Barbedwire DP Inspector boasts an impressive security resume

Despite management shortcomings, the solution proves a one-stop shop for network security

How many network security functions can you stuff into one box? Barbedwire Technologies' DP Inspector appliances start with a firewall/IPS, VPN, anti-virus, anti-spam, and URL filtering, and allow you to add more services, including IDS and even Samba (Windows file services), via software upgrade modules.

Barbedwire's appliances not only offer convenient one-stop shopping for managers of small and midsize networks, the components are also solid and the price is quite nice. I tested the DPI 100, a 1U, rack-mountable Linux server with a VIA 733MHz processor and 128MB of RAM, preconfigured with the OS and a Web-based GUI for administering the different modules. The system has three 10/100Mbps Ethernet ports for the internal, external, and management interfaces.

Initial configuration is easy. Because the box is preconfigured with a default IP address, configuration via serial terminal is not necessary. Once the network configuration is accomplished through a wizard, you can begin setting up the various "Softblades," the software modules for anti-spam, anti-virus, firewall, VPN, and so forth. I was forced to call Barbedwire tech support for help in configuring the anti-spam module, a first in my last 15 tests of anti-spam gateways, but the support line was easy to reach and the tech was able to resolve my problems quickly.

The DPI 100 is the smallest of three models, which support 100, 500, and thousands of users. The box was able to maintain full, 100Mbps wire-rate speeds, on both internal and external connections simultaneously, while performing stateful packet inspection (basic firewall) alone. As you would expect, when I engaged additional security layers performance fell off to about 32Mbps when performing anti-spam and anti-virus inspection, in addition to serving 50Mbps of VPN connections. That's a mere fraction of 100Mbps, but that should be more than adequate for any small business. The other models, with Gigabit Ethernet connections, more memory, and faster processors should be able to handle even enterprise loads without problems.

The anti-virus and anti-spam engines, from Sophos and SpamAssassin respectively, were quite effective. All viruses and more than 93 percent of spam received during the test period were detected and stopped by the DPI 100. Anti-spam also achieved relatively low false-positive rates of 2.5 percent noncritical (that is, 2.5 percent of bulk mailings were incorrectly identified as spam) and 0.48 percent critical false positives (just six personal messages incorrectly identified as spam, out of more than 2,000 real messages). This was accomplished with the default anti-spam settings and without my adding senders to the whitelist. Tuning the whitelist would quickly reduce the false positive rate. Spam can either be identified as such in the subject head or quarantined on the appliance. Users can log into the appliance and release spam themselves or the administrator can restrict access.

The DPI 100 also offers a Web content filter from Cerberian that can also monitor employee Internet usage, reporting which URLs have been accessed and blocking access to specific sites if necessary.

The firewall is based on the open-source IPTables, which provides more-than-adequate security for most organizations, including protection from DoS attacks. Those who want the increased security can opt for a Check Point firewall at additional cost. The optional intrusion detection module adds protection against application-level attacks, Web server and CGI attacks, root kit exploits, SMB and NetBIOS queries, buffer overflows, and other threats that could slip by a firewall. Signatures for detecting these attacks are automatically updated along with the anti-spam and anti-virus signatures.

The DPI 100 supports all the standard VPN and authentication standards, and as many as 50 site-to-site IPSec VPN connections and 400 PPTP (point to point tunneling protocol) connections. Optional LAN/Wi-Fi user authentication adds an extra layer of security for open wireless networks. The appliance can also be deployed in an active/active or active/passive redundant configuration. Reporting functions are comprehensive and relatively easy to access. Oddly, the anti-spam reporting functions are under anti-spam, rather than with the rest of the reports.

In a small office environment, the DPI 100 could function as the sole server for a network, providing DNS services, Windows file server capability, and through an optional module, even an e-mail server and a Web server as well.

The DPI 100 is powerful and effective but not for beginners. The only configuration wizard available is for initial network configuration; configuring the firewall, anti-spam, and other modules involves following sometimes obscure directions in several different online manuals. There are many options available in some of the configuration forms that most users would not need -- even in the novice mode -- which can lead the user to change default settings that will render the box inoperable.

Aside from the relative complexity however, the DPI 100 offers a complete and effective Internet security suite at a very reasonable price with unlimited users for anti-spam and anti-virus. 

InfoWorld Scorecard
Setup (20.0%)
Manageability (20.0%)
Value (10.0%)
Performance (20.0%)
Flexibility (20.0%)
Scalability (10.0%)
Overall Score (100%)
Barbedwire DPI 100 7.0 8.0 10.0 9.0 9.0 8.0 8.4

Copyright © 2004 IDG Communications, Inc.