Current Filter: Network>>>>>Review>

   

The M440 is very different to standard security appliances as it's designed to make light work of segmenting enterprise networks and enforcing custom policies on each one. IT does away with the need to add extra network switches and complex VLANs for segmentation duties as it's packed to the gills with network ports. Along with 25 copper Gigabit ports, it comes as standard with a pair of high-speed 10-Gigabit SFP+ ports.

The M440 won't be beaten for features as along with a standard SPI firewall, IPsec and SSL VPNs plus HTTPS inspection, an NGFW subscription enables IPS and application controls. Go for the full Security Suite and you get web content filtering, gateway anti-virus, anti-spam and WatchGuard's reputation enabled defence.

There's more, as WatchGuard offers its optional advanced persistent threat (APT) blocker and data leak prevention (DLP) services. APT scans inbound files, it computes MD5 hashes and then checks them with the LastLine cloud service to see if they can be identified as known malware.

The DLP service uses the appliance's HTTP, FTP and SMTP proxies to check traffic for specific keywords and either drops connections, strips the keywords out of emails or quarantines the entire message. WatchGuard includes predefined sensors for HIPPA and PCI, but we found it simple to create our own custom sensors.

Even wireless networks come under the M440's remit as it functions as a central management controller for WatchGuard's own APs and provides PoE services on the centre group of eight Gigabit ports. After pairing a WatchGuard AP200 with the appliance, we were able to deploy secure SSIDs and apply custom security policies to wireless traffic on the port the AP was connected to.

It's no slouch in the performance stakes either, touting high throughputs of 6.7Gbits/sec for its firewall and an impressive 1.6Gbits/sec with all UTM features enabled. The M440 delivers on its promises: the lab's Ixia Xcellon Ultra-NP network load modules confirmed 2.2Gbits/sec with gateway AV activated in our policy and a perfect 1.6Gbits/sec with both IPS and AV enabled.

A quick start wizard simplifies deployment and defaults to the mixed routing mode which defines all ports as separate interfaces, each with their own IP address. Only the first two are enabled by the wizard, but it was easy for us to define the remainder as external, trusted, optional, or custom interfaces, and provide DHCP services on specific trusted ports.

Proxies are used extensively for security services and WatchGuard includes those required for HTTP, HTTPS, FTP, SIP, H.323, POP3 and SMTP. Firewall rules enforce security policies where they apply defined proxy actions on selected network ports. WatchGuard uses its WebBlocker service for web content filtering and HTTP actions can be used to apply blocking manoeuvres on any of the 130 URL categories provided. For anti-spam, we created a policy for the POP3 proxy where we used the spamBlocker service to tag messages classed as spam, suspect and bulk.

The M440 is application aware and uses policies to control access to hundreds of apps with eleven entries for FaceBook alone. Linking up the M440 with Active Directory authentication allowed us to control precisely what, if any, social networking activities our users were allowed to indulge in.

With the hardware and a full 3-year Security Suite subscription costing less than £8,500, the Firebox M440 represents remarkable value. The powerful combination of extensive security measures, high port count and an integral wireless controller makes the M440 one of the most versatile and affordable enterprise security appliances on the market today. NC

Product: Firebox M440
Supplier: WatchGuard
Tel: +44 (0) 203 608 9070
Web site: www.watchguard.com
Price: Appliance and 3-year Security Suite: £8,449 excluding VAT