Manufacturer: Watchguard Technologies, Inc.
Price: $4,990 US (Firebox II; options extra), $449 US (base SOHO)
Reviewer: Glenn Stone
Much ado has been made in the post-Melissa era about firewalling, particularly with the advent of low-cost, always-on high-speed Internet connections and associated security risks. Many of us here are familiar with the poor but educated man's approach to the problem: drop a Linux distro on a machine with a pair of NICs and configure appropriately. This is cheap, effective, reasonably secure, but also time-consuming and doesn't scale all that well. It's fine for Joe Hobbyist, but Mike the Network Manager wants something a little easier to handle.
Enter Watchguard. This Seattle-based company makes a line of dedicated firewall appliances to serve anything from the SOHO market to a 5,000-user mega-office with up to 100 branches on Virtual Private Networks connected securely across the Internet. Bundled with the bigger boxes is their LiveSecurity System, a GUI-based manager tool that allows the network manager to easily configure the local firewall, called a Firebox, and optionally, VPN Manager, which allows management of multiple VPNs as well as any Fireboxes (including the SOHOs) that happen to be on the other end of the VPN link. As you might have guessed, the larger Fireboxes run Linux. (The SOHOs run VxWorks.) At $4,990 US for a full-sized one, it's not cheap at all but, as I was to find out, it is easy.
The Firebox II arrived in a nice carry-handle box with all the cables needed to hook it up, including an RJ-45 crossover cable for setup, RJ-45 patch cords for the rest of the network and a serial cable for direct console setup with appropriate adapters for DB9 or DB25 connectors. The fire-engine red case also comes with a pair of metal flanges that, when you rearrange them appropriately, allow the Firebox to be mounted in a standard 19", 2U rack slot. The front panel has an array of LEDs for system status, traffic and load average; the back panel has three RJ-45 10/100Tx jacks, a pair of DB9 serial ports, a pair of Type II PCMCIA modem slots, power socket and switch. (I always liked the idea of the switch on the front, but that's just me.) Under the hood lies a custom single-board computer with a 200MHz Pentium MMX, 64MB of SDRAM, an 8MB Flash ROM and two noisy but effective fans. Instead of a CPU fan, there is a monster heat sink, and one of the case fans is aimed directly at it. I suppose this is so the unit can survive the loss of one of the fans; using a smaller fanned-heat sink would give the unit a single point of failure.
The manual is a nice 300-page spiral-bound volume about the size of a trade paperback. What lay inside, though, was the big surprise—Windows?!? You need Microsoft Windows to run this software.
A query to Watchguard's tech support web page netted me a pair of answering phone calls, verifying what the manual said. There is currently no way to set up the big Fireboxes without using Microsoft Windows. But, they said, we would be happy to have you visit our training facility and show you how things work.
On-site at Watchguard, we get down to business. We put the CD in the drive, the install ran, did its normal Windowsish thing (including a reboot) and now we're looking at the configurator for the Firebox. You can configure it for drop-in mode (where it does transparent proxy like a bridge) or routed mode, which allows the trusted network to have private addresses, to which the Firebox will port-forward, if so desired. With all the requisite magic numbers in place, we pressed the button to upload and booted the Firebox. Hmmm, uploading via TCP didn't work. Not to worry, you can also upload via the console port. Back up a click, reset for COM1 and up pops the progress box. Ahh, sweet success. A reboot under software control, and the Firebox is up and running. We verified that it would communicate over the trusted interface then used a pre-configured Firebox to address it over the external interface, set up an IPSec gateway and tunnel. The optional VPN Manager is really slick; you simply give it the remote address and configuration password of the remote Firebox, then drag one Firebox icon onto another, run through three clicks worth of configuration and the tunnel is configured; a quick reset (20-30 seconds) on each Firebox, and the tunnel is active. The VPN tunnels can be filtered in all the same ways you can filter regular IP traffic: by host, by port or both, on source, destination or both. The Firebox II client can also configure SOHO units remotely, so a network admin can manage his or her telecommuters as well as big branches.
I asked some pointed questions about the safety of uploading new configurations and got a neat insight into the Firebox's internal architecture. The Flash ROM is divided into several sections: the running configuration, the underlying Linux system, a backup area where these can be saved (and recovered) during upgrades and a “system” area, which is the moral equivalent of a rescue partition. You tell the configurator you want to restore the factory default configuration, then reboot the system with the console port connected to your serial port. The configurator detects the boot prompt and tells the system to boot from the system area, at which point you reconfigure the machine from scratch. You can also boot the box with a PCMCIA modem in one of its slots and (re-)configure the machine from remote dialup. This makes for easy physical deployment of a large VPN; all the person at the remote site has to do is insert various sets of tab “A” into slot “B” (and the cables are all color-coded) and turn it on, and the network admin sitting in the home office in Sioux City can take it from there.
|Designing Electronics with Linux||May 22, 2013|
|Dynamic DNS—an Object Lesson in Problem Solving||May 21, 2013|
|Using Salt Stack and Vagrant for Drupal Development||May 20, 2013|
|Making Linux and Android Get Along (It's Not as Hard as It Sounds)||May 16, 2013|
|Drupal Is a Framework: Why Everyone Needs to Understand This||May 15, 2013|
|Home, My Backup Data Center||May 13, 2013|
- Nice article, thanks for the
18 min 33 sec ago
- I once had a better way I
6 hours 4 min ago
- Not only you I too assumed
6 hours 21 min ago
- another very interesting
8 hours 14 min ago
- Reply to comment | Linux Journal
10 hours 8 min ago
- Reply to comment | Linux Journal
17 hours 2 min ago
- Reply to comment | Linux Journal
17 hours 18 min ago
- Favorite (and easily brute-forced) pw's
19 hours 9 min ago
- Have you tried Boxen? It's a
1 day 1 hour ago
- seo services in india
1 day 5 hours ago
Enter to Win an Adafruit Pi Cobbler Breakout Kit for Raspberry Pi
It's Raspberry Pi month at Linux Journal. Each week in May, Adafruit will be giving away a Pi-related prize to a lucky, randomly drawn LJ reader. Winners will be announced weekly.
Fill out the fields below to enter to win this week's prize-- a Pi Cobbler Breakout Kit for Raspberry Pi.
Congratulations to our winners so far:
- 5-8-13, Pi Starter Pack: Jack Davis
- 5-15-13, Pi Model B 512MB RAM: Patrick Dunn
- 5-21-13, Prototyping Pi Plate Kit: Philip Kirby
- Next winner announced on 5-27-13!
Free Webinar: Hadoop
How to Build an Optimal Hadoop Cluster to Store and Maintain Unlimited Amounts of Data Using Microservers
Realizing the promise of Apache® Hadoop® requires the effective deployment of compute, memory, storage and networking to achieve optimal results. With its flexibility and multitude of options, it is easy to over or under provision the server infrastructure, resulting in poor performance and high TCO. Join us for an in depth, technical discussion with industry experts from leading Hadoop and server companies who will provide insights into the key considerations for designing and deploying an optimal Hadoop cluster.
Some of key questions to be discussed are:
- What is the “typical” Hadoop cluster and what should be installed on the different machine types?
- Why should you consider the typical workload patterns when making your hardware decisions?
- Are all microservers created equal for Hadoop deployments?
- How do I plan for expansion if I require more compute, memory, storage or networking?