Full-featured firewalls

Never has the firewall been asked to do so much. Although firewalls have long offered extras, such as the ability to do VPN processing and content filtering, today vendors are throwing in the kitchen sink, including virus and spam filtering and even intrusion detection and prevention.

Putting all of these functions into one box and behind one management interface sounds like a winning idea, but what happens to firewall performance when you turn all of these services on? That was one question I wanted to answer when I tested two full-featured firewalls, Fortinet’s FortiGate 800 and ServGate’s EdgeForce Accel, at Spirent Communications’ lab in Calabasas, Calif.

In addition to examining ease of setup, manageability, and security features, I used Spirent’s Avalanche 5.2 and Reflector 5.2 test suites, running on Avalanche 2500 and Reflector 2500 hardware, to assess the performance of these gigabit-capable boxes. Avalanche and Reflector emulate multiprotocol traffic (namely HTTP, FTP, POP3, and SMTP) between a number of clients and servers, which allowed me to test performance under load with all features and filtering disabled, and when enabled, to determine the performance hit the device would take.

To assess firewall functionality, I emulated a Syn Flood, the only denial-of-service attack that phased participants in my previous test, and I created basic functionality tests to ensure that the Fortinet and ServGate firewalls handled an e-mailed virus and a forbidden URL Get request successfully.

Finally, to prove out VPN muscle, I used Spirent’s TeraVPN 4.0 to test throughput for both 10 and 200 LAN-to-LAN tunnels. I verified data passage across all tunnels using six different payload sizes, from 64 to 1,350KB.

Fortinet FortiGate 800

Since I tested the FortiGate 500 last fall, Fortinet has packed a full load of security services into its firewalls and given them a new, slicker front end with the recent 2.8 release of the FortiOS operating system. Fortinet has beefed up the firewall’s routing features by enhancing support for RIP (Routing Information Protocol) I and II and adding support for OSPF.

Firewall capabilities are also improved, through increased granularity of protection profiles and the ability to customize security features such as anti-virus, Web filtering, Web category (URL) filtering, anti-spam, intrusion prevention, and content logging. For example, the drop down window for intrusion prevention now has signature and anomaly subsections that give you up to eight action options.

The FortiGate’s dashboard, or System Status page, is pretty cool. It gives you a quick overview of important information such as recent viruses, attack detections, and the status of system resources. One of the handiest additions I found in FortiOS 2.8 is that command line access is now available with a single click from the main task bar icon. Other useful additions include a signature-based “grayware” malware category and a backup and restore feature, which should have been included sooner.