Juniper's ISG-1000, SSG-520M

The ISG-1000 is the oldest piece of hardware we tested, but that didn’t keep it from registering the highest score. The SSG-520M is a 2U device, also with four 10/100/1000 Ethernet ports, but sports six slots and the ability to add both LAN and WAN interface cards.

Juniper Networks ISG-1000 Score: 4.38 Juniper Networks SSG-520M Score: 3.8

Editor’s note: This is a summary of our testing of this product, for a full rundown of how it fared in our testing across ten UTM categories, please see our full coverage.

The ISG-1000 is the oldest piece of hardware we tested, but that didn’t keep it from registering the highest score. As an ASIC-based firewall with additional coprocessors to handle the IPS end of things, the ISG-1000 combines Juniper’s enterprise-class firewall with its stand-alone IPS. A 3U chassis, it comes with four 10/100/1000 Ethernet ports and can be expanded with additional Ethernet ports through the two expansion slots.

Juniper offers both faster and slower firewalls, but the ISG series is the only one that can take the optional IPS coprocessor(s), and there is only one more model in the ISG series, the faster ISG-2000.

Alternatively, the SSG-520M is a 2U device, also with four 10/100/1000 Ethernet ports, but sports six slots and the ability to add both LAN and WAN interface cards. The SSG-520M uses Intel-based processors to power its way through different tasks and has a very different IPS engine. The SSG-520M is one of a series of security gateways that Juniper has introduced that can run either ScreenOS firewall software or JunOS routing software. The SSG-520M is near the top of the line (only the 540M is specified to be faster), but there are devices going down to the SOHO level in this series.

The SSG-520M and the ISG-1000 have very different IPSes. The ISG-1000 essentially takes Juniper’s stand-alone IPS and puts it as a blade within the ISG-1000 chassis. Although the IPS in the ISG-1000 does not have the same management toolkit as Juniper’s stand-alone IPS, the engine and signatures are the same, and this is reflected in the high catch rates we found in our testing.

The SSG-520M has what Juniper calls “Deep Inspection” (DI) IPS capabilities. Because the DI software in the SSG-520M also runs on much more limited systems, it is harder to configure and has fewer capabilities. The IPS features in the SSG do not scale well up to the enterprise environment — they are firmly rooted in a SOHO design mentality.

Both the ISG-1000 and the SSG-520M can be managed, like all Juniper firewalls, using the local Web-based GUI, a command-line interface, or the Netscreen Security Manager (NSM). NSM is a centralized management tool that includes policy and configuration control, log management, and VPN creation and management. 

NSM challenges, but does not generally best, what we consider to be the premier firewall-management application, Check Point’s SmartCenter. However, we gave both Juniper firewalls higher scores than Check Point for management in this test, because of its control over the UTM features: Juniper takes management of the new UTM features we looked at, antivirus and IPS, much more seriously than Check Point does.

Overall, we found that the ISG-1000 was the best general-purpose firewall in our tests when we coupled it with IPS coverage. While other firewalls may have reached above it in specific areas, the ISG-1000 consistently rated a top performer in all categories but one: remote access VPN. The ISG-1000 does not, however, have antivirus capabilities.

The SSG-520M has a much weaker IPS feature set, but does have a fuller set of UTM features, including antivirus scanning.

If you like Juniper firewalls and management, you’ll want to use the ISG-1000 for any applications that has a requirement for raw speed and IPS. The SSG-520M, at about one-third the price, has more modest performance — though still 1Gbps or higher without UTM features turned on — and antivirus scanning, but not a production-quality IPS.