NetScreen is ready for its close-up

NetScreen is expanding its firewall/VPN appliances to include application-layer inspection of traffic that is often allowed through traditional firewalls but that might contain malicious code anyway.

Called Deep Packet Inspection, this closer scrutiny comes as part of the next upgrade to its software called ScreenOS Version 5.0, due out in November and December.

Deep Packet Inspection looks for exploits trying to slip through as Web, e-mail and file transfers. Specifically, it can screen HTTP, SMTP, IMAP, POP, FTP and DNS traffic. The algorithms selected to carry out the screening were chosen because they generate few false positives, NetScreen says.

The idea behind the new software is to give branch offices more protection, on an existing platform, making it less of a burden than the addition of a separate device.

This may be the way to go for small companies with limited staff capable of keeping multiple platforms up and running or larger companies that have so many branch offices that they can’t afford to run separate intrusion detection and prevention gear at each remote location.

This is the direction customers should expect firewall/VPN vendors to head as firewall/VPN devices take on more functions and become security gateways.

To help manage this new capability, the company has overhauled its GlobalPro management system to support the creation of multiple security profiles for firewall, VPN and Deep Packet Inspection and to distribute those to the appropriate devices. The new management software is called NetScreen Security Manager 2004.

ScreenOS 5.0 will be available in November on five NetScreen appliance models: 5GT, 5XT, 25, 204 and 208. In December, it will be available on the company’s larger systems, models 500, 5200 and 5400.

The new software is a free upgrade for customers with service contracts. A service to update files of signatures for known threats is priced based on which device a customer has, starting with $75 per year for the 5GT. Generally, the service costs between 5% and 10% of the purchase price of the appliance.

NetScreen Security Manager 2004 is due out in December and is a free upgrade to current customers with service contracts.