The evolution of the SOBO (small office/branch office)-oriented, all-in-one box is a continuing process, bent on improving speed and convenience. The latest fish to walk their way out of the SOBO ocean include not only highly sophisticated firewalls, but also advanced LAN-switching software, solid management utilities, and 802.11a/b/g wireless connectivity and management.
Although we found a few dings, a pair of small contenders -- Check Point Safe@Office 425w and the SonicWall TZ170w -- pack a powerful security punch for individual or branch offices.
Check Point Safe@Office 425w
Those seeking all-in-one functionality with a little depth might want to take a close look at Check Point's bright orange box. The box combines an inspection firewall router with single WAN port, a DMZ port, a console port, a four-port switch, and two USB 2.0 ports to feed the built-in print server. It also tacks on a slew of additional service-based protections and a wireless bridge that's compatible with all the latest protocols.
Installing the 425w really should include a functioning broadband connection of some kind. With some tweaking, though, you can get it to serve as the central routing point for an air-gapped LAN. Fortunately, Check Point's obvious attention to detail in 425w's Web-based management interface makes this tweaking easier.
Although the SonicWall TZ170w has a functional Web interface, the Check Point folks really went all out in their quest for ease of use and intuitiveness in the management GUI. Creating baseline connectivity is less wizard-based than with the SonicWall, but the process is just as easy.
The only downside to the interface might be that the GUI continually wants to steer you toward Check Point's large number of additional-cost security services to squeeze a little more from your wallet.
As it turns out, to get the full benefits of the 425w, you will have to pony up. Luckily, the services are worth the money and include antivirus, antispam, content filtering, and Dynamic DNS. All of these are available via subscription licensing to Check Point, but you'll need to maintain your broadband connection in order to access the services.
Dynamic DNS is especially interesting as it mirrors the functionality of Microsoft's new NAP (Network Access Protection) technology and Cisco's competing NAC (Network Access Control). These access control technologies scan clients as they reconnect to the network to ensure that each client is in compliance with an administrator-defined security policy (appropriate antivirus updates, all necessary OS security patches, and the like.) If the client passes the policy requirements, they're in; if not, they're in quarantine until they become compliant. That's an especially valuable service for SOBOs, as it can cut down on having to hire a consultant to quash virus outbreaks every time a new attack rears its ugly head.
Going beyond the norm
Despite the push towards the add-on services, when you start digging into the 425w's internal features, you'll be pleasantly surprised by how much enterprise-class functionality it has. For example, the 425w automatically manages a DNS cache, allowing you to reference the unit through "My Firewall" regardless of what DNS Server your ISP is using. You can also provide DHCP on different VLANs (port- or tag-based), which is helpful when implementing things such as VoIP.
You can get into traffic shaping with the 425w, applying rate limiters in the same way you apply firewall rules. And naturally, you've got full support for Check Point's IPSec VPN features, both point-to-point and remote access variations, as well as access to a Dynamic VPN subscription service. The Dynamic VPN service provides roaming from ISP to ISP without having to modify the IPSec VPN rules for each new location.
Even the 425w's router's physical capabilities are a bit beyond the norm for the SOBO set. The box's ability to fail over to a secondary ISP is good, but its ability to do so over either a broadband or modem connection is excellent.
It can build a VLAN trunk, too -- another feature usually found only on enterprise-class firewalls. VLAN trunking allows multiple VLANs to be configured off the WAN port, each with its own virtual port.
The box's wireless capabilities are very similar to SonicWall's, with support for AP or bridge configuration (though not both, which is disappointing), compatibility with WPA security, and Super-G throughput. The 425w, however, lacks the WLAN Guest Services feature that SonicWall provides. Strangely, both boxes support only a single SSID (service set identifier) -- something that's usually a no-no in business-oriented Wi-Fi products.
Another ding is that the Check Point will only talk to legacy APs if these are placed into a DMZ. This function may not be a huge handicap in its intended working space, but it does limit its flexibility.
The Check Point is definitely the higher priced of our two, all-in-one wireless security gateways, but we found its intuitive interface, excellent native feature set, and extensive subscription feature set to be worth the big bucks.