Array Networks falters where F5 flies in SSL VPN standoff

The FirePass also allows you to force the cache cleanup applet to install

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft

on the remote PC to remove any traces of attachments or temporary files on exit. There are different settings for how content is cached, from “cache nothing” to “cache only style sheets and JavaScript.” This allows you to balance performance and security during user sessions.

Array Networks Array SP

As the name implies, the Array SP is a security device. It is not a pure SSL VPN appliance; it’s VPN, firewall, content filtering, and SSL acceleration all rolled into one, and as such, it’s not overly deficient nor does it excel in any one area.

The Array SP is a great choice for networks where Web-based applications are the primary destination for remote users. Like most other SSL VPN appliances, the SP rewrites the HTML stream to hide internal name spaces and can also compress the HTML data on the fly to improve server response. The SP includes a powerful URL-filtering component and easily connects your secure session to both Windows and Unix file shares. However, it does not come with a network-level VPN connector as the F5 FirePass 1000 does, and configuration is too complex.

The SP ships with excellent infrastructure compatibility and includes dual Gigabit Ethernet interfaces and VLAN tagging in its midsize, 3U chassis. It is cluster-ready and has the ability to stack up to 32 units in a single cluster. WebWall, a network-layer firewall, helps protect the appliance from any type of network attack. The SP can also encrypt internal traffic to a back-end server using SSL.

SP’s policy- and user-control start with the creation of a Virtual Site. A Virtual Site is a container for managing authentication and security policies in the SP. Each Virtual Site requires an available IP address from the outside network interface’s subnet. For granular user- or group-level policy enforcement, you must define multiple Virtual Sites. Although I like the Virtual Site concept, I do not like the fact that each one uses up an IP address. Depending on your infrastructure, this may prove to be a logistical problem.

For each Virtual Site, you choose the type of authentication to use from Active Directory, LDAP, RADIUS, SecurID, or the local user database. Array has an API that allows you write your own authentication connector, if needed. For my test, I authenticated my users against Windows 2000 Active Directory without any trouble. Each Virtual Site can have its own server-side digital certificate, cipher suite definition, and minimum cipher strength.

Further Virtual Site definition includes enabling Windows or Unix file shares, and the creation of TCP Application Settings, a section in each Virtual Site that allows you to create thin-application mappings. Defining your TCP applications in the SP is not very intuitive and would benefit from a less confusing user interface. Although the available settings allow you to define just about any TCP application profile based on address and port, there are no predefined applications to choose from.

A Java applet downloads to your browser automatically when you connect to one of these protected resources. I found that for best results, you need to be running the latest version of the Microsoft JVM. I ran into trouble because one of my test laptops had the Sun 1.4.2 Java Virtual Machine installed. Currently there is no network-layer VPN component to allow IPSec-style access through the SP, but a company representative confirmed that one is under development.

All told, the Array Networks Array SP is secure in the services it provides, and it’s well-suited to protecting Web applications. However, the F5 FirePass 1000 is a more complete offering.