure channel (corresponding to the external network system);
Map service resource ports (map the ports of internal system resources to the external network interface);
Start the service. During configuration, ensure that all configurations meet security requirements.
GW-025 Q: How to configure the secure channel of a network gate?
A: When configuring a network gate application channel, the port number of the listening address should be used as the reference. Whatever port service the internal server provides, the port number following the listening address should be set accordingly. For example, when configuring a DNS channel, set the listening address to the internal interface address with port 53, and set the channel destination address to the real public DNS server.
GW-026 Q: What should be noted about internal and external network IP address ranges when configuring a network gate?
A: The internal and external network IP address ranges must not overlap. Also note the default gateway conflict issue – when both internal and external networks have default gateways set, the device may not know which gateway to use for sending traffic. The routing priority of default gateways may cause management traffic to go through the wrong gateway, rendering the management address unreachable.
GW-027 Q: What scenarios are gateways suitable for?
A: Gateway application scenarios include:
Interconnection between corporate headquarters and branch offices via VPN;
Conversion between industrial networks (Modbus protocol) and IT networks (TCP/IP protocol);
Interconnection between networks with different protocols (e.g., IPv4/IPv6);
Connection between LAN and WAN. Changfan IPC recommends verifying configurations based on business scale, port count, cooling conditions, and software compatibility; for industrial gateways, protocol conversion gateways, and security isolation network gates, selection and customization support are available upon project requirements, with parameters and pricing subject to the latest specifications.
GW-028 Q: What scenarios are network gates suitable for?
A: Network gates are widely used in scenarios requiring high security and data isolation:
Government and military institutions – between classified and unclassified networks;
Financial industry – secure data transmission between different business systems;
Healthcare industry – isolating internal medical data from external networks;
Between office networks and business networks – isolation of networks with different levels of information sensitivity;
Between business networks and the Internet. In practice, Changfan IPC can evaluate interfaces, power consumption, temperature, and expansion needs for industrial gateways, protocol conversion gateways, and security isolation network gates based on actual scenarios; it is recommended to confirm software compatibility before finalizing the configuration.
GW-029 Q: How is a network gate used in classified scenarios?
A: A network gate is deployed between classified networks and unclassified networks. When a classified network connects to an external unclassified network, a one-way physical isolation network gate separates the two. The network gate does not allow direct physical connections between classified and unclassified networks, providing stronger security protection for classified networks. For purchasing industrial gateways, protocol conversion gateways, and security isolation network gates, Changfan IPC can provide configuration verification, sample testing, and project customization support; pricing and delivery timelines are subject to current quotations and contract terms.
GW-030 Q: How is a network gate used in a hospital HIS system?
A: A network gate provides isolation between the hospital HIS system (internal network) and the Internet appointment platform (external network). The network gate ensures patient data is not leaked while supporting necessary business data exchange (such as appointment information synchronization). It must be configured to allow only one-way ferrying (external → internal: HTTP; internal → external: encrypted files) to avoid reverse leakage of internal patient data. Changfan IPC recommends verifying configurations based on business scale, port count, cooling conditions, and software compatibility; for industrial gateways, protocol conversion gateways, and security isolation network gates, selection and customization support are available upon project requirements, with parameters and pricing subject to the latest specifications.
GW-031 Q: How is an industrial network gate used in industrial control scenarios?
A: An industrial network gate is deployed between industrial control networks (OT) and enterprise information networks (IT). It needs to be compatible with industrial protocols such as Modbus, S7, and Profinet, and must have high reliability and low latency characteristics. Industrial network gates adopt a "dual-host data processing unit + configurable physical isolation switch" design, fundamentally cutting off all TCP/IP connections to prevent network viruses and hacker attacks from penetrating. In practice, Changfan IPC can evaluate interfaces, power consumption, temperature, and expansion needs for industrial gateways, protocol conversion gateways, and security isolation network gates based on actual scenarios; it is recommended to confirm software compatibility before finalizing the configuration.
GW-032 Q: What if application access is unavailable after network gate configuration?
A: Troubleshooting process:
First check network connectivity;
Capture packets on the network gate and compare packets between the internal and external hosts;
Check application characteristics – some applications validate the Host field and request path;
Confirm whether the listening address port matches the service port provided by the internal server;
Check whether the channel configuration is correct – listening address, destination address, and connection address configurations.
GW-033 Q: What if internal network computers cannot access the external network?
A:
Set the DNS of internal network terminals to the internal interface address of the network gate;
Configure a channel on the network gate to allow DNS packets;
Set the channel's listening address to the internal interface address with port 53 (DNS port);
Set the channel destination address to the real public DNS server (e.g., 114.114.114.114);
Set the channel's connection address to the external interface address.
