Taking one part stateful inspection firewall, one part intrusion prevention, and equal parts anti-virus, anti-spam, anti-spyware, and content filtering, UTM (Unified Threat Management) appliances blend traditionally separate security services into a single device, providing not only comprehensive protection against Internet-based threats but also streamlined access to policies and reporting.

Now, instead of jumping between separate security tools and management UIs, admins need only go to one place to manage and monitor these systems. Updates are scheduled and initiated from a single console, reports are viewed from one appliance, and policy is managed from one device.

By moving all of these security services into a single device, UTM appliances are supposed to reduce the admin’s workload; ease-of-use is one of the main selling points. A well-crafted UI can make short work of checking for signature updates, recent activity, and alerts. All of the solutions I tested provided “at a glance” monitoring and management, although some did it better than others. For the datacenter folks, all of the appliances can report back to all common reporting systems, including Syslog and SNMP tools, and all have their own branded central management tool.

A possible argument against UTM appliances is that security guys can no longer pick specific solutions for each defense; they have to use the UTM vendor’s bundled products. If, for example, the enterprise has standardized on CA’s anti-virus and anti-spyware products but wants another vendor’s firewall/VPN, there is no way to integrate the two systems into a common management platform.

For most, this argument is moot. The security services bundled together are typically “best of breed” services in their own right. For example, Astaro uses a combination of Kaspersky and open source signatures for virus protection, whereas WatchGuard and ServGate employ McAfee AV. I don’t believe any security administrator is going to stop using desktop anti-virus or anti-spyware protection and rely solely on the network edge device. UTM’s goal is to stop the threats before they can enter the network, with desktop protection as the last line of defense.

Take your places, please

For this round up of UTM solutions, we requested the model most suited for branch-office deployment. For us, that meant the smallest rack-mountable device that supports all core UTM features and can be managed centrally from the corporate datacenter. We ended up with a range of products from Astaro, Fortinet, ServGate, SonicWall, and WatchGuard, all 1U appliances and more than up to the task. Symantec, Secure Computing, and TippingPoint were invited but were not able to participate due to various scheduling conflicts. 

I ran each appliance through a series of test scenarios similar to what any protected office might experience. I placed each firewall in front of a Windows SBS (Small Business Server) 2003 server running Outlook Web Access, the standard SBS remote workplace portal, SMTP mail services (Exchange), and an FTP server. I created inbound policies designed to expose yet protect each service. I then tried to exploit these services using Core Impact from Core Security Technologies.

My penetration tests included a series of attacks using well-known and well-documented exploits for each service. I targeted the attacks against the exposed services, all of which attempted to either take the service offline (DoS) or run code on the server. Core Impact made these tests extremely easy to set up, but even more importantly, it allowed the same tests to be repeated for each UTM appliance. The results proved that each firewall was more than capable of preventing a direct attack, and not once was my targeted server interrupted. During each attack phase, I kept an eye on the firewall’s logs to monitor developments as the attack took place.

Click for larger view.

One other test was to stress the virus scanning capabilities of each UTM box. To do this, I copied a 160MB virus infected zip file from a “public” FTP server into my protected network from a Windows XP system using Internet Explorer as the FTP client. Only SonicWall and ServGate were capable of handling the file copy correctly without ignoring the virus in the file. I was amazed to find that not all UTM solutions can scan for viruses in all types of traffic in all situations. This is an area that many vendors need to work on.

Astaro Security Gateway 220

The Astaro Security Gateway 220 packs its UTM punch into a chassis loaded with eight 10/100Mbps Ethernet inter¬faces. The ASG 220 has a 40GB hard drive that is also used for Web caching and quarantining of spam and virus-infected objects. Setup and policy creation was not as straightforward as Fortinet’s or SonicWall’s but didn’t take more than an hour to complete. Astaro does, however, have one of the better built-in reporting engines.

Putting together the various inbound and outbound access rules takes a few extra clicks to complete, requiring the admin to create packet filter and dynamic NAT rules in order to allow valid inbound traffic. Other appliances, such as ServGate and SonicWall, take care of this extra step. Outbound policy can be defined different ways using the various proxies to mix and match users, hosts, and destinations along with content filters to provide just the right blend of threat management.