Bake-Off: Unified Threat Management Appliances

The Astaro Security Gateway 110/120 Version 7 arrives with the most security management features of all the products we reviewed. Solution providers will find Astaro's Gateway appliance the most flexible to use in most network environments, simply due to its many options and configurations available for each of its network and security features. However, many SMB networks probably won't use most of them.

Astaro's Security Gateway is designed to scale up from small offices all the way to an enterprise. Solution providers servicing large customers can get the security gateway software and install it on Intel-based servers or place it into a virtual appliance running VMware. The appliance's features are GUI-based, so small solution providers do not have to be security or command line experts to run it. However, the appliance comes with an SSH interface for those that want to use the command line.

Astaro's dashboard interface is structured quite well. When logging in for the first time, solution providers can check when the last software revision was updated. Astaro's update service requires constant access to the appliance so that critical software, such as virus signatures and intrusion-protection patterns, are updated quickly. The appliance informs administrators if rebooting is required, and updates software automatically or manually if Internet access is sporadic. Setting up the appliance takes about 10 steps.

However, the submenus provide many details that aren't always easy to follow. Some menus require in-depth knowledge of complex networking setups. CMP Channel engineers highly recommend reading the appliance's administration guide. By contrast, some steps, such as VPN-site-to-VPN-site connectivity rules are handled automatically. Solution providers do have to wrestle with packet rules and figure out the protocols. Some higher-level interfaces, such as Web security, are extremely useful and do not require following submenus. Solution providers can check a customer's top domains, active users and traffic, and even determine which user is hogging network bandwidth.

As solution providers start enabling modules, they have to follow different rule sequences. They also can create definitions on the fly. The rest of the setup process is similar to eSoft's and SonicWall's. The Web admin GUI is highly configurable, so solution providers will find Astaro ideal when administering remote sites. The gateway appliance provides user authentication or can attach to external services such as VeriSign.

A good feature is the automatic backup. After creating a backup of its configuration, the appliance can send the file via encrypted e-mail off-site. In case of a successful zero day attack, backup configurations allow solution providers to get up and running in minutes.

Unlike some of its competitors, the appliance provides remote access clients for IPSec and SSL VPN. In addition, end users can go in and manage their e-mail by creating white lists and marking off incorrectly marked e-mails.

The appliance's networking interfaces are just as comprehensive as its security features. Solution providers can set up IP schemes, bridging/routing, link aggregations, DHCP, network address translations and DMZs. Everything that's created on any interface is off until an administrator allows it. Link aggregation groups can eliminate redundant NIC connections.

Solution providers don't have to be experts when activating the appliance's security features. The Astaro appliance provides simple steps when starting intrusion-detection and Web-filtering modules. Astaro provides a list of commonly used environments and applications that can be activated based on actual applications running on a network. Many of the protection measures that are installed on the appliance are based on rules.

Solution providers can change internal logos, disclaimers and various other text messages and can do the same for Web and e-mail proxies. They can also put HTTP and HTTP proxies, so that users can get custom messages.

Astaro's licensing model is channel-friendly. Solution providers have full control at all times over features that are activated through the appliance. Astaro arrives with SNMP services to manage multiple gateway boxes. The appliance supports high-availability and load-balancing configurations from two to 10 active appliances connected together.

The base license covers all of the network functionality, such as firewalls, intrusion protection, VPN gateway, services for proxies and services for VoIP. The appliance comes with a special license for hot standby clustering.

Additional licenses activate Web-content filtering, antivirus protection, antispyware and end-user profiles. Another license is for e-mail security, which provides protection for SPAM, adware or attachments. E-mail security works on SMTP and POP 3.

Next: ESoft InstaGate 604