Fast Security to Go

IT managers can choose among a fast-growing crop of capable Gigabit-speed firewall/VPN appliances that push the price and manageability envelope.

One thing that became clear during eWeek Labs tests of two products in this category is that, increasingly, "speeds and feeds," or the sheer ability of a firewall/virtual private network device to handle traffic, will be overshadowed by its device management and maintenance capabilities, especially to keep up with rapidly changing attacks on systems and networks.

In tests of firewall/VPN offerings, one from heretofore consumer player SonicWall Inc. and one from enterprise stalwart Nokia Corp., we found that each portends a future of further plummeting prices mixed with increasing performance.

Along with products such as Cisco Systems Inc.s PIX 535 and NetScreen Technologies Inc.s NetScreen 500, the SonicWall and Nokia devices we tested offer the capacity to connect thousands of users via secure VPN tunnels while handily ensuring that the organizations private network is protected from hackers.

The Nokia IP740 came out on top in this head-to-head review because of its superior ability to handle VPN client setup and management. However, the SonicWall GX650 was no slouch when it came to performance, providing as much as 260M bps of Triple DES (Data Encryption Standard) traffic using ASIC chips, far exceeding the roughly 21M bps of Triple DES throughput that we measured on the Nokia IP740. Nokia is decoding traffic in software, which is more flexible when it comes to correcting problems. Company officials also stated that encryption accelerator cards would be available within the next several months.

IT managers shouldnt place too much emphasis on raw performance numbers, however, because increased security almost always means a slowdown in performance. This is where firewall configuration becomes as much art as science.

Nokia, through the Firewall-1 software, provides an easy-to-use interface to build new rules to govern traffic access. IT managers should have skilled administrators craft these rules with a solid understanding of what employees need to access and without bogging down the firewall with redundant or pointless restrictions.

Nokia IP740

Nokia is set to release the IP740 later this month for $49,995. IT managers will also have to buy the appropriate Check Point Software Technologies Ltd.s FireWall-1 and VPN-1 licenses, which can add anywhere from 3 percent to 10 percent to the price, depending on the size of the installed base and the number of licenses needed.

Although this is a normal price for systems of this size (Ciscos PIX 535 is approximately $50,000), its considerably more expensive than SonicWalls aggressively priced $29,995 GX650.

When it comes to pricing deals, IT managers should also investigate hot-standby units, which, in the case of Nokia and SonicWall, cost half the retail price of the first unit.

For Nokia and SonicWall, we used two units connected back-to-back with small networks on either side to perform VPN throughput tests. We used single units for firewall performance tests. We generated one-way and bidirectional traffic using a Spirent Communications (Spirent is owned by Spirent plc.) SmartBits 600 chassis and SmartApplications Layer 3 traffic software.

The IP740 we tested had two single-port optical Gigabit Ethernet interfaces (which use Nokias nonstandard but much-easier-to-use RJ-45-like jack). The units have two additional card slots that can be configured with a variety of WAN interfaces as well as 10/100M-bps LAN ports, making the IP740 more versatile than the SonicWall, which has fewer WAN interfaces.

In tests, the biggest drawback of using the Nokia IP740 was that we had to master three user interfaces to configure the units. First was Nokias Ipso operating system to initiate the unit. We then used a combination of Check Points management interface and Nokias Voyager interface to set up access rules, VPN settings, routes and interfaces.

The Nokia Voyager interface was capable enough after we got used to searching through the long list of options. However, it is not intuitive and made it very awkward for us to effectively manage the systems. Typical of the "engineers-only" interface is that some options have to be turned on before fields for crucial information such as an interface IP address can be entered.

Once Nokias product was configured, we got good performance numbers (with relatively big packet sizes). Single, one-way flows exceeded 1G-bps throughput. When Network Address Translation was turned on, as is more typical in the real world, performance bogged down, which is to be expected.

SonicWall GX650

SonicWall, with its grounding in "keep it simple, stupid" consumer products and its Global Management System, was easier to use than the Nokia IP740. The SonicWall GX650, which shipped in late June, also clocked terrific performance in tests. We measured 1G-bps firewall throughput and nearly 260M bps with Triple DES VPN flows.

However, the VPN management system isnt nearly as developed as the firewall side, and this should be corrected before IT managers think about using the product as a central VPN device.

Using a beta version of the SmartBits WebSuite Internet performance measurement tool, we achieved 500,000 simultaneous connections. Based on the amount of memory in the appliance (256MB of RAM) and the amount of memory needed per security association, IT managers should be able to create up to 10,000 VPN tunnels.

Like the Nokia IP740, the SonicWall GX650 is equipped with a hot- swappable dual power supply. Both appliances are bulky—3U (5.25 inches) high—making them rack-space hogs.

SonicWalls Java-based management interface is logically laid out and easy to navigate. We quickly configured and managed access and filter rules to restrict access to our test network.

Its just as well that SonicWall makes its access and content filtering rules easy to manage: During tests, the built-in filtering system failed to screen out most racist and hatemongering Web sites. IT managers should skip the yearly subscription offered by SonicWall.