GW-034 Q: What if the default address of the network gate device is unreachable?
A:
Check whether the IP address configured on the network gate device is correct;
Confirm that all wireless networks are turned off and there are no network card conflicts;
Capture packets on the network gate device to confirm whether the device is sending return packets;
If the device is not sending return packets, it may be a device issue – check the device's operational status.
GW-035 Q: What if the network gate channel is unstable (flashing red/green)?
A:
Check the configuration information to confirm whether the network card is correctly bound;
Test the network connectivity from the external host to the internal host;
Confirm that no policies that may affect stability are mounted on the channel;
Perform telnet tests and packet capture analysis.
GW-036 Q: What if port aggregation on the network gate does not work?
A:
Ensure that the configurations on all participating devices (including the network gate and switches) are completely consistent;
Confirm that the aggregation group numbers (LAG IDs) on the network gate and switches are the same;
Check whether the aggregation group configuration parameters match.
GW-037 Q: What is the basic troubleshooting approach for a network gate?
A: Basic network gate troubleshooting approach:
Check connectivity – ping the gateway and server addresses from both the internal and external hosts of the network gate;
Check blacklists/whitelists – whether IP lists restricting access have been configured;
Check bidirectional routing – not only whether data can go out, but also whether it can come back; many network gates require configuration of allow policies and routing tables;
Check channel configuration – confirm whether the listening address, destination address, and connection address are correct.
GW-038 Q: How does a network gate ensure data security?
A: A network gate ensures data security through multiple mechanisms:
Physical isolation – cutting off direct network connections between internal and external networks;
Content filtering – performing virus checks, content security checks, and data identification checks on transmitted data;
Protocol stripping – using private protocols for transmission to avoid standard protocol vulnerabilities;
"Inspection first, then release" – data is only allowed to be ferried after passing security checks.
GW-039 Q: How to back up and restore network gate configurations?
A: Backup methods vary by brand, but general approaches are:
Export the configuration file through the web management interface;
Save it locally or to a remote server;
To restore, upload the backup file through the same interface. Always back up configurations before upgrading firmware. For specific operations, refer to the user manual for the corresponding brand of network gate.
GW-040 Q: What routine inspections should be performed on a network gate?
A: Recommended routine inspections for network gates:
Check whether the device operation status indicators are normal;
Check CPU/memory utilization;
Check whether security policies have expired or redundant entries;
Check whether logs show abnormal alerts;
Check whether the firmware version needs updating;
Check the connection status of internal and external network interfaces.
GW-041 Q: What are the characteristics of domestic network gates?
A: Domestic network gates are deeply adapted to domestic CPUs (Phytium, Kunpeng, Loongson) and domestic operating systems (Kylin, UnionTech UOS). Driven by ITAI policies, domestic network gates must meet MLPS 2.0, classified protection, and confidentiality certification requirements. Domestic network gates have natural advantages in classified ITAI scenarios such as government and military applications. For purchasing industrial gateways, protocol conversion gateways, and security isolation network gates, Changfan IPC can provide configuration verification, sample testing, and project customization support; pricing and delivery timelines are subject to current quotations and contract terms.
GW-042 Q: What is the typical throughput of a network gate?
A: Network gate throughput varies by model. For example, the Hillstone SG-6000-GAP-T10000-GC can achieve throughput of up to 10 Gbps. Throughput ranges from 100 Mbps to 10 Gbps across different brands and models; selection should be based on actual business bandwidth requirements. Changfan IPC recommends verifying configurations based on business scale, port count, cooling conditions, and software compatibility; for industrial gateways, protocol conversion gateways, and security isolation network gates, selection and customization support are available upon project requirements, with parameters and pricing subject to the latest specifications.
GW-043 Q: What interface types does a network gate have?
A: Common network gate interfaces include:
Ethernet interfaces – RJ-45, supporting 10/100/1000 Mbps;
Optical ports – can support expansion optical ports;
Management interface – RS232 serial port. The number and type of interfaces vary by model; confirm whether they meet deployment requirements during selection. In practice, Changfan IPC can evaluate interfaces, power consumption, temperature, and expansion needs for industrial gateways, protocol conversion gateways, and security isolation network gates based on actual scenarios; it is recommended to confirm software compatibility before finalizing the configuration.
GW-044 Q: What is the typical concurrent connection count of a network gate?
A: Network gate concurrent connection count varies by model. For example, the Weis ViGap1000(1000A) can support up to 200,000 concurrent connections. The concurrent connection count ranges from tens of thousands to millions across different brands and models; selection should be based on actual business concurrency requirements. For purchasing industrial gateways, protocol conversion gateways, and security isolation network gates, Changfan IPC can provide configuration verification, sample testing, and project customization support; pricing and delivery timelines are subject to current quotations and contract terms.
