Symantec's Gateway Security 5460 offers tight integration of services but isn't speedy.
Symantec Corp.'s Gateway Security 5460 Version 2.0 provides tight integration of security services and much-needed relief for networks with complex security architectures. However, administrators with networks requiring extremely fast transaction times should consider how much scanning is done at the gateway.
The Gateway Security 5460, which began shipping in late October, is priced starting at $10,500 with only the firewall enabled; adding security services quickly increases the price. The unit eWEEK Labs tested—with anti-virus, content filtering, VPN, intrusion detection and intrusion prevention for 250 nodes—costs $26,535.
In eWEEK Labs' tests, SGMI proved to be wonderfully intuitive and flexible. The object-oriented policy engine allows superb control of destination zones and service groups. We especially liked the Gateway Security 5460's ability to tie content filtering and anti-virus scans to particular service groups and access rules, instead of offering just a simple on/off mechanism.
The Gateway Security 5460 uses application proxies for several common network applications, including HTTP, FTP and Network News Transport Protocol. This means that the Gateway Security 5460 scans and approves application content before sending the traffic to its destination on the requestor's behalf. As always, however, proxy technology adds transaction time because the firewall must maintain and tear down separate connections to the client and target server.
The Gateway Security 5460 can act as a primary DNS (Domain Name System) server, providing protection against attacks such as a poisoned DNS cache. During tests, we had to point a forwarder on our internal DNS server to the Symantec unit. Although this feature left us feeling a little queasy, it worked flawlessly in our tests and should provide great relief to administrators who haven't updated their BIND (Berkeley Internet Name Domain) version lately.
The Gateway Security 5460's inline anti-virus scan is an appealing feature, but our tests showed there is room for improvement.
Click to read the full review.
Technical Analyst Andrew Garcia can be reached at andrew_garcia@ziffdavis.com.
