Deep Inspection Firewalls

Posted by Adrian Peters and Michael Jones on May 3, 2005

Tags: Check Point Software Technologies Firewall-1 Secure Platform,  CyberGuard Corp. TSP 7100 Security Appliance,  DataPower XS40 XML Security Gateway,  Fortinet FortiGate 3600,  Fortinet FortiGate-800 Antivirus Firewall version 2.8,  IDS,  IPS,  Ingate Systems' Ingate Firewall 1200,  Internet Security Systems Proventia M50 Integrated Security Appli-ance,  Juniper Networks NetScreen-ISG 2000,  NIDS,  NIPS,  Nokia's IP260/265,  Reactivity XML Secu-rity Gateway and Manager 2400 Series,  SQL injection,  Sarvega XML Guardian Gateway v5.0.2,  Secure Computing Corp. Sidewinder G2 Security Appliance Model 2150,  Secure Computing Sidewinder G2 and Symantec Corp. Symantec Gateway Security 5440 Appliance,  ServGate Technologies' Edge-Force M30,  SonicWall Pro 5060c with SonicOS 3.0 Enhanced 5060 ,  Symantec Corp. Symantec Gateway Security 5460,  Symantec Corp.'s Gateway Security 5420,  VPN,  WatchGuard Technologies' Firebox X2500,  Web Services,  Web filtering,  XML firewall,  XML security,  XML security gateway XML gateway,  and ZyXel's ZyWall 70,  anti-spam,  antivirus,  branch-office firewall,  centralized firewall management,  denial of service,  eep inspection,  heck Point Software Technologies' Check Point Express,  high-availability,  security,  stateful failover,  stateful filtering,  Access Control,  Data Protection,  Electronics,  Firewalls,  Managed Firewall and Intrusion Detection,  Network security appliances,  Other,  Security and Privacy,  Software and Web Development,  firewall

Channel: Data Protection, Other

Once we'd laid in a few cases of Red Bull, we put on our enterprise firewall admin hat and focused on answering these questions: How effective at stopping attacks are the new DI-capable firewalls, and what impact does DI have on performance? How robust is the failover component? What capabilities are provided for those who need to manage a large number of firewall rules? What audit, logging and troubleshooting capabilities can we expect? And finally, what do these bad boys cost?

Our invite list reads like a who's who in the enterprise firewall arena. However, after reviewing our testing criteria, only six top-level vendors were both qualified and willing to participate. We were pleased to welcome Check Point Software Technologies' Next Generation With Application Intelligence, CyberGuard Corp.'s TSP 7100 Security Appliance, Fortinet's FortiGate-3600 Antivirus Firewall 2.8, Juniper Networks' NetScreen-ISG 2000, Secure Computing's Sidewinder G2 and Symantec Corp.'s Symantec Gateway Security 5460 Appliance into our labs and consider these offerings squarely within the upper echelon of the enterprise firewall market.

3Com-TippingPoint, McAfee and the latest Gartner Group-anointed "visionary" of next-generation firewalls, iPolicy Networks, didn't have products that fulfilled our required feature set. Lucent Technologies sent us the wrong product and Nokia did not respond at all, while Cisco Systems, Crossbeam Systems, ISS, Nortel Networks, SonicWall and WatchGuard declined to participate.

The Testing

Deep inspection firewall features Click to Enlarge