Feature-stoked firewalls burn brightly

When it came time to deliver data, the SonicWall, running on the somewhat limiting PDA-size StrongArm 233MHz processor, turned in a maximum 340 connections per second with the total number of persistent connections hitting the 96,000 mark. It wouldn’t handle the larger loads and didn’t ramp as well with mixed protocol data as the other two firewalls. However, it did a decent job of withstanding my attacks with the exception of a 28.4 percent unsuccessful transaction rate on the ARP attack.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft

The Pro 330 built and passed data through 843 tunnels, almost meeting the FortiGate-500 figure, but its data performance throughput figure was limited to 5.5Mbps. It began dropping tunnels when it got to 843 and logged a Payload Malformed error message in TeraVPN. The throughput test showed a small amount of CRC (cyclic redundancy check) errors as well as some tunnel fragmentation.

WatchGuard Vclass V80

The V80’s initial setup can be handled either through WatchGuard’s Vcontroller software via a Port 443 SSL connection to the box or from Cisco-like command line prompts. Changes are made directly to the CPU and updated to the database so the V80 doesn’t require reboots unless the modifications cause an interface change.

Vcontroller’s six-step setup wizard is self-explanatory and simple to move through, yet it does not compromise potential customization. Some important capabilities include enabling DHCP (Dynamic Host Configuration Protocol) on the private side and sending out e-mail alerts based on designated alarm conditions.

The V80’s default policy allows no traffic in. You can configure settings within the nifty Hacker Prevention screen using a setup wizard, making it possible to catch an attack that slips past the logic built in to the ASIC chip. I was able to set packet-per-second thresholds for several common nasties such as ICMP (Internet Control Message Protocol), Syn, UDP (User Datagram Protocol), POD (point of demarcation) and IP source route attacks. Additionally, V80 allows you to look at all the servers on your network, choose the weakest, and set parameters to that one. These customizable settings make this a very flexible, scalable product. The GUI is split into three parts comprised of activities, policy, and administration sections.

WatchGuard acquired RapidStream in April 2002 and as part of the product merger process, RapidStream’s RSSA (RapidStream Security Appliance) series morphed into the Vclass series. Hardware architecture remains the same, but there have been software upgrades. WatchGuard’s most recent software release includes application-layer inspection HTTP and SMTP, BGP (Border Gateway Protocol)-routing support, DHCP relay, and WAN fail-over.

The V80 supported a respectable 1,150 connections per second, sustained 125,960 persistent connections, and was unaffected by any of the attacks I tossed at it. I did notice, however, that the latency through the box increased every minute,  then returned to the previous level almost as if a timer went off or there was some internal event occurring.

Its VPN capabilities proved the most powerful of my group’s, supporting data passage through 7,968 tunnels and providing a 63Mbps bi-directional data performance figure. The version of firmware I tested doesn’t support AES (Advanced Encryption Standard) encryption or Group 5. It builds tunnels at a maximum rate of two per second, which also happens to be its tear-down time, so I improvised, configuring it for 3DES encryption and Group 2 instead.

The V80 and FortiGate-500 proved they are in the same solution and cost class, although with slightly different strengths. If firewall muscle is of primary importance, the  FortiGate-500 is the clear choice. If you’re more in need of VPN capability, the WatchGuard is the ticket. Both were impervious to the range of attacks we slung at them. The Pro 330 is the least powerful of the group but it only costs one third of the price of the other two, and would be suitable for most midsize businesses.