Articles and reviews about firewalls always seem to lump products by platform. For example, an article about Windows NT firewalls won't include standalone boxes such
as the products that WatchGuard Technologies and SonicWALL offer; UNIX products also get left out. Can an NT-based network use a UNIX firewall or a SonicWALL appliance? Of course it can. Consider expanding Allen Jones's Lab Reports: "Firewalls with VPN" (March 2001) to include other firewall platforms.


Phil Wells 6/6/2001 9:51:40 AM

A good review except you don't really discuss the overall security of the products short of the mention of Checkpoint's secureclient.

You should have at least discussed the varieties of mechanisms of the various firewalls, application proxy, stateful inspection, etc.

I must admit I am biased to the Raptor product. It's a tough cookie to break into. I do not beliecve that there is one case where a hacker broke the security of a Raptor firewall. The same can not be said for the market leader, Checkpoint. Your article shed no light on this complex subject.

My $.02,



David McKinney 3/1/2001 9:23:24 AM

I took a few seconds to review your article. In your assessment of FireWall-1/VPN-1 you are wrong on a number of points.
Check Point does indeed include wizards for defining rulebases. If you click on File, New Policy and enter a policy name, click on security and address translation, on the right hand side of the dialog box, you will see "helpers" including Wizard, Template and empty policy.
You also fail to point out that the standard remote client SecuRemote is $FREE$.
Performance of the Log viewer is greatly dependent upon you hardware and address resolution capabilities. If your firewall machine is the same as your management machine then performance will be adversly effected. Secondly if you have "options, resolve addresses" turned on, then the performance of the log viewer is directly relational to the speed of your management servers DNS resolution capabilities. Besides which would you rather have performance and security or near-real-time reporting???

Gregor Munro 2/21/2001 3:26:39 PM