ZyXel ZyWall: The little firewall that could
ZyXel's ZyWall USG1000 delivers a solid set of features, acceptable performance, and a surprising level of attack protection at a bargain priceFollow @infoworld
Small, not simple
The ZyWall gives the physical impression of being a simpler, "lightweight" UTM, but don't be fooled. First, it doesn't have wizard-based setup; you need to know what you're doing. Second, it's not terribly lightweight from the features standpoint, either. Although it doesn't come close to the Astaro's broad selection of possibilities, there's no shortage of options for protecting your network through the ZyXel interface. The shortage lies in the absence of wizards to ease the pain of bouncing among numerous screens for setup and configuration, and to keep naming and rules in the realm of best practices.
AppPatrol is an optional set of capabilities that allows you to set rules for common Internet-based applications, including VoIP, IM, streaming media, and P2P apps. Functions include restricting time of access for different groups of users, enforcing bandwidth quota against certain types of P2P applications, and prioritizing VoIP traffic to ensure best call quality over slow WAN links. These are standard features in an enterprise-class UTM device, but surprising in $3,400 product.
Anti-virus, intrusion detection and prevention, anomaly detection and prevention (abnormal protocols and flows), and content filtering are available through the Anti-X tabbed interface, with virus signatures from Kaspersky or ZyXel AV. Unlike many other UTMs on the market, ZyXel doesn't charge for anti-spam updates, so this box is an even better deal. The rest of the UTM features can be purchased either bundled or a la carte, depending upon your needs and level of paranoia.
The ZyWall USG1000 even has port aggregation for better throughput -- a rare feature in an economy firewall.