UTMs require routing for flexibility's sake

Dynamic routing is the kind of feature required of any UTM firewall as a means of providing deployment flexibility.

We tested the OSPF-routing capabilities of the UTM devices in order to simulate the kind of multiple-exit network (two Internet gateways) that might be common in a large network.

However, we do need to note that dynamic routing might also be useful on the inside of a multiple-zone firewall for a growing network as it picks up new subnets around the globe. VPNs, likewise, are perfect places for dynamic routing to be used. As a large VPN grows, the burden of managing the list of networks at each point in the VPN can be high, and dynamic routing combined with VPNs can help to maintain reachability information on what networks are connected without making every single device reconfigure its VPN each time the network changes. When VPNs are combined with dynamic routing, a tight integration among firewall policy, VPN rules and dynamic routing is required.

Two vendors stood out for making dynamic routing especially easy: Juniper, in both the ISG-1000 and the SSG-520, and Nokia, in the IP290 with Nokia's IPSO operating system and Check Point's VPN-1 firewall. While Juniper doesn't offer the full suite of routing capabilities available on its enterprise and carrier-class routers, the ScreenOS routing features in combination with its virtual routers within the firewall and easily manageable configurations will probably go way beyond what is needed in most UTM environments. Likewise, Nokia's IPSO platform has long had a very strong routing base, that supports clustering and a broad range of protocols .

To stress the extended features in both Juniper and Nokia dynamic routing, we also added a Border Gateway Protocol session to our test devices and made sure that we could control the propagation of routes between OSPF and BGP.

Cisco, traditionally a routing giant, fell down in our evaluation because its ASA platform doesn't include all of the brainpower of its IOS code base. Although Cisco is pushing EIGRP (it's proprietary and very popular dynamic-routing algorithm) routing into Version 8 of the ASA software (which was released after we had completed testing), the capabilities of the ASA 5540 we tested don't live up to Cisco's routing strengths.

We gave passing marks for dynamic routing to the Astaro, FortiGate, Secure Computing and SonicWall UTM firewalls. All had working dynamic-routing code that was easy to configure and debug. With he Secure Computing Sidewinder configuration, you have to drop out of the GUI and work at the command line. However, the underlying open source Quagga routing code looks and behaves in a way that will be familiar to Cisco IOS-trained network managers - a big plus.

IBM/ISS' Proventia MX5010 also ships with Quagga, but with three differences: Only OSPF is supported, the debugging features that make Quagga easy to manage are disabled, and, in our testing, the dynamic routing didn't come up immediately after being enabled. With a considerable amount of fiddling with firewall rules to allow the OSPF updates to be accepted by the firewall, we were eventually able to make OSPF work.

The weakest dynamic routing came from Check Point's Secure Platform (used on Check Point's own UTM-1 2050 and on Crossbeam's C25 hardware), which incorporates NextHop's dynamic-routing engine. While the engine worked great and is very advanced in its capabilities, Check Point's documentation, user interface and debugging capabilities make diving into dynamic routing an exercise in frustration. In addition, Check Point includes only dynamic routing in its Secure Platform Pro version of the Secure Platform operating system, which is licensed separately and at additional cost. If you want to use dynamic routing and Check Point firewalls, our advice is to stick with Nokia IPSO platforms, which include similar capabilities, a great user interface and debugging, cluster support, and no extra license fee.

We also had to give low marks to WatchGuard's Firebox X8500e, which has a configuration system similar to Check Point's. However, in our testing, dynamic routing is not allowed within a high-availability configuraton. Because we think that high availability will be integral to any enterprise firewall, whether UTM or not, this effectively means that WatchGuard doesn't support dynamic routing in the enterprise.

Read related articles:
Check Point UTM management falters; Cisco, Juniper gain
UTM and IPv6: Do they mix?
UTM performance takes a hit
Juniper, Cisco all-in-1 devices hit on intrusion-prevention
VPN capabilities vary widely across UTM firewall devices
Tracking UTM high availability
A closer look at UTM hardware architecture
Watts up with power consumption?
AV's place is not in the all-in-one security box

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Joel Snyder

Network World
Show Comments

Essentials

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?