Editor’s note: This is a summary of our testing of this product, for a full rundown of how it fared in our testing across 10 UTM categories, please see our full coverage.
The WatchGuard Firebox Peak X8500e is a 1U device with eight built-in 10/100/1000 Ethernet ports. As the high-end of a product line with over a dozen devices, the Peak X8500e is a high-performance appliance with impressive speed and an outstanding price — the lowest total cost of any of the devices we tested.
WatchGuard has divided its product line into three broad categories, Peak, Core and Edge. The Peak products, like the X8500e we tested, bring together WatchGuard’s proxy-firewall heritage with a number of performance optimizations. Our testing shows that performance isn’t a problem for the Firebox. However, we have some reservations about putting the Peak X8500e into an enterprise setting because of missing true central management and SMB focus of some features.
For example, in our testing, we set up the SMTP proxy provided with the Peak X8500e firewall, because that should have offered the greatest security. However, we couldn’t test with the SMTP proxy, because it doesn’t properly support the 2001 version of SMTP, which all modern mail servers use. This kind of rough edge might be acceptable in an SMB environment, but no enterprise e-mail manager would put up with that kind of restriction. To work around it, you have to turn off the SMTP proxy and lose some of the value of the WatchGuard firewall.
WatchGuard has always had the best firewall-monitoring tools available, and the current management suite continues this trend. You get better tools from WatchGuard to monitor what is happening on your firewall than with any other UTM vendor. Where these tools fall down is when it comes to configuration control and system management. The lack of true centralized management and the relatively chaotic nature of the management tools that do exist also raise questions as to the enterprise suitability of the product.
At the same time, WatchGuard includes a comprehensive set of configuration controls specifically aimed at making highly granular UTM policies. We had to double-check our work to be sure that we were actually scanning the traffic we wanted to scan, because of the large number of options and configurability. In comparison with other UTM firewalls, the WatchGuard proxies for applications such as HTTP have a very high degree of control of antivirus UTM features. What was disappointing, though, is how poorly the WatchGuard firewall performed when it came to blocking viruses.
Overall, our testing shows that WatchGuard has come a long way in some areas, such as performance, but still may not measure up to the needs of the enterprise network manager. Lack of flexibility in the area of NAT, dynamic routing and IPS configuration, inability to run high availability and dynamic routing at the same time, and a generally chaotic management toolkit will probably keep this version of the Peak software in the SMB/SME space.
