eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
The powerful Netscreen-500 firewall and VPN combination with a Gigabit fiber interface delivers exceptional high-bandwidth throughput, transferring data at almost 750M bps across the firewall and as fast as 243M bps with 168-bit Triple DES encryption through a site-to-site virtual private network tunnel in eWeek Labs tests.
In addition to great throughput, the new high-end appliance for ISPs (Internet service providers) and large enterprises that NetScreen Technologies Inc. started shipping this month features support for NAT (network address translation), which allows private IP addresses to be mapped to public IP addresses; tools to prevent denial-of-service attacks; support for multiple virtual LANs; and a well-designed Web-based interface.
Additionally, the NetScreen-500 supports Remote Authentication Dial-In User Service, known as RADIUS, and includes an integrated database for authenticating users seeking remote access. However, it does not authenticate remote users via Windows NT Domains.
The NetScreen-500 we tested had three Gigabit ports and lists for just under $39,500 but can be purchased with 10/100M-bps ports for less than $25,000 by sites that wish to upgrade later.
With only 750M-bps throughput across the firewall, the NetScreen appliance comes up a little short of the Gigabit throughput that Cisco Systems Inc. advertises for its new PIX 535 firewall, which runs around $50,000 depending on options. However, with additional hardware the PIX 535 can only manage 100M bps with Triple Data Encryption Standard encryption, according to Ciscos documentation, far below the maximum 243M-bps throughput we clocked when testing the NetScreen device.
Although the PIX falls short in encrypted performance and is not as easy to use as the NetScreen-500, sites with staff that has Cisco expertise should check out the Cisco product.
To test the NetScreen-500, we used Netcom Systems Inc.s SmartBits 2000 testing tool to generate traffic and test throughput, and we set up two small networks on either side of a pair of the NetScreen devices to test how well they handled virtual IP addresses and firewall security.
To measure maximum throughput without encryption, we hooked the SmartBits traffic generator to the trusted and untrusted ports on the NetScreen appliance. We set rules that would allow traffic from the IP addresses of the SmartBits machine to transverse the firewall in either direction. This test produced 750M-bps throughput. We believe this number is high because the test was conducted in a laboratory setting, NAT wasnt used, and traffic from only two IP addresses had to be processed, but the results were impressive nonetheless.
Tales from the encryption
To see how well the Netscreen-500 handled encrypted traffic, we connected two of the devices back-to-back through the untrusted ports of their firewalls. We added a VPN tunnel, setting up one of the NetScreen devices as a trusted peer of the other. We then used the SmartBits tool to generate traffic encrypted using several methods, including Single and Triple DES, SHA (Secure Hash Algorithm), and MD5 (Message Digest 5) authentication. All of those tests were run using Encapsulating Security Payload and a shared key.
Taking the average of five test runs that lasted from 1 second to 2 minutes, the runs using Triple DES with MD5 produced the best results, an average throughput of 243M bps. Using SHA, a more robust and secure authentication method with higher processing overhead, pulled the throughput down to 222M bps.
Much to our surprise, the results using Single DES and SHA (246M-bps throughput) were only slightly faster than with Triple DES using MD5. NetScreen officials told us that this is because the appliance has been optimized for Triple DES performance.
NetScreen
-500″>
NetScreen-500
|
USABILITY |
B |
|
CAPABILITY |
A |
|
PERFORMANCE |
A |
|
INTEROPERABILITY |
B |
|
MANAGEABILITY |
B |
NetScreen Technologies NetScreen-500 with Gigabit fiber interface is a solid firewall and VPN appliance that will be a good fit for shops needing greater performance than is possible through a 10/100M-bps interface. However, shops familiar with Cisco products should look at that companys comparable PIX 535 firewall.
SHORT-TERM BUSINESS IMPACT // The NetScreen-500 will let ISPs and large enterprises promptly increase their firewall and VPN throughput beyond the 10/100M-bps rate that is common today.
LONG-TERM BUSINESS IMPACT // A firewall with the ability to handle speeds faster than 700M bps and a VPN that can transfer data at close to 250M bps should satisfy most businesses for the foreseeable future.
Fast throughput through firewall and when handling encrypted data over a VPN; straightforward setup.
No NT Domain authentication of remote users.
NetScreen Technologies Inc., Sunnyvale, Calif.; (800)638-8296; www.netscreen.com