UTM and application control performance

[gshaw]

Just wondering who is running a UTM-style appliance with application-level control and how is it working for you?

 

Reason being we want to implement BYOD wireless access but without some way of controlling the usage and bandwidth of applications such as iPlayer, YouTube and suchlike I can see it being a free for all killing our Internet connection.

 

As a result I'm looking at a new firewall appliance with app-level control being one of the key features... needs to service 300-350 desktops plus however many we get on guest wi-fi (50-100 perhaps?)

 

Thus far Palo Alto really stands out on app-level control but not sure if their smaller box (which comes in at around £1300 for the box plus £800ish for licensing) has enough grunt... define "enterprise branch office"

 

http://www.paloaltonetworks.com/products/platforms/pa-200.html

 

Gut instinct says the PA-500 is a better long-term bet but support costs double (they never miss a trick do they!)

 

Others that I've looked at...

 

Sonicwall, seems to have the feature set but not sure how good the app control is in practice

Fortinet, pricier than Sonicwall and same question over app-level control

Watchguard, has some level of app control but seems to be pricey (had a quote for an XTM 520 that's on a level with the PA-500 Palo Alto box)

 

We'll have to use content filtering that comes with the firewall for now, not expecting any of them to be brilliant in that regard but will do the job for now...

[jamesreedersmith]

Is this a duplicate post!

[gshaw]

Is this a duplicate post!

 

Realised I'd put the original in the wrong category so deleted it and re-created here

[jamesreedersmith]

In which case Smoothwall speak to @tom_newton

[MYK-IT]

We use (2x) SmoothWall UTM-1000 Appliances with Ruckus.

 

SmoothWall deals with all the networking (DNS.DHCP, VLAN etc) for the guest/student WLAN and we use the 'rate limiting' option within Ruckus to control the bandwidth speed for up/downloads which is based per user.

 

Yes, highly recommended SmoothWall (and Ruckus!)

[AMLinington]

Regarding App-level control, the smoothwall cannot interact with apps specifically, but you can set bandwidth limiting on domains - so iplayer and youtube can be limited and the bandwidth can be throttled per proxy client or across all proxy clients (so you could potentially limit the domain youtube.com to 1Mb of bandwidth shared between proxy clients - they'll very quickly tire of trying to watch Rhianna videos when it takes forever to load and buffers every half a second...)

 

If you are looking for content filtering, contact Smoothwall to look at the Guardian3 product. @tom_newton can put you in touch with an appropriate sales representative. They can sort you out with some evaluation media to have a play with that you can pop into VirtualBox and mess about with.

[gshaw]

Smoothwall won't be able to stop Skype and anything that tunnels over port 80 that's the main issue... is filtering by domain really enough these days?