Big security power in small packages

The evolution of the SOBO (Small Office/Branch Office)-oriented, all-in-one box is a continuing process, bent on improving speed and convenience. The latest fish to walk their way out of the SOBO ocean include not only highly sophisticated firewalls, but also advanced LAN-switching software, solid management utilities, and 802.11a/b/g wireless connectivity and management.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft

Although we found a few dings, a pair of small contenders -- Check Point Safe@Office 425w and the SonicWall TZ170w -- pack a powerful security punch for individual or branch offices.

Check Point Safe@Office 425w
Those seeking all-in-one functionality with a little depth might want to take a close look at Check Point’s bright orange box. The box combines an inspection firewall router with single WAN port, a DMZ port, a console port, a four-port switch, and two USB 2.0 ports to feed the built-in print server. It also tacks on a slew of additional service-based protections and a wireless bridge that’s compatible with all the latest protocols.

Installing the 425w really should include a functioning broadband connection of some kind. With some tweaking, though, you can get it to serve as the central routing point for an air-gapped LAN. Fortunately, Check Point’s obvious attention to detail in 425w’s Web-based management interface makes this tweaking easier.

Although the SonicWall TZ170w has a functional Web interface, the Check Point folks really went all out in their quest for ease of use and intuitiveness in the management GUI. Creating baseline connectivity is less wizard-based than with the SonicWall, but the process is just as easy.

The only downside to the interface might be that the GUI continually wants to steer you toward Check Point’s large number of additional-cost security services to squeeze a little more from your wallet.

As it turns out, to get the full benefits of the 425w, you will have to pony up. Luckily, the services are worth the money and include anti-virus, anti-spam, content filtering, and Dynamic DNS. All of these are available via subscription licensing to Check Point, but you’ll need to maintain your broadband connection in order to access the services.

Dynamic DNS is especially interesting, as it mirrors the functionality of Microsoft’s new NAP (Network Access Protection) technology and Cisco’s competing NAC (Network Access Control). These access control technologies scan clients as they reconnect to the network to ensure that each client is in compliance with an administrator-defined security policy (appropriate anti-virus updates, all necessary OS security patches, etc.)

If the client passes the policy requirements, they’re in; if not, they’re in quarantine until they become compliant. That’s an especially valuable service for SOBOs, as it can cut down on having to hire a consultant to quash virus outbreaks every time a new attack rears its ugly head.

Going Beyond the Norm
Despite the push toward the add-on services, when you start digging into the 425w’s internal features, you’ll be pleasantly surprised by how much enterprise-class functionality it has. For example, the 425w automatically manages a DNS cache, allowing you to reference the unit through “My Firewall” regardless of what DNS Server your ISP is using. You can also provide DHCP on different VLANs (port- or tag-based), which is helpful when implementing things such as VoIP.

You can get into traffic shaping with the 425w, applying rate limiters in the same way you apply firewall rules. And naturally, you’ve got full support for Check Point’s IPSec VPN features, both point-to-point and remote access variations, as well as access to a Dynamic VPN subscription service. The Dynamic VPN service provides roaming from ISP to ISP without having to modify the IPSec VPN rules for each new location.