Security appliances wrestle with blanket coverage

Worms, Trojan horses, security holes, floods, hacks, and attacks -- what's an SMB to do? Why, install an all-in-one security appliance, of course. Just make sure it lives up to its name

The Safe@Office has a unique way of handling AV, so we adjusted our test accordingly. The appliance redirects e-mail traffic to a server at Check Point, which scans then forwards it to its destination. This explains why such a small CPU can handle so many services at once, but it also means that, unlike some anti-virus solutions, Safe@Office can’t check for viruses downloaded before installation.

The bottom line? Check Point stripped its much-vaunted Firewall 1 down to its bare bones to build this appliance. Fronted by a friendly user interface and using Check Point-hosted services to handle advanced functions such as AV, Web filtering, and dynamic DNS, the Safe@Office offers complex features at a low cost, but locks customers into the vendor’s services.

Juniper NetScreen-5GT Enhanced

The NetScreen-5GT Enhanced packs a load of good impressions into a tiny box, combining everything you could ask for from an all-in-one security box, including firewall, VPN, intrusion detection, and AV. The NetScreen-5GT Enhanced sports an attractive $495 price tag for 10 VPN clients.

The NetScreen-5GT presents a logical home screen on its Web interface. It doesn’t require you to dig any deeper if you’re just looking for a general status of firewall health, which is handy in an emergency — and this box can react to emergencies. The NetScreen goes beyond the basic functionality of similar boxes with specific defenses for a host of popular attacks, including WinNuke, ICMP/UDP and SYN floods, malware based on Java or ActiveX, and much more.

Displaying responses to specific attacks in a menu-like fashion, this box allows you to configure its defenses to simply sound an alarm or to start dropping malicious packets. Configured in the latter manner, it stopped everything we threw at it, allowing us to go above and beyond our normal attack suite.

We were similarly impressed with its AV capabilities. As does Check Point’s Safe@Office, the NetScreen handles AV via a subscription-based service for which Juniper partnered with Trend Micro. The device differentiates AV settings between Webmail and POP3/SMTP mail services, so we were surprised to see no AV features supported for IMAP users.

Similar to the best this roundup offered, NetScreen’s VPN testing went almost without a hitch. The box handled all 20 VPN tunnels with aplomb.

The NetScreen can fully protect a SOHO or an SMB. Its performance indicated it could handle firewall duties for networks upward of 50 clients without breaking a sweat. It not only can support multiple ISPs for fail-over, but it also can drop a dial-up connection in case of WAN failure. Web content filtering is another example, allowing the NetScreen to access the WebSense subscription service to create corporate white- or blacklists (this costs extra).

One unique feature is the NetScreen’s source routing. Every box we tested can handle static route additions, but only the NetScreen can add source routing entries that report where the routes originated and whether the source arrived via OSPF, RIP (Routing Information Protocol), BGP (Boundary Gateway Protocol), or a static entry. This is truly advanced firewall functionality that we didn’t expect in a smaller box, and we definitely didn’t expect it to be so accessible.

NetGear VPN Firewall FVS328