Check Point halts application threats

Another big difference between Firewall-1 and the rest of the pack: The concept of a DMZ is not terribly useful in Check Point’s view of the world, either; every host is either external or internal. Check Point allows you to manually define hosts behind any interface and either provide NAT for them or not with the additional ability to use different NAT subnets per interface. And although you can configure Firewall-1 to examine traffic on different VLANs, Check Point suggests you stick to examining trunk traffic and use a switch behind the firewall to break out the VLAN traffic.

Manageable Security

Once you’ve climbed the Check Point learning curve, you’ll be pleasantly surprised by the unit’s management capabilities. The SmartView Tracker, for example, provides a level of reporting that may seem overwhelming until you start focusing on how the data is organized. The first level of the report tree shows a list of all packets that have touched the system; progressively more detailed tabs allow you to look at only VPN traffic, VoIP (voice over IP) Traffic, Web traffic, or any traffic stopped by the layer 7 filter.

Overall, our testing was uneventful, which struck us as extraordinary. As expected, when our DoS test attacks started, some traffic got through. But as SmartDefense recognized the sequence of packets as a denial of service attack, it began blocking. Although our rules were configured for Any — anything was allowed in or out — the Check Point software recognized our attacks and blocked them.

Furthermore, performance remained blazing regardless of whether the machine was under attack. The WebAvalanche 220 device we were using could generate only enough traffic to saturate a Fast Ethernet link. Because this is far and away more bandwidth than most organizations have to the outside world, it seemed enough. However, even on our most complex DoS attack sequences, Firewall-1 never missed a beat.

We were impressed with Check Point’s Firewall-1/VPN-1 and SmartDefense. Not only is this combination deep, it’s more than fast enough to handle standard enterprise traffic levels. And while we’ve criticized the complexity of Check Point’s software in the past, we have to admit it’s taken a quantum leap forward from previous iterations. If you’re willing to put in some work, there’s no reason you should need a dedicated Check Point technician to help configure and manage the device.