Network Computingwww.networkcomputing.com

	Issue TOC Print full article Print this page Download as PDF E-Mail this URL Discuss this article Flame the author     In this article Introduction Testing App-Level Firewalls Secure Computing Corp. Check Point Software Technologies FireWall-1 NG FP3 Other Products Reviewed Executive Summary How We Tested Glossary & Web Links Report Card

OK, how many of you know that FireWall-1 NG has application proxies? Not many, I bet. Check Point has been putting in application proxies--Security Servers in Check Point parlance--since version 4.0. We found a huge difference in HTTP performance when Security Servers were active as compared with performance when they were inactive. HTTP performance took a dive when we enabled application scanning, highlighting what we knew all along: Application filtering is much more resource-intensive than stateful packet filtering. However, the price is worth paying because the protection you get with application proxies is much better.

The FireWall-1 management GUI still offers the same rule-based paradigm. It's clean and easy to use and the logging is better than what you'd find with most other firewalls in terms of detail. Symantec's Enterprise Firewall is one that provides more detail. If you want to blend application proxies with stateful packet filtering, FireWall-1 will provide good protection and performance.

Security Servers are added via the resource mechanism. In the resources area you can configure specific protection features, such as URL length for HTTP or MIME types for SMTP. Once the resource is configured, it is added to the rule base just like a regular service and you're done. The types of protection are configured in the SmartDefense dialog for the particular resource. Using HTTP as an example, the HTTP Security Server SmartDefense options are applied to all HTTP Security Servers or to one selected in the rule base. Here we could choose to enforce URL lengths and HTTP Header lengths as well as enforce the use of ASCII characters in the HTTP request and response headers. Because Web server buffer overflows tend to use long strings in header fields and/or pass non-ASCII data in the header, these two selections should block requests that are not HTTP-compliant.