6/3/2004 -- Cisco this week announced an update for its Cisco Firewall Service Module, along with two new appliances that it says can detect and mitigate distributed denial of service (DDoS) attacks and traffic anomalies.

Cisco says that the version 2.2 update for its Firewall Service Module delivers new managed virtualization capabilities that permit a single physical firewall module to act as several different virtual devices or "contexts. The upshot, Cisco officials say, is that the revamped Firewall Service Module can support the delivery of differentiated firewall services by customer, user or application type.

In addition, Cisco announced a new Resource Manager tool that supports the virtualization of firewall resources. The idea, Cisco officials say, is that users can tap Resource Manager to allocate firewall performance and resource availability on a per virtual firewall basis. To that end, Resource Manager supports differentiated service level definitions and guarantees.

Finally, the revamped Firewall Service Module boasts built-in Layer 2 firewall support, which makes it possible for customers to segment their networks into multiple Layer- 2 security "trust zones," while at the same time preserving their existing IP addressing schemes.

Elsewhere, Cisco announced the Cisco Guard XT 5650 and Cisco Traffic Anomaly Detector XT 5600, two new security appliances based on technology it acquired earlier this year from the former Riverhead Networks.

Cisco says that the Guard XT 5650 can compare individual traffic flows to profiles of normal traffic patterns, behavior, and protocol compliance to identify potential traffic anomalies. In addition, officials say, the Guard XT 5650 boasts source verification and anti-spoofing capabilities.

The Cisco Traffic Anomaly Detector XT 5600, on the other hand, can identify both known and previously unseen DDoS attacks, as well as automate activation of the Cisco Guard XT 5650. -Stephen Swoyer