Bake-Off: Unified Threat Management Appliances

ESoft InstaGate 604
Solution providers servicing SMBs with UTM appliances need to have relevant information at their fingertips to make rapid decisions on incoming threats. To take action, the information needs to be comprehensive but easy to absorb. ESoft's InstaGate 604 UTM appliance does it quite well.

InstaGate's user interfaces are simple and clear, and do not overwhelm solution providers with too much detail. Like the other vendors in the review, the first pane shows a general status of the system and the network. ESoft calls this pane the ThreatMonitor.

ESoft has invested in firewall and intrusion-prevention technologies, as well as proxy-based tools, which is good for Web filtering and preventing virus attacks. In addition, InstaGate supports e-mail filtering.

All major security decisions are left up to the appliance. Solution providers only have to turn most settings on. At its core, InstaGate uses a bimodal scanning technique that takes advantage of both methods to scan data streams in the most efficient way it can, depending on traffic load.

Unlike its competitors, the InstaGate appliance comes with a hard drive, which can be used to store content or run third-party servers such as Exchange. This is a good feature for customers that don't have the resources to maintain multiple servers.

The e-mail filtering capabilities only provide the basic blocking mechanism. E-mail filtering settings, for instance, support regular expressions and a couple of other simple blocking features, including a file attachment filter that is based on file types. File attachments can be routed to eSoft for virus and spyware analysis.

The SpamFilter settings come with many options to block content. Solution providers need to understand many of the rules and feature settings that are part of an antispam solution. For instance, turning on a Bayesian self-teaching tool allows the appliance to identify the difference between spam and legitimate messages. The Bayesian tool uses its own internal scoring mechanism. However, solution providers can restrict the Bayesian tool from accessing certain IPs, which then forces them to maintain whitelists.

The appliance decides which type of scanning to perform based on the threat at hand and what settings have been turned on. The antivirus (AV) features are able to maintain network file flow automatically. In addition to network scanning, InstaGate's Gateway AV settings can scan e-mail SMTP ports.

Even though solution providers have fewer options when managing the AV and antispyware Gateway features, they can override the appliance from scanning major external ports. This option is useful when testing Web applications. Unfortunately, custom ports cannot be scanned. The AV Gateway only supports scanning exemptions based on IP.

InstaGate's Intrusion Prevention features reflect today's dynamic threats, which have many signatures and come from many sources. Therefore, Intrusion Prevention combines network, e-mail, Web and network settings into one pane. Solution providers can turn off a number of P2P and chat clients, set up IP boundaries to protect networks and servers, and add rules that aim to detect possible intrusions. The intrusion rules are based on predefined categories, such as Network Trojan Detected, Attempted Denial of Service, User Privilege Gain and Web Application Attack. Turning everything on is useful when figuring out what the appliance is able to detect.

InstaGate also supports VPN-to-VPN sites, PPTP VPN and remote user VPN through third-party VPN clients. What's more, the appliance supports SIP and VoIP RTP protocols. Solution providers are able to manage quality of service on VoIP, as well as many other network-protocol services.

InstaGate has a built-in router that can configure network settings for an entire organization. The appliance even supports fail-over for dual WAN connection types. Simple routing features are also available. InstaGate's alerts and reports are comprehensive. Solution providers are able to receive daily reports on just about every option that's turned on. Reports on quotas of all sizes and types can be marked as alerts.

Next: SonicWall TZ 180