Firewall for secure networks inspects SSL-encrypted data

Firewalls are the unsung heroes of any serious network. They are almost always the first line of defense against any type of attack. And depending on the network, they’re sometimes the only defender.

While we always recommend a defense in depth for important networks, if a network admin had to rely on just one piece of defensive hardware, any of the new SuperMassive 9000 series firewalls from Dell SonicWALL would be a good choice. Although they are called SuperMassive, the entire line is actually made up of 1U appliances. The massive part describes their throughput, which we really put to the test. 

We looked at the baby of the line, the 9200. The user interface and protection on the 9200 is identical to the higher-performing 9400 and 9600 models. The only difference is the RAM and the number of VPN tunnels and simultaneous users supported. The 9200 is recommended for offices with between 500 and 600 people. 

The 9200 is specifically designed for deep packet inspection of SSL-encrypted data. This tends to slow down most firewalls to a crawl. But to get a baseline, we first tested the 9200 against a variety of threats on a closed network of normal, unprotected traffic. 

We dusted off our Spirant Avalanche and began to simulate traffic running though the 9200. A reflector on the backend recorded what was allowed through and what was blocked. We used the basic rules that came with the 9200, but we also configured quite a few of our own. Once our closed network was running, we unleashed our zoo of malicious programs and exploitive program traffic and had them assault the wall with full force. Many of the programs in the lab's zoo are extremely malevolent because they make use of camouflaging and adaptive skills and can replicate themselves if given even a little space on a network. 

The 9200 counters malicious programs with an intrusion protection system that specifically scans for evasion technology and behavior used by many stealthy programs. Dell told us to expect about a 97 percent success rate in dealing with packets that try to bypass the IPS system. However, we found it was able to score a little higher, at 98.8 percent after a week-long test. And just as important, there were very few false positives, less than half a percent. Given that our traffic was simulated, that could have accounted for some of the false alerts. Depending on how the 9200 is configured, some of those false positives could have still gotten through, just with extra scrutiny, so we don’t think that any legitimate traffic would ever be fully blocked.

During the baseline testing, we were seeing an average of 4.5 gigabit/second of throughput. We did push that up to the maximum limit of 5 gigabit/second and the SuperMassive handled the extra load with ease. The device is rated to be able to handle 100,000 new connections per second, and it was able to do so in our tests. That's probably more than a 500 person office is going to ever generate, but it's good to know the capacity is there if needed.

A lot of firewalls slow down and stop when they get overloaded with SSL-encrypted traffic. The 9200 is designed to handle the extra, processor intensive step of examining SSL packets using a single-pass, reassembly-free deep-packet inspection engine. Given that up to a third of the traffic on a government network could be SSL-encrypted — and even more in some agencies — the 9200’s performance on this test was critical to its usefulness for government. 

Like all firewalls, once we started using SSL packets, performance dropped because it simply takes more processor cycles to inspect protected packets than it does with normal ones. However, it's worth noting that the SuperMassive 9200's performance dropped far less than we expected, and far less than with any other firewall we’ve tested. Once SSL packets started streaming in, the 9200 dropped from 4.5 gigabit/second on average to 450 megabit/second. The level of traffic we had moving through the network didn't change, but we began sending half of it through encrypted. Even with the performance drop, the 9200 was still able to carry on and keep the traffic flowing. And it maintained its high accuracy level, even when we encrypted the malicious traffic to try and sneak it through. There was no change from the 98.8 percent accuracy result with SSL added. That makes for an impressive outcome with a difficult test.

Besides great performance, the 9200 has an easy-to-use elegant interface. It has application intelligence and control that lets administrators configure application traffic, throttle application bandwidth and even create rule sets on the fly. We changed the configuration of our test unit several times to prioritize different types of traffic, even IPv4 rules vs IPv6, and in all instances it was a simple matter of a few clicks. An alert administrator could even use this function to respond to ongoing threats in real time, something not possible with most firewalls.

Dell seems so happy with the interface that it maintains a test center that anyone can log onto to play with a real 9200 — or any other firewall in the line. Just head over to the live demo to see exactly what we did on our local box in the lab. At the demo site, users can make changes and configure reports and even set up users and groups. It's designed not to permanently save any changes visitors make, but gives a great look at the real interface running on an actual machine.

Between the solid user interface, the stellar performance rooting out malicious programs and the fact that the SuperMassive 9200 was able to keep churning along even when half the traffic going through it was SSL-encrypted, it earned our recommendation for use in government offices. It's a powerful and accurate firewall with a user interface that makes controlling it surprisingly easy. It would suffice as the single defensive tool for a network if needed, but it would be better as the first stop and frontline protection of an integrated security system. Having a 9200 protecting the front door would help any administrator sleep a bit easier.

The 9200 (firewall only) sells for $29,995. Adding TotalSecure protection, which adds 24-hour technical support, content and URL filtering and malware protection takes the price up to $44,393, with a one year service contract.