NetScreen's Global Pro 3

Revamped management suite offers simultaneous control of NetScreen security gear.

By Joel Synder
Network World, 01/07/02

NetScreen's revamped Global Pro 3.0 management suite gives network professionals a way to simultaneously manage a network of NetScreen firewalls. While our tests show NetScreen hasn't exactly hit a home run with this product, the company has managed to load the bases with some serious firewall and VPN management and configuration tools.

Released in November, Global Pro 3.0 takes network executives out of the tedious position of managing individual firewalls, and moves them into the realm of policy-based security management.

Before now, NetScreen had fallen behind competitors including Check Point Software, Avaya, and Nokia because it didn't offer centralized policy-based configuration.

Global Pro 3.0 comes in two flavors. The Express version, which we evaluated, can manage up to 100 devices. This version lacks some of the aggregate reporting tools available in the higher-end full version, which scales up to 10,000 devices, sports an Oracle database back-end and offers some fault tolerance.

How we did it
Scorecard and Net Results

For the Global Pro Express 3.0, you get quite a bit of management machinery for $6,000. It comes standard on a dedicated Sun server with a 500-MHz Sun Netra T1 processor with 512M bytes of RAM. To install, hook up a terminal and give it an IP address. The management server comes prebuilt with a firewall and can be placed anywhere inside your network.

Management is controlled from any Windows NT 4.0 or Windows 2000 system. The Management Server has a small Web server installed, largely to feed Windows the Java-based management graphical user interface (GUI) that communicates with the management server. We drove the GUI from a dual 650-MHz Win 2000 system with 512M bytes of RAM. Things weren't intolerably slow, but with that much hardware underneath the hood, it should have provided a better showing.

When we started to dump firewalls into the management system, there was no way to import the current configuration from an existing firewall. Existing NetScreen customers with complex configurations might find this aggravating.

Security policies are key to Global Pro 3.0. There are 13 types of security policies, ranging from the prosaic (such as where to send SYSLOG messages) to the critical (such as what traffic gets in and what traffic does not). Policies are defined using a simple interface and then applied to as many firewalls or firewall groups as you'd like.

We defined a policy listing all our corporate mail servers and stating that the Internet could connect to our corporate mail servers, but only for the purpose of sending us mail. The policy also let the mail servers send mail out to the Internet. Once the policy was defined, we used the policy editor to add the relevant firewall groups to it, pushed changes, and we were done.

The beautiful thing about NetScreen's policy-based management is that if a new firewall was added into one of the groups already attached to the policy, Global Pro 3.0 would automatically build a policy for that firewall that includes all the policies for that group. The same thing is true of changes to the policy. If a new mail server was added, all it would have taken is a push to all firewalls to make them aware of the change in policy.

VPN configuration a dream

One of the areas where Global Pro 3.0 really steps up to the plate is in building large VPNs. To build a mesh or hub-and-spoke VPN, select all of the protected networks, add them into the VPN, specify Internet Key Exchange and IP Security policies, and you're done. Global Pro 3.0 already knows which gateways protect which networks based on the configuration information provided when the firewall was installed, and downloads appropriate policies to each one.

We built VPNs not only between NetScreen firewalls, but also among third-party gateways (see 'How we did it'). The connection was easy to do, something we found difficult for many vendors in our last VPN review.

Because Global Pro 3.0 doesn't do anything that the NetScreen firewall can't do, there are no new capabilities in the VPN (or firewall) side of the house.But some things are omitted. For example, NetScreen VPNs can do bandwidth management through a tunnel, but this has been left out of the Global Pro 3.0 VPN configuration.

Enterprise readiness

Features like real-time monitoring and alerting are built into the product, as is a powerful set of delegated management functions. With the ability to partition the management function across multiple servers, NetScreen's architecture looks as if it can scale to thousands of firewalls.

Because monitoring was a feature of NetScreen's earlier management console, that feature has been brought forward largely unchanged into this new Global Pro 3.0 deployment. The links between the configuration tool and the monitoring tool are a little weak, requiring some active export and import functions to move information between the two parts of the product.

Global Pro 3.0 could go a lot further in showing the big picture of your network. Global Pro 3.0 has a summary report that gives you a partial view of the enterprise firewall configuration, but the report was not as complete as we wanted.

There are other problems that may raise issues in large deployments. For example, when you change policy, it can affect a number of firewalls. But there is no way to tell which firewalls need to have the policy pushed to them. Your alternatives are to guess (and hope you catch all the ones with changes) or just to push to everything - which could take a long time if you have hundreds of firewalls.

There are some inconsistencies in what can be done with policies. You can define DNS servers, but not Network Time Protocol (NTP) servers.To set up NTP, you have to go to the Web-based configuration on each device.

NetScreen clearly has some work to do on Global Pro. Still, it's an outstanding first effort and NetScreen clearly has strong insight into the way network executives want to handle policy-based security management.

NetScreen Global Pro Express v3.0
3.65 Rating	Company: NetScreen www.netscreen.com Cost: Price as tested: $6,000 (25 devices). Pros: Outstanding architectural base. Preinstalled and preconfigured management platform to simplify implementation and reduce ongoing operations tasks. Handles firewall and VPN tasks from a policy point of view. Cons: Centralized configuration not available for all tasks. Bugs and inconsistencies in the configuration and documentation areas need work. Usability and performance could be better.

	NetScreen Global Pro Express v3.0
Enterprise-quality config. 30%	4
Ease of use/documentation 25%	3.5
Scalability 20%	4
Management 15%	3.5
Performance 10%	2.5
TOTAL SCORE	3.65

Individual category scores are based on a scale of 1 to 5. Percentages are the weight given each category in determining the total score. Scoring Key: 5: Exceptional showing in this category. Defines the standard of excellence; 4: Very good showing. Although there may be room for improvement, this product was much better than the average; 3: Average showing in this category. Product was neither especially good nor exceptionally bad; 2: Below average. Lacked some features or lower performance than other products or than expected; 1: Consistently subpar, or lacking features being reviewed.