Juniper Networks ISG-1000 Score: 4.38 Juniper Networks SSG-520M Score: 3.8

Editor’s note: This is a summary of our testing of this product, for a full rundown of how it fared in our testing across ten UTM categories, please see our full coverage.

The ISG-1000 is the oldest piece of hardware we tested, but that didn’t keep it from registering the highest score. As an ASIC-based firewall with additional coprocessors to handle the IPS end of things, the ISG-1000 combines Juniper’s enterprise-class firewall with its stand-alone IPS. A 3U chassis, it comes with four 10/100/1000 Ethernet ports and can be expanded with additional Ethernet ports through the two expansion slots.

Juniper offers both faster and slower firewalls, but the ISG series is the only one that can take the optional IPS coprocessor(s), and there is only one more model in the ISG series, the faster ISG-2000.

Alternatively, the SSG-520M is a 2U device, also with four 10/100/1000 Ethernet ports, but sports six slots and the ability to add both LAN and WAN interface cards. The SSG-520M uses Intel-based processors to power its way through different tasks and has a very different IPS engine. The SSG-520M is one of a series of security gateways that Juniper has introduced that can run either ScreenOS firewall software or JunOS routing software. The SSG-520M is near the top of the line (only the 540M is specified to be faster), but there are devices going down to the SOHO level in this series.

The SSG-520M and the ISG-1000 have very different IPSes. The ISG-1000 essentially takes Juniper’s stand-alone IPS and puts it as a blade within the ISG-1000 chassis. Although the IPS in the ISG-1000 does not have the same management toolkit as Juniper’s stand-alone IPS, the engine and signatures are the same, and this is reflected in the high catch rates we found in our testing.

The SSG-520M has what Juniper calls “Deep Inspection” (DI) IPS capabilities. Because the DI software in the SSG-520M also runs on much more limited systems, it is harder to configure and has fewer capabilities. The IPS features in the SSG do not scale well up to the enterprise environment — they are firmly rooted in a SOHO design mentality.

Both the ISG-1000 and the SSG-520M can be managed, like all Juniper firewalls, using the local Web-based GUI, a command-line interface, or the Netscreen Security Manager (NSM). NSM is a centralized management tool that includes policy and configuration control, log management, and VPN creation and management.