Full-featured firewalls

Never has the firewall been asked to do so much. Although firewalls have long offered extras, such as the ability to do VPN processing and content filtering, today vendors are throwing in the kitchen sink, including virus and spam filtering and even intrusion detection and prevention.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft

Putting all of these functions into one box and behind one management interface sounds like a winning idea, but what happens to firewall performance when you turn all of these services on? That was one question I wanted to answer when I tested two full-featured firewalls, Fortinet’s FortiGate 800 and ServGate’s EdgeForce Accel, at Spirent Communications’ lab in Calabasas, Calif.

In addition to examining ease of setup, manageability, and security features, I used Spirent’s Avalanche 5.2 and Reflector 5.2 test suites, running on Avalanche 2500 and Reflector 2500 hardware, to assess the performance of these gigabit-capable boxes. Avalanche and Reflector emulate multiprotocol traffic (namely HTTP, FTP, POP3, and SMTP) between a number of clients and servers, which allowed me to test performance under load with all features and filtering disabled, and when enabled, to determine the performance hit the device would take.

To assess firewall functionality, I emulated a Syn Flood, the only denial-of-service attack that phased participants in my previous test, and I created basic functionality tests to ensure that the Fortinet and ServGate firewalls handled an e-mailed virus and a forbidden URL Get request successfully.

Finally, to prove out VPN muscle, I used Spirent’s TeraVPN 4.0 to test throughput for both 10 and 200 LAN-to-LAN tunnels. I verified data passage across all tunnels using six different payload sizes, from 64 to 1,350KB.

Fortinet FortiGate 800

Since I tested the FortiGate 500 last fall, Fortinet has packed a full load of security services into its firewalls and given them a new, slicker front end with the recent 2.8 release of the FortiOS operating system. Fortinet has beefed up the firewall’s routing features by enhancing support for RIP (Routing Information Protocol) I and II and adding support for OSPF.

Firewall capabilities are also improved, through increased granularity of protection profiles and the ability to customize security features such as anti-virus, Web filtering, Web category (URL) filtering, anti-spam, intrusion prevention, and content logging. For example, the drop down window for intrusion prevention now has signature and anomaly subsections that give you up to eight action options.

The FortiGate’s dashboard, or System Status page, is pretty cool. It gives you a quick overview of important information such as recent viruses, attack detections, and the status of system resources. One of the handiest additions I found in FortiOS 2.8 is that command line access is now available with a single click from the main task bar icon. Other useful additions include a signature-based “grayware” malware category and a backup and restore feature, which should have been included sooner.

The FortiGate 800 turned in an excellent performance in my VPN throughput tests; firewall performance was also impressive. Although the maximum connections per second I achieved in the lab (3,200) fell far short of the vendor’s claim of 10,000, the maximum number of concurrent connections the box was able to handle (446,000) beat both Fortinet’s spec and the ServGate box (131,000), the latter by a wide margin.

With all security features enabled, the FortiGate 800 took a significant hit in terms of its ability to serve new connections, achieving just 900 connections per second before choking, representing a 72 percent drop in performance. 

I was pleased with the FortiGate’s VPN performance. The box arrived with VPNs preconfigured according to my test plan, using AES (Advanced Encryption Standard) 128-bit encryption, and I was able to pass data through the tunnels — in all six payload sizes — immediately. The box proved out at 544Mbps for the 10-tunnel test and 424Mbps for the 200-tunnel test, again exceeding Fortinet’s marketing data.