Tactical Advice

Security at the Gate

Fortinet serves up one UTM box to rule them all.
This story appears in the March 2009 issue of BizTech Magazine.

FortiGate 200A

Given the demand for spam filtering, firewalls, intrusion detection, antivirus and secure remote connectivity, something typically gets short shrift when resources are limited. Thus was born the idea of unified threat management.

A UTM device expands on the key features of a good firewall — the use of stateful packet inspection to examine traffic for malicious intent — by integrating the ability to perform:

  • on-the-fly antivirus and phishing protection;
  • spam and web filtering;
  • routing and virtual private network management.

The result is one box that rules all facets of a layered security approach.

Advantages

Fortinet created its UTM tool with a realization: If a device were to do all these things without melting down under the CPU load, it would need to run on a processor built specifically for the purpose. The FortiGate family is powered on application-specific integrated circuits to maximize performance and reduce cost.

For the core mission of firewall protection and intrusion prevention, the FortiGate UTM devices are highly effective. They feature stateful packet inspection and come preloaded with a large database of attack profiles. Fortinet updates the antivirus and intrusion attack profiles through a subscription service on a push basis, as opposed to the more typical client pull method, which allows the company to get new attack profiles into the field quickly and makes its units responsive to zero-day attacks.

Why It Works for IT

All Fortinet products run the FortiOS, currently in Version 3.0, and all share a common command line and web administration syntax. The web administration tool is attractive, simply constructed and consistent in performance. Web administration can be handled through HTTP or HTTPS over either internal or external interfaces. External web administration is disabled by default, and the device accepts only the Secure Shell protocol out of the box.

For text-oriented users, the FortiGate devices can be configured on the command line through the console, SSH or web browser.

Web filtering services are also highly configurable. Users can define URL allow/deny lists by hand, by keyword content blocking or by using the Fortinet subscription web-filtering service to restrict by content category or service type (such as peer-to-peer file sharing, streaming media or chat). Exception lists can also be created with Server Message Block authentication or manual lists.

The FortiGate 200A is rated for 150 megabit-per-second firewall throughput and 70Mbps VPN throughput. It can support 200 dedicated VPN tunnels and 400,000 concurrent sessions and can create or tear down 4,000 sessions per second. The firewall can handle 2,000 policy rules.

Inbound/outbound file scanning, limited to 10 megabytes by default, can be increased to 50MB. Be sure to review the default setting during install because larger files will be allowed through without inspection.

The system’s broad-based configurability also exists in its antispam feature. Administrators can manually block by regular expressions, by domain allow/deny or by using the subscription spam filter.

 

Disadvantages

The spam filter is probably the weakest feature. In real-world use, the device reduced spam levels by between 40 percent and 55 percent.

Additionally, the web interface has a fairly steep learning curve. This is pretty common, however, in UTM hardware because of the broad feature set and high degree of configurability of these products.

Although the FortiGate appliance functions well as a firewall/VPN solution out of the box, you will need to sign up for the subscription service to receive attack signature updates and web- and spam-filtering services. But Fortinet’s subscriptions are well priced, which plays a part in the value proposition of its products.

CDW Price: $4,425.99

Connor W. Anderson is vice president of Riverfront Technology in Clinton, Iowa.
Sign up for our e-newsletter

Security

Why Cloud Security Is More E... |
Cloud protection services enable companies to keep up with security threats while...
Securing the Internet of Thi... |
As excitement around the connected-device future grows, technology vendors seek ways to...
Tools to Maintain Mobile Sec... |
Far-flung devices pose serious challenges, but a variety of technologies can help protect...

Storage

The New Backup Utility Proce... |
Just getting used to the Windows 8 workflow? Prepare for a change.
How to Perform Traditional W... |
With previous versions going unused, Microsoft radically reimagined the backup utility in...
5 Easy Ways to Build a Bette... |
While large enterprises have the resources of an entire IT department behind them, these...

Infrastructure Optimization

Why Cloud Security Is More E... |
Cloud protection services enable companies to keep up with security threats while...
Ensure Uptime Is in Your Dat... |
Power and cooling solutions support disaster recovery and create cost savings and...
The Value of Converged Infra... |
Improvements in security, management and efficiency are just a few of the benefits CI can...

Networking

Securing the Internet of Thi... |
As excitement around the connected-device future grows, technology vendors seek ways to...
How to Maximize WAN Bandwidt... |
Understand six common problems that plague wide area networks — and how to address them.
Linksys Makes a Comeback in... |
The networking vendor introduced several new Smart Switch products at Interop this week.

Mobile & Wireless

Now that Office for iPad Is... |
After waiting awhile for Microsoft’s productivity suite to arrive, professionals who use...
Visualization Can Help Busin... |
Companies need to put their data in formats that make it consumable anytime, anywhere.
Linksys Makes a Comeback in... |
The networking vendor introduced several new Smart Switch products at Interop this week.

Hardware & Software

New Challenges in Software M... |
IT trends such as cloud, virtualization and BYOD pose serious hurdles for software...
Visualization Can Help Busin... |
Companies need to put their data in formats that make it consumable anytime, anywhere.
The Tools That Power Busines... |
Ever-evolving analytic software can greatly improve financial institutions’ decision-...