Midrange firewalls face off

Choosing the right firewall involves weighing a variety of factors. Naturally, you’ll want a box that’s easy to set up and configure; that complements your anti-virus, anti-spam, and other perimeter security solutions; and that comes at the right price. But even if you meet these needs, your firewall will do you no good unless it can handle your network’s highest traffic levels and, at the same time, thwart external attacks.

I recently invited vendors of midrange firewall appliances — products that support between 100,000 and 200,000 concurrent connections and between 1,000 and 2,000 VPN tunnels — to a performance test at Spirent Communications’ labs in Calabasas, Calif. In addition to sizing up setup requirements and feature sets, I used Spirent’s test equipment to measure the performance and security capabilities of three entries: ServGate’s EdgeForce Accel, SonicWall’s Pro 3060, and Stonesoft’s StoneGate SG-500.

I used Spirent’s Avalanche 5.2 and Reflector 5.2 test suites, running on Avalanche 2500 and Reflector 2500 hardware, to plumb each firewall’s performance capabilities, including performance under load and volume of traffic across a multiprotocol network. I also emulated a number of DDoS attacks  — namely Syn, Smurf, Reset, and ARP (Address Resolution Protocol) Flood attacks — to see how successfully each device forwarded legitimate traffic while fending off each threat.

To test VPN performance, I used Spirent’s SmartBits 6000 load generator and its newly released TeraVPN 4.0 test suite to measure maximum throughput in a site-to-site tunnel. In addition, I verified data passage on the vendors’ stated maximum number of supported VPN tunnels.

In the end, none of the three devices were materially affected by the simulated attacks, which was not surprising, considering this is an essential requirement for any enterprise-class firewall. But I did see significant differences in firewall and VPN performance, with ServGate and SonicWall leading the way. 

ServGate EdgeForce Accel

ServGate’s EdgeForce product line eschews the much-touted ASIC-based approach for a modular architecture on the grounds that maximum flexibility to defend against network threats is more important than brute muscle. Optional add-on modules allow you to boost the Accel’s firewall throughput from a rated 250Mbps to 1Gbps and to take advantage of features such as Web content caching, local logging, virus scanning, and spam filtering.

The EdgeForce Accel I tested came with the works. This 1U, rack-mountable device runs a customized version of Linux on a Pentium III 686MHz processor and uses a Broadcom security chip for encryption processing. It is the only one of the International Computer Security Association-certified reviewees that supports gigabit interfaces. Standard management tasks, such as configuring firewall policies and designating e-mail alerts, are easily handled from within the GUI’s drop-down windows. The Accel supports a garden variety of VPN configuration standards and protocols, and you can specify granular levels of QoS. To ease the management of multiple firewalls in distributed organizations, ServGate will soon release a centralized management console called the Global Manager. This software was not available in time for this review.