AV's place is not in the all-in-one security box

Tests indicate antivirus is a UTM performance drain
  • (Network World)
  • — 14 November, 2007 11:05

There is no real agreement about whether antivirus software is required in or even a good idea for an enterprise-class firewall.

Some consider antivirus software protection irrelevant in a unified threat management (UTM) firewall deployment, because a desktop antivirus application and an e-mail security appliance are doing a good job scanning for viruses. Others consider sitting inside the UTM a huge bonus, because they want every possible "defense-in-depth" feature to block viruses at other places on the network.

The former attitude proved the most defensible one based on our testing. Not only did we see incredible performance problems when antivirus scanning was included in the UTM mix, but we also found that these firewalls don't do a very good job of finding viruses in any event.

Most UTMs we tested can scan only for particular applications on known ports. We tested three applications (SMTP, FTP and HTTP) on four ports, and the nonstandard port wasn't seen by most products - SonicWall and WatchGuard were the exceptions, and the WatchGuard proxy can't scan FTP. Even if you run only known applications on known ports, our tests show that half of the firewalls will miss a significant number of viruses.

We ran into flawed implementations, and bugs and hidden features that were needed to make antivirus scanning work properly.

We started our testing knowing that most vendors feel that UTM-based antivirus scanning is useful in the small-to-midsize business sector, but not necessarily in gigabit-speed enterprise firewall deployments. Exactly where antivirus stops being useful is not clear.

We discovered quickly that few of these participating vendors take antivirus software seriously. Some don't even include it in their high-end boxes. For example, Juniper Networks' ISG-1000 makes you pick between virus and intrusion-prevention protection. The Cisco ASA5540 doesn't give you any antivirus-management options.

Some vendors do give antivirus a fighting chance, though. Secure Computing's Sidewinder gives network managers tight control of antivirus scanning parameters. For every rule that allows traffic through the firewall using the HTTP, FTP and SMTP protocols it supports, you can specify what to scan, and what Multi-purpose Internet Mail Extensions types to scan.

The Sidewinder got a perfect score in blocking all our FTP, SMTP and HTTP viruses. However, when we tried to send viruses through the firewall using a nonstandard HTTP port, the Sidewinder missed them all. That scanning comes at a moderate performance cost, though, with antivirus scanning dropping the throughput of the Sidewinder 2150D by about 50%.

Sidewinder fans might protest this as an unfair test, because we had to create an "un-Sidewinder-like" policy to allow traffic out on nonstandard ports. Maybe so, but the bottom line is that you can't cover all traffic with virus protection unless you know about it ahead of time.

When we tried to configure SMTP scanning, we discovered why Secure Computing added to its portfolio Ironmail, an antispam-antivirus messaging-security gateway. Although Sidewinder is sold as an appliance firewall, there are multiple dead ends, where the firewall ends and you're suddenly managing a Unix system. E-mail is one of those. If you want to scan e-mail for viruses, you have to configure Sendmail on the Sidewinder. You're limited in what direction you can scan e-mail. In addition, performance was miserable across SMTP, with the antivirus scanner taking 64 seconds to handle 20 e-mails.

Fortinet certainly knows how to set up antivirus scanning. Every rule passing traffic through the FortiGate 3600A firewall can call for a protection profile that enables antivirus scanning. In addition, the FortiGate box supports a wide number of protocols, adding messaging and Network News Transfer Protocol to standard mail (SMTP, POP, IMAP), Web and FTP protocols. FortiGate's logs were complete, and the performance was incredible, scanning at 500Mbps.

Unfortunately, the FortiGate 3600A initially caught only 60% of the viruses we sent through it. It also had an annoying configuration that had the box pass on virus-containing e-mail after it had stripped away the virus. Because most viruses are not attached to legitimate e-mails, sending through junk mail without a virus is no longer a best practice in enterprise e-mail management. We were disappointed there was no way just to tell a system to scan all traffic on all ports. If there's any product in this entire test that might be used for enterprise-speed antivirus scanning, FortiGate was it, except that you can't scan all traffic on all ports.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Joel Snyder

Network World
Comments are now closed.

Latest News Articles

Most Popular Articles

Follow Us

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Resources

Best Deals on GoodGearGuide

Compare & Save

Deals powered by WhistleOut
WhistleOut

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?