Barracuda sinks teeth into spam

I’ve reviewed many security products, but it’s rare for me to be so impressed with a product that I want to keep and use it after the review. Barracuda Networks’ Spam Firewall is my favorite keeper so far this year.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft Barracuda Spam Firewall Barracuda Networks, barracudanetworks.com Very Good  8.5 criteria score weight Manageability 8 25% Performance 9 25% Ease-of-use 8 20% Setup 8 20% Value 10 10% Cost: Starting at $1,199, depending on model, plus a $399-per-year update subscription Platforms: JavaScript-capable browsers for management console Bottom Line: Spam Firewall is an accurate anti-spam appliance that’s chock-full of features for a relatively low price. It’s easy to install and to use; with only a few weaknesses in documentation and reporting, this is a top anti-spam defense choice. About our Reviews and Scoring Methodology

In my experience, perimeter solutions usually rank just behind Internet-hosted service offerings in accuracy, with end-point solutions having the worst rates. This is not the case with Barracuda — it’s among the more accurate anti-spam products I’ve tested, even when compared with seemingly more intelligent hosted solutions. In a crowded field, Barracuda Spam Firewall stands out for being packed with features, easy to use, accurate, and relatively low-cost.

Filter-friendly

The Spam Firewall 300 is a 1U appliance running Linux on an AMD Athlon XP 1900+ processor with a 40GB hard drive and 512MB of RAM. It is designed to be placed as a front-end MTA in front of SMTP servers, but unlike most Linux appliances, the Spam Firewall rarely if ever requires you to delve into the world of command-line prompts because administration is performed via almost any JavaScript-enabled browser. Although there are more than 100 features that can be enabled or customized, the default settings are fine for most environments.

Installation is fairly easy. Administrators set the correct IP address and then follow a simple four-page document to complete the setup, leaving the advanced options, such as Exchange LDAP interaction, for another configuration session. The defaults are accurate enough to capture most spam, so you can customize and strengthen the settings later when you are more familiar with the system.

If you’ve read about an anti-spam feature, the Spam Firewall 300 probably has it. Functionality includes keyword blocking, whitelists, internal and external blacklists, Bayesian filtering, subject and header filtering, and reverse DNS lookups, as well as content and URL fingerprinting.

The Spam Firewall has true Bayesian filtering, so the administrator must train and fine-tune the filtering engine between spam and nonspam e-mails. Barracuda recommends marking 200 messages as spam and nonspam to train the filter. Ironically, this was a bit of a problem in my tests because the Spam Firewall is so accurate in stopping spam for other reasons — attached viruses, bad domains, incomplete messages, sender time-outs, and so on — that it was tough to get enough real spam past the first stage of blocking and into the logging area to be marked as spam.

I tested the Spam Firewall 300 and 200 models for several months with tens of thousands of messages received. The population of spam e-mail to legitimate e-mail ranged from 30 percent to 60 percent during the testing period.

The result? Only a few legitimate spam messages got by and fewer than a handful of false positives were tagged. The few legitimate spam messages that did get through the Spam Firewall were correctly marked as possible spam. A few false positives came up as possible spam, but in my small-site setup, only two messages out of tens of thousands were marked as definite spam when they were not.

To tag and route potential spam, the Spam Firewall administrator sets rating thresholds for scanned messages and determines which scores result in blocking a message versus quarantining it. Ratings are determined by noting common spam characteristics and generating an overall score for each message; a rating of 0 means the message is not spam.

Many anti-spam products have a similar ranking system, but I’ve always had to tweak and fine-tune them for weeks to optimize accuracy. The Spam Firewall is very accurate out of the box — at most, administrators may need to add a few legitimate bulk e-mail senders to a whitelist.

The Spam Firewall allows its major functionalities — anti-spam, anti-virus, quarantining, and notification — to be set for a global community or per user. The latter is useful if administrators want end-users to maintain their own personal whitelists. Administrators can set up their own blacklists or use predefined common blacklists; Barracuda Networks also offers its own custom blacklist.

As another layer of security, LDAP communications can be enabled for Microsoft Exchange servers to verify recipients if a spammer is mining for potential victims.

Other notable features include RFC 821 compliance, rate controls, and attachment filtering. Administrators can even block or quarantine password-protected archive files, such as PKZipped files, which comes in handy with some of the latest e-mail worms.

Updates are frequent; during my trial period, operational firmware updates were sent at least once per week if not several times per week — yes, some were bug fixes. But administrators can choose when to download new code and run updates. Anti-virus and spam definitions are separate from the firmware updates and can automatically update hourly or daily depending on your preference. The Spam Firewall even has a handy roll-back feature in case the new firmware or definitions cause problems.

Three spots to mend

Barracuda has created an impressive spam fighter, but the appliance does have three moderate weaknesses.

The first is Barracuda’s lack of detailed documentation. The Spam Firewall is packed with good features, but unless the user is already familiar with a particular feature, it may take a call to tech support to figure out exactly what it does. 

A related complaint is that the Barracuda Networks’ Web site is devoid of any useful tech support information, often requiring a call or e-mail to tech support for basic configuration help when a decent online FAQ or configuration document would suffice. On a good note, Barracuda says a thick PDF configuration document is on its way.

The second deficiency is that the Spam Firewall has only one summary report that’s sent by e-mail to the administrator. It would be nice to see increased reporting functionality with five to 10 canned reports, with the data sorted more ways and with differing levels of detail.

Third, vendor support was spotty early on but appears to be getting stronger. Early e-mails and calls to tech support, even in the worst weeks, were returned the same day, but in the past few months, phone calls and e-mails have been answered or returned promptly, so I assume the early poor performance was due to the growing pains of an up-and-coming company.

The Barracuda Spam Firewall comes in a few different versions — models 200, 300, and 400 — depending on how much processing power and storage space you need. For example, the Spam Firewall 300 supports as many as 2,000 active users and 4 million messages per day. Prices range from $1,199 for the 200 model to $3,999 for the top-end 400 model; these prices are cheap when compared with equivalent spam solutions.

I have reviewed dozens of different types of anti-spam products, and Barracuda’s Spam Firewall product line is among the best. It installs fairly easily with minimal instructions, and its default settings take care of the job right from the start. Its Bayesian filtering prowess results in a minimum of false positives.

For the price, the features and accuracy are a great value. If Barracuda Networks delivers on the promised documentation and keeps pushing toward good customer support, few companies will have to look elsewhere for a solution to their spam woes.