Selecting UTM firewalls in an enterprise environment is more work than just picking a standard firewall, because the "UTM" moniker doesn't offer much information about what the firewall actually does. When evaluating enterprise UTM firewalls, there are four key issues to consider: performance, UTM feature set, network integration and management. Many of these overlap traditional firewall requirements but must be considered in the light of specific needs for very high-reliability, high-performance, enterprise-class products.

Performance is the key starting point for UTM firewalls, because the UTM features exact such a heavy performance cost. Without accepted metrics on how to measure UTM firewall performance, network managers are left to determine how fast a UTM device will go by turning it on and putting it in the middle of their network. No matter what you do, don't skip this step or some reasonable approximation in a test lab. The performance of UTM devices is very dependent on exact configuration and traffic flows, and without some testing, you could easily end up with a device that can't handle the loads you throw at it.

UTM firewalls that let you scale up without a forklift upgrade, either by upgrading in the chassis or by adding systems in an active/active load balancing configuration, are especially attractive when the performance card is on the table. But it's better to start with a system that can run as fast as you need the day you turn it on, and save upgrading for another year.

UTM features are near the top of the list for selection criteria. The idea seems simple enough: If you want antivirus, it should do antivirus. But within UTM firewalls, there's considerable variation in how a simple feature such as antivirus is implemented. For example, not every firewall can examine every protocol for virus signatures, and even those that do cover the top protocols can't always be configured to work on non-standard ports. One firewall we tested only looks for viruses in certain defined Multi-purpose Internet Mail Extensions types as a way to keep performance peak, opening the potential for future exploits to slip directly past. A critical exercise before buying is understanding exactly what coverage is included and how that coverage relates to your own traffic patterns and requirements.