Security appliances wrestle with blanket coverage

Worms, Trojan horses, security holes, floods, hacks, and attacks -- what's an SMB to do? Why, install an all-in-one security appliance, of course. Just make sure it lives up to its name

NetGear has made a good name for itself in the SOHO-product arena. Although the FVS328 does no harm to that reputation, we stumbled enough in our testing to be cautious about recommending this device.

This is the only box we tested that does not support anti-virus. On the upside, the FVS328 was the second-easiest machine to get into a basic configuration and, at $195, it was also the least expensive. Unfortunately, its ease of use comes at the expense of interface functionality, so if you want to do anything even slightly customized, you must spend some time with NetGear’s tech support personnel.

We ran into most of our trouble while testing VPN functionality. Our test device, the Spirent SmartBits 600 running TeraVPN, wanted to use certain encryption schemes for performance reasons, and NetGear’s interpretation of the way to set up a VPN didn’t match Spirent’s. The FVS328 makes it tricky to configure advanced VPN handshaking features such as the Diffie-Hellman Key Agreement Standard. And when we finally got there, we discovered that the box can only get as far as 3DES and Diffie-Hellman group 2. This isn’t necessarily a critical flaw in a SOHO-oriented device, but the Check Point and ServGate products offered more flexibility.

Even after we got our VPN tunnels configured, the FVS328 displayed several idiosyncrasies. We couldn’t activate a VPN tunnel unless we first sent a ping through it, which was not mentioned in the NetGear manuals. And although the docs indicated IPSec should be defined as a service, they failed to point out that doing so is critical to configuring any VPN tunnel.

NetGear reported that this tunneling problem was a known issue and sent a firmware upgrade to solve the problem, but the upgrade only made things worse. In the end, the FVS328 was so unstable that it never managed to keep enough simultaneous tunnels running to complete our VPN performance tests.

Fortunately, our firewall tests went better. Basic configuration is simple and wizard-based. The box carries a full-state inspection firewall that passed our ad hoc ping-hack attempts and stopped our static DDoS (distributed DoS) attack sequence. The wizard even offers a few niceties such as locking out certain types of traffic functions based on the hour of the day. We also liked being able to insert addresses for certificate authorities.

Although the NetGear sells at an attractive price and features a friendly wizard interface, it boils down to a no-frills firewall with VPN capabilities shoehorned in — and it shows. With its CPU lacking help for crypto processing, its performance slows noticeably when more than 10 tunnels run at once. Knowing NetGear, a better firmware version exists already, but we’d recommend testing it thoroughly before spending even the little money this box costs. Your company will be more secure for the effort.

ServGate EdgeForce Plus

The EdgeForce Plus differentiated itself from every other appliance with an impressive feature set and an excellent approach to modular configuration.