Feature-stoked firewalls burn brightly

Facing ever-increasing network threats, businesses of all sizes are demanding more security features from their firewalls, such as security policy management, IDP (intrusion detection and prevention), and VPN capabilities. Consequently, firewall manufacturers are rising to the challenge and cramming more and more security functionality into their products.

In our continuing quest to see how firewalls are stacking up, we tested another group of devices. This round included two higher-priced firewalls, the Fortinet FortiGate-500 and WatchGuard’s Vclass V80, as well as the SonicWall Pro 330, an Internet security appliance.

To assess just how capable these souped-up firewalls are, I emulated a multi-protocol network, then launched a range of attacks against the boxes, including Syn, Smurf, Reset, and ARP (Address Resolution Protocol) floods, first separately, then simultaneously. Additionally, I challenged the boxes to meet stated VPN support data, testing for VPN tunnel support and data performance metrics.

The good news is, these contenders stood up nicely, with few exceptions, to my attack tests. The FortiGate-500 wasn’t phased by any of them, and the V80 wasn’t fazed by  any but the Syn. The Pro 330, considered the least muscular of all the entries, actually provided strong defense against all attacks except the ARP flood, which isn’t that common an attack.

The not-so-good news, depending on your needs, is that deploying VPN functionality with these firewalls is not reasonably easy, not even with the SonicWall, which the company deems an appliance. The Pro 330 supported close to its marketing claim of 1,000 tunnels, so it has limited capability for VPN support, but it doesn’t ship with the required software and provides support only to other SonicWall devices. Although the FortiGate-500 and V80 are quite robust, they do support tunneling to other firewalls, and tunnels can be built individually or multiples can be constructed using a script. However, there is no way of quickly cloning them.

Fortinet FortiGate-500

This high-end enterprise box falls just below the company’s large enterprise and service provider offerings. It runs on an ASIC-based 1GB Pentium 4 processor, which gives it plenty of processing power compared to the less robust SonicWall box.

The FortiGate-500 is easy to set up, either through the Web-based GUI or command line prompts. The management GUI is easy on the eyes and intuitive, with sections such as the System, Firewall, User, VPN, NIDS, Anti-Virus, E-mail and Web Filters, as well as Logs and Reports, which are easy to select through a left frame menu. There’s no full blown spam filtering but it does filter keywords. Log capabilities are fairly granular and notification options give you five levels of importance going from emergency to informational.

The FortiGate-500 left the other contenders in the dust when it came to delivering rock-solid firewall beef. In the lab, none of the attacks or combination attacks fazed it. It supported 2,400 multi-protocol connections per second and held on to 422,000 sustained connections. I did find that the device began dropping larger numbers of connections intermittently after hitting  the 260,000 mark.