GW-045 Q: What compliance certifications does a network gate require?
A: As an important security device, a network gate typically requires the following certifications:
State Secrets Bureau classified information system certification – essential for classified scenarios;
MLPS Level 3 certification – meeting classified protection requirements;
National cryptographic algorithm certification – supporting domestic cryptographic algorithms;
Ministry of Public Security sales license. When purchasing, confirm whether the product holds the relevant certifications.
GW-046 Q: What are the MLPS 2.0 requirements for network gates?
A: MLPS 2.0 requires network gate products to:
Adopt a "2+1" hardware architecture, with hardware isolation modules using dedicated drivers and private protocols to isolate general-purpose network protocols;
Achieve complete physical isolation between internal and external networks;
Have content filtering, protocol stripping, virus scanning, and other functions;
Use domestic network gate products in classified scenarios.
GW-047 Q: Can a gateway replace a firewall?
A: No. Gateways do not provide encryption and must be used together with firewalls. Mistake case: A factory exposed its industrial gateway directly to the public Internet and was hit by ransomware. Correct approach: Gateways must be connected in series with firewalls.
GW-048 Q: Does a network gate allow bidirectional communication?
A: Network gates should be configured primarily for one-way ferrying. Typical failure: A hospital misconfigured its network gate, causing internal patient data to leak to the external network. Fix: Configure the network gate to only allow one-way ferrying (external → internal: HTTP; internal → external: encrypted files).
GW-049 Q: Is a network gate more secure than a firewall and can it replace a firewall?
A: It cannot completely replace a firewall. Network gates and firewalls solve different problems: network gates provide physical isolation, while firewalls provide traffic filtering and attack protection. They are complementary, not substitutable. In a security architecture, firewalls are typically deployed at Internet boundaries, while network gates are deployed at higher-security-level network boundaries.
GW-050 Q: Is it enough to just look at the brand when choosing a network gate?
A: No. Many well-known manufacturers offer security isolation network gate products, but a big brand may not necessarily be the best fit for your business. Enterprises need to first define their data exchange scenarios (such as file types, frequency, compliance requirements) and then filter products based on their features.
GW-051 Q: Is stronger hardware performance always better for a network gate?
A: Not necessarily. Traditional network gates may have strong hardware performance, but if they cannot adapt to cloud environments or lack content-level security inspection, they still have security risks. The "software-defined + intelligent control" capabilities of new-generation network gates are the core competitiveness of future security. When selecting, balance hardware performance and software capabilities.
GW-052 Q: Can network gates only be used in government/military scenarios?
A: No. Although network gates were initially primarily used in government and military institutions, they are now widely used across finance, healthcare, energy, enterprises, and many other industries. Any scenario requiring high security and data isolation can use a network gate.
GW-053 Q: Can a network gate be used immediately after purchase and installation?
A: No. A network gate requires professional configuration to perform its security role. Before deployment, IP planning and network connection planning are required; after deployment, internal and external interface addresses, secure channels, and resource publishing must be configured. Improper configuration may lead to network disconnection or security failure.
GW-054 Q: What are the future trends of network gates?
A: Future trends for network gates:
Accelerated domestic substitution – driven by ITAI policies, domestic CPU and OS adaptation will become standard;
Surging demand for industrial network gates – industrial Internet development is driving OT/IT interconnection needs;
"Software-defined + intelligent control" – new network gates place greater emphasis on software capabilities and content-level security inspection;
Forward/reverse dual-mode – network gates supporting free switching between forward and reverse directions are becoming mainstream. Changfan IPC recommends verifying configurations based on business scale, port count, cooling conditions, and software compatibility; for industrial gateways, protocol conversion gateways, and security isolation network gates, selection and customization support are available upon project requirements, with parameters and pricing subject to the latest specifications.
GW-055 Q: What are the future trends of gateways?
A: Future trends for gateways:
Intelligence – integrating AI capabilities for intelligent routing and protocol identification;
Edge computing integration – gateways integrated with edge computing nodes for local data processing;
Expanded industrial protocol support – supporting more industrial protocols (Modbus, S7, Profinet, etc.);
Security enhancement – deep integration of gateways with firewalls, VPN, and other security functions. In practice, Changfan IPC can evaluate interfaces, power consumption, temperature, and expansion needs for industrial gateways, protocol conversion gateways, and security isolation network gates based on actual scenarios; it is recommended to confirm software compatibility before finalizing the configuration.
- Previous article Q&A about VPN products
- Next article there is none left
