Endian UTM

This UTM offers features like network monitoring using Ntop, VPN and Active Directory authentication besides the regular ones

Tuesday, October 06, 2009

Print

Comment

Email

Digg

Del.icio.us

Reddit

Twitter

This UTM doesn't have rack concept and you don't have to download the apps since all the features are bundled inside a single ISO. Apart from the usual anti-virus, anti-spam, anti-malware capabilities, it also provides features like SIP/VoIP support, stateful packet inspection, etc. You need to open its configuration panel from a Web browser. You can configure the UTM from the client application as well which is pretty easy. As you access the browser interface for the first time, a wizard will let you configure it without any hassle. Like Untangle, Endian has a couple of other versions of UTM available such as hardware appliance, which you just need to plug into your network to get your machine ready. There are a couple of good features available on the paid UTM such as, high availability in case of failure, instant recovery/backup on a USB stick, captive portal, etc.

Though the installation process was in textual mode, it was easy. For evaluating, we installed this appliance on our Harpertown server, which took 10-15 min. Then we configured two different NICs, one acting as WAN interface and other as LAN interface.

In the anti-virus test, the results were similar to those of Untangle with a score of 93%. This was because both UTMs use the same ClamAV anti-virus technology. Also, ClamAV itself is open source and free. Next was the anti-spam test. We downloaded approx 1000 spam mails. The UTM scored slighty better than Untangle, with 55%. Well, this number is not great, as we have seen devices which can block spam by more than 90%. The paid devices like ZyXel 70 could detect 96% of image based spam. Then we ran Nessus which showed zero warnings and zero holes for the setup we did. We also tried jamming the Endian server's LAN port by flooding the device by five different clients and the Internet access in the internal network was blocked.

Endian provides you a real time picture of the connection being established over different protocols using the IPtables connection tracking.

Unfortunately, this attack was not logged or detected. We tested the device for denial-of-service attack and for this, we ran the test from the public network and attacked its public IP. The attack failed and the device kept working without any errors.

Page(s)   1