Much ado has been made in the post-Melissa era about firewalling, particularly with the advent of low-cost, always-on high-speed Internet connections and associated security risks. Many of us here are familiar with the poor but educated man's approach to the problem: drop a Linux distro on a machine with a pair of NICs and configure appropriately. This is cheap, effective, reasonably secure, but also time-consuming and doesn't scale all that well. It's fine for Joe Hobbyist, but Mike the Network Manager wants something a little easier to handle.

Enter Watchguard. This Seattle-based company makes a line of dedicated firewall appliances to serve anything from the SOHO market to a 5,000-user mega-office with up to 100 branches on Virtual Private Networks connected securely across the Internet. Bundled with the bigger boxes is their LiveSecurity System, a GUI-based manager tool that allows the network manager to easily configure the local firewall, called a Firebox, and optionally, VPN Manager, which allows management of multiple VPNs as well as any Fireboxes (including the SOHOs) that happen to be on the other end of the VPN link. As you might have guessed, the larger Fireboxes run Linux. (The SOHOs run VxWorks.) At $4,990 US for a full-sized one, it's not cheap at all but, as I was to find out, it is easy.

The Firebox II arrived in a nice carry-handle box with all the cables needed to hook it up, including an RJ-45 crossover cable for setup, RJ-45 patch cords for the rest of the network and a serial cable for direct console setup with appropriate adapters for DB9 or DB25 connectors. The fire-engine red case also comes with a pair of metal flanges that, when you rearrange them appropriately, allow the Firebox to be mounted in a standard 19", 2U rack slot. The front panel has an array of LEDs for system status, traffic and load average; the back panel has three RJ-45 10/100Tx jacks, a pair of DB9 serial ports, a pair of Type II PCMCIA modem slots, power socket and switch. (I always liked the idea of the switch on the front, but that's just me.) Under the hood lies a custom single-board computer with a 200MHz Pentium MMX, 64MB of SDRAM, an 8MB Flash ROM and two noisy but effective fans. Instead of a CPU fan, there is a monster heat sink, and one of the case fans is aimed directly at it. I suppose this is so the unit can survive the loss of one of the fans; using a smaller fanned-heat sink would give the unit a single point of failure.

The manual is a nice 300-page spiral-bound volume about the size of a trade paperback. What lay inside, though, was the big surprise—Windows?!? You need Microsoft Windows to run this software.

A query to Watchguard's tech support web page netted me a pair of answering phone calls, verifying what the manual said. There is currently no way to set up the big Fireboxes without using Microsoft Windows. But, they said, we would be happy to have you visit our training facility and show you how things work.

On-site at Watchguard, we get down to business. We put the CD in the drive, the install ran, did its normal Windowsish thing (including a reboot) and now we're looking at the configurator for the Firebox. You can configure it for drop-in mode (where it does transparent proxy like a bridge) or routed mode, which allows the trusted network to have private addresses, to which the Firebox will port-forward, if so desired. With all the requisite magic numbers in place, we pressed the button to upload and booted the Firebox. Hmmm, uploading via TCP didn't work. Not to worry, you can also upload via the console port. Back up a click, reset for COM1 and up pops the progress box. Ahh, sweet success. A reboot under software control, and the Firebox is up and running. We verified that it would communicate over the trusted interface then used a pre-configured Firebox to address it over the external interface, set up an IPSec gateway and tunnel. The optional VPN Manager is really slick; you simply give it the remote address and configuration password of the remote Firebox, then drag one Firebox icon onto another, run through three clicks worth of configuration and the tunnel is configured; a quick reset (20-30 seconds) on each Firebox, and the tunnel is active. The VPN tunnels can be filtered in all the same ways you can filter regular IP traffic: by host, by port or both, on source, destination or both. The Firebox II client can also configure SOHO units remotely, so a network admin can manage his or her telecommuters as well as big branches.

I asked some pointed questions about the safety of uploading new configurations and got a neat insight into the Firebox's internal architecture. The Flash ROM is divided into several sections: the running configuration, the underlying Linux system, a backup area where these can be saved (and recovered) during upgrades and a “system” area, which is the moral equivalent of a rescue partition. You tell the configurator you want to restore the factory default configuration, then reboot the system with the console port connected to your serial port. The configurator detects the boot prompt and tells the system to boot from the system area, at which point you reconfigure the machine from scratch. You can also boot the box with a PCMCIA modem in one of its slots and (re-)configure the machine from remote dialup. This makes for easy physical deployment of a large VPN; all the person at the remote site has to do is insert various sets of tab “A” into slot “B” (and the cables are all color-coded) and turn it on, and the network admin sitting in the home office in Sioux City can take it from there.

This is all well and good for larger companies with heterogenous networks, but what about us Linux-only types with a relatively tiny network and budget? (After all, the Firebox II is rated at 500 users and costs five grand.) Not to worry. Remember those SOHOs? Well, they don't run Linux, but they do grok it...as a matter of fact, any SSL-capable browser can configure a SOHO. The configuration screens are all straight, low-graphics HTML, so, while it doesn't look as fancy as the Windows client, you could even talk to it with Lynx patched for OpenSSL. They're also a lot more affordable, with an MSRP of $449 US for a ten-user version. It's about the size and shape of an 8-port hub with a built-in 4+1-port hub on the back and a few status LEDs in the front.

All the Fireboxes do NAT, logging, DHCP both client and server, logging to a remote host, remote setup of one form or another and, if you're stuck with it, PPP over Ethernet. VPN is standard on the big boxes, and a $100 US option on the SOHOs. (Interestingly enough, the VPNs use IPSec and a few other protocols, but not Microsoft's PPTP. Why? That's right. Microsoft wasn't forthcoming with the standards.) The big boxes also perform scan and spoofing detection. All of them come with a year's subscription to LiveSecurity, a “push” service that delivers security updates, both human readable and in software form, via e-mail or directly to the configuration host. Network managers can then upload the software at their convenience. Your subscription also gets you access to the tech support web pages, which include both a knowledge base and a trouble-ticket submission and tracking interface. The license key is also your password to get tech support on the phone. (Don't lose that card!)

Watchguard said they were working on ways to minimize the number of times you had to reset a Firebox after a configuration change; this makes sense since you can do almost anything except change kernels to a standard Linux machine without resorting to a reboot. They also hinted that there might be Linux in the SOHO's future. For the foreseeable future, however, the big Fireboxes will require a Windows host to configure. Watchguard's primary focus is to make it as easy as possible to deploy a network on a truly grand scale and manage it with a minimum of fuss.

They've done that to a certain extent already. As the old saw goes: good, cheap, fast—choose any two. This isn't cheap, but I think with the dual solution of the Firebox IIs for large, heterogenous networks and the SOHOs for small or Linux-only implementations, a network admin can make a case for these drop-in machines in terms of saved people-time, both up-front and on an ongoing basis. It's not a perfect solution, particularly not for the purists among us, but I think it's a step in the right direction. Not bad for a company “only” five years old.

The Good/The Bad