Midrange firewalls face off

Choosing the right firewall involves weighing a variety of factors. Naturally, you’ll want a box that’s easy to set up and configure; that complements your anti-virus, anti-spam, and other perimeter security solutions; and that comes at the right price. But even if you meet these needs, your firewall will do you no good unless it can handle your network’s highest traffic levels and, at the same time, thwart external attacks.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft

I recently invited vendors of midrange firewall appliances — products that support between 100,000 and 200,000 concurrent connections and between 1,000 and 2,000 VPN tunnels — to a performance test at Spirent Communications’ labs in Calabasas, Calif. In addition to sizing up setup requirements and feature sets, I used Spirent’s test equipment to measure the performance and security capabilities of three entries: ServGate’s EdgeForce Accel, SonicWall’s Pro 3060, and Stonesoft’s StoneGate SG-500.

I used Spirent’s Avalanche 5.2 and Reflector 5.2 test suites, running on Avalanche 2500 and Reflector 2500 hardware, to plumb each firewall’s performance capabilities, including performance under load and volume of traffic across a multiprotocol network. I also emulated a number of DDoS attacks  — namely Syn, Smurf, Reset, and ARP (Address Resolution Protocol) Flood attacks — to see how successfully each device forwarded legitimate traffic while fending off each threat.

To test VPN performance, I used Spirent’s SmartBits 6000 load generator and its newly released TeraVPN 4.0 test suite to measure maximum throughput in a site-to-site tunnel. In addition, I verified data passage on the vendors’ stated maximum number of supported VPN tunnels.

In the end, none of the three devices were materially affected by the simulated attacks, which was not surprising, considering this is an essential requirement for any enterprise-class firewall. But I did see significant differences in firewall and VPN performance, with ServGate and SonicWall leading the way. 

ServGate EdgeForce Accel

ServGate’s EdgeForce product line eschews the much-touted ASIC-based approach for a modular architecture on the grounds that maximum flexibility to defend against network threats is more important than brute muscle. Optional add-on modules allow you to boost the Accel’s firewall throughput from a rated 250Mbps to 1Gbps and to take advantage of features such as Web content caching, local logging, virus scanning, and spam filtering.

The EdgeForce Accel I tested came with the works. This 1U, rack-mountable device runs a customized version of Linux on a Pentium III 686MHz processor and uses a Broadcom security chip for encryption processing. It is the only one of the International Computer Security Association-certified reviewees that supports gigabit interfaces. Standard management tasks, such as configuring firewall policies and designating e-mail alerts, are easily handled from within the GUI’s drop-down windows. The Accel supports a garden variety of VPN configuration standards and protocols, and you can specify granular levels of QoS. To ease the management of multiple firewalls in distributed organizations, ServGate will soon release a centralized management console called the Global Manager. This software was not available in time for this review.

In firewall performance tests, the Accel exceeded its own specs of 128,000 concurrent connections, dropping out as it approached 131,000. When tested for maximum connections per second, the device ran into a problem due to the default rate at which it dropped old connections. Because the Accel kept the connection socket open for 120 seconds after the TCP connection closed, it was not releasing old connections fast enough to support the number of new connection requests.

Under this default configuration, the box tested out at 1,100 connections per second with intrusion detection turned on and NAT enabled. ServGate says that when it tested Accel with the TCP session teardown time reduced to 60 seconds and the intrusion detection and NAT features disabled, firewall performance improved to 3,490 connections per second.

Although ServGate claims that when Accel is coupled with the Performance module it can support 2,000 VPN tunnels, I wasn’t able to verify this due to time constraints. None of these vendors has a quick means of configuring large numbers of tunnels, but I did manage to configure and verify support for 1,000 tunnels on the ServGate box before time ran out.