eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
If Alterpoint Inc.s DeviceAuthority Suite, Rendition Networks Inc.s TrueControl 3.0 and Tripwire Inc.s Tripwire for Network Devices 3.0 are any indication, the latest wave of tools for managing network device configuration will help IT managers cut operational costs and smooth audits to meet security requirements.
Click here to read the full review of AlterPoints DeviceAuthority Suite.
2
If Alterpoint Inc.s DeviceAuthority Suite, Rendition Networks Inc.s TrueControl 3.0 and Tripwire Inc.s Tripwire for Network Devices 3.0 are any indication, the latest wave of tools for managing network device configuration will help IT managers cut operational costs and smooth audits to meet security requirements.
eWEEK Labs tests showed that each of these products will more effectively manage a multivendor network than would a collection of single-vendor management tools. As recently as last year, vendor tools such as Cisco Systems Inc.s Cisco Works provided greater configuration control than any of the products in this review. But this is no longer the case.
The three software-based tools we tested use ordinary network protocols, including Trivial File Transport Protocol, to retrieve a copy of the current configuration of network devices, including routers, switches, firewalls, VPN concentrators and load balancers. The major appeal of these products is that they can corral many brands and types of products into one administrative console. In our tests, we found some platforms that werent supported by any of the tools, such as a WatchGuard Technologies Inc. Firebox V80 firewall. Nevertheless, all three packages made it easy to request support for an unlisted product.
All three products support a wide range of Cisco network equipment, but support for non-Cisco gear isnt as comprehensive.
Configuration management tools should be judged on three features: real-time configuration tracking, logging when changes were made and by whom, and integration with authentication systems.
Its also worth noting that any of these network management tools could assist IT managers who must provide records to security auditors checking for compliance with the rules of the Sarbanes-Oxley Act of 2002 regarding verifiable change process and control. This is because all three tools we tested can integrate with authentication, authorization and accounting services running on Remote Authentication Dial-In User service or TACACS+ servers.
Each product has different feature strengths. We liked Tripwire TND 3.0s (see review) ability to create a base-line configuration that allowed us to revert to an approved setting, regardless of the number of changes we made. The other products made us step back to the last good configuration.
Hierarchical device assignment capabilities made TrueControl (see review) the most flexible of the products in terms of setting up administrative groups, but we think the company made fundamentally clumsy choices about user interface development that will make this product more difficult to use than other network configuration tools.
TrueControls tedious rules, actions and node definitions made it the hardest to learn and the hardest to use of all the products we tested.
In addition, as much as we admire TrueControls policy assurance manager and patch features, we cant see why the product costs double the other products: $19,995 to manage 50 nodes. AlterPoints DeviceAuthority Suite starts at $19,950 for 100 devices, and Tripwires TND 3.0 costs $19,900 for 100 devices. DeviceAuthority Suite and TrueControl 3.0 shipped last month; Tripwire shipped this month.
DeviceAuthority Suite
DeviceAuthority Suite had the greatest number of changes—for the better—of the configuration tools we analyzed.
The previous version of the product, what is now called the Audit module, is still available as a separate product, priced at $5,000 for 50 licenses. The completely new Update Module in DeviceAuthority includes a wizard-based update template to define how and when changes should occur, a script recorder, a change management workflow process and new search capabilities.
Taken as a whole, Update Module should significantly improve IT staff efficiency over the previous version of the product.
DeviceAuthority Suite included the most automation tools of the products we tested, making it a strong choice for IT managers with many junior administrators.
We used DeviceAuthority Suites INE (Integrated Network Environment), which is a fancy way of saying that AlterPoint included a Telnet client along with scripting and job- scheduling tools. The INE is a very handy addition to DeviceAuthority Suite and gives an edge among the products we tested when it comes to combining commonly used administrator tools.
However, to utilize all the features of DeviceAuthority Suite fully, administrators will have to invest quite a bit of time, and this finicky demand for intricate setup is the chief drawback of the product. For example, we spent several hours configuring our installation of the product to integrate with log servers so that configuration alerts would work correctly. Once we got the feature functioning, though, it worked well enough in tests to warrant the extra setup time.
When we made changes to our Cisco 1700-series routers, DeviceAuthority picked up on the log activity in our log server and automatically queried the device for configuration changes and made note of the authenticated user who made the change. In the previous version of DeviceAuthority Suite, devices were queried on a scheduled basis, so changes could go unnoticed for a relatively long time.
A key advantage revealed in our tests is that configuration changes made by specific users didnt require the operator to go through DeviceAuthority Suites console.
Although DeviceAuthority Suite is a stickler for detail, it lacks the ability to ensure conformance with corporate policy. Company officials said such a policy-based feature was under consideration for a future version of the product.
Senior Analyst Cameron Sturdevant can be reached at cameron_sturdevant@ziffdavis.com.