- 18 Hot IT Certifications for 2014
- CIOs Opting for IT Contractors Over Hiring Full-Time Staff
- 12 Best Free iOS 7 Holiday Shopping Apps
- For CMOs Big Data Can Lead to Big Profits
Network World - If you run a small business, you have a lot of choices to protect your network. You can buy a consumer-grade router for less than $50, you can spend more than $4,000 for an enterprise firewall, or you can select something in between.
That’s where unified threat management (UTM) products fit. UTMs integrate five basic security features: firewall, IDS/IPS, anti-virus/anti-spam, VPN and outbound content filtering to prevent phishing and browser-based attacks. UTMs offer easy setup and they can support a 25-person small business for an average of around $1,500.
We tested eight devices: Check Point Software's 640, Dell/SonicWall's NSA 250MW, Cyberoam CR35iNG (which is now a separate company from Elitecore Technologies), Fortinet's FortiGate-100D, Juniper Networks' SRX220H-POE, Kerio Technologies' Control 1100, Sophos/Astaro's UTM 220, and WatchGuard Technolgies' XTM 330.
Here are our top-line findings:
Pricing and buying your UTM
The hardest part about choosing the right UTM box is figuring out its overall cost. Each vendor offers dozens of different sized boxes with a dizzying array of choices, licensing options and features. We asked each vendor to send us a typical box that might be used by a 25-person office, and some sent boxes with built-in or separately managed wireless access points.
Each box has a series of features that are separately licensed and a support contract is also purchased, typically for a year at a time. This means that getting a bottom-line price can be a chore. The range of prices for the first year of service on the units tested were $900 for Check Point to $2,900 for Fortinet.
The summary table below shows which additional features each product has, the number of different ports, scanners and filters are available, and which type of VPNs are supported by each box. (Watch a slideshow version of this test.)
Here are the individual reviews:
Our winner is the Check Point 640. It was extremely easy to setup, had wizards that offered simple choices and defaults that just required a few buttons to click on before the box was up and running. And it was also the least expensive.
By default, it enables all of its ports on a single LAN switch, and you can set up multiple SSIDs for the wireless interface with just a single policy selection, which is the easiest of any of the boxes we tested.
One of the things that we liked is that Check Point has designed this box for the SMB market by navigating a nice balance between ease of use and yet still including powerful security features. In fact, the same software that runs on its enterprise UTMs is also running on the 640.
Unlike Juniper, Check Point doesn’t hide its advanced settings in a command-line interface. Instead, everything is accessible from the Web interface, which has the best-looking and clearest menus of any of the boxes we used. You can quickly view the active computers connected to the box, change the URL blocking dialog messages that pop up when your users try to surf to inappropriate sites, add protocols to the anti-virus scanner, and other commonly selected options.
If you need extra features, such as setting up a failover link to an ADSL modem or changing the priority of a particular security policy, it isn’t all that hard to find the right menu option to accomplish your task.
Like more advanced UTMs, you can do quick on-screen packet captures for particular interfaces, or create file-based Pcaps too.
The biggest downside for the Check Point is a serious firmware bug that prevented its wireless radio from being controlled properly. This was a function of a pre-release version that we were given for the test and was eventually resolved. Another issue: while the menus are clearly presented, there are some context changes on the left hand menu when you choose top menu tabs that can be somewhat annoying. Finally, while Check Point promises to have cloud-based tools to automate firmware downloads, upload logs and handle remote unit management, this wasn’t yet available in our test unit.