SonicWall SSL-VPN 2000

SSL-VPN 2000 is a VPN solution for mid sized organizations.
The device comes with a nice silver casing and resembles SonicWall firewall box.
It comes with four Ethernet ports on the front side of the box. All the ports
can be managed separately and used for a different network or DMZ. Additionally,
it has a console port for configuration using Telnet. The front of the box also
has three LEDs. One of them  alarms you of any impending attack or problem
with the box. Its  granular access control feature enables you to broaden
connectivity beyond the domains of your organization by providing trusted
sources with remote access to your network resources.

Price: Rs 1,89,642 (1 yr warranty)

Meant For: Mid-sized Enterprises

Key Specs: Web based configuration, Web based VPN client access

Pros: Good security features

Cons: Configuration is not easy with web interface. No support for third party routers/firewalls

Contact: SonicWall India, Bangalore Tel: 9844021937 Email id: sbiswas@sonicwall.com

The device supports three network scenarios. The first two
include a setup where you have a SonicWall UTM device, coupled with SSL-VPN 2000
box, with direct (one to one) port forwarding. You can also use any third party
router but you would need an option for one to one NATing for this to
work.

Such an arrangement enables data coming to the router on
port 443 to be forwarded to the device. In the third scenario,  you have
the SSL-VPN running inside a sub-netted LAN. In this setup, since the box is
running inside a LAN, there is no need for NATing.

We also tried to use a third party ZyXel router to test the
first two scenarios. At our  first attempt, we failed. Then, we took a
supporting Sonicwall TZ170 router. But the configuration of the box is slightly
tricky, so we had to call technicians from the company to set it up for us.
One of the plus points with this box is its easy integration to external
authentication servers such as Active Directory. We tried authenticating the box
with a domain controller created over a Windows 2003 Server and it worked
perfectly.

During tests, the product showed some negative features
such as lack of support for port-forwarded applications, ACLs on file servers
and Web servers running on non-standard ports. This happened because of
difficulties in configuring the box.  For testing the VPN over SSL, we
created a VPN connection on SonicWall and connected it on a real IP using 'one
to one' NATing. On the client side, we used a 256 Kbps connection to access
our test network.

From this end, we were able to see the entire test network
quite  easily. To test the throughput, we did some file transferring and
found the performance to be good enough on a decent machine (AMD 2.0 GHz with
256 RAM). This test checks whether any load is generated over the machine while
encrypting the data before transferring or not.

As it supports SSL technology which means encryption of
data between both points, we ran a sniffer to capture the raw data. But the
sniffer failed to decode any packets over the SSL connection. It was not able to
decode even the authentication strings, which in some devices are sent in plain
text.

In the security tests, the box performed admirably. We ran
a slew of vulnerability accessing tools such as Nessus and Firewalk on the
forwarded port where the router was sending traffic to the Box. Nessus showed
zero risks while Firewalk just failed to penetrate. We also tried to check
whether we could capture the authentication strings of the box by running a
sniffer inside the LAN or not but even this failed.

SonicWall has recently entered the remote access and VPN
market with some new products. To consolidate its position, it has acquired 'enKoo,'
which is an SSL VPN product vendor and has some good products on remote desktop,
online conferencing, etc.

This merger took place in Nov 2005. So, we hope that very
soon SonicWall will incorporate all the features from this product and others,
and make itself friendlier with third party vendors, eventually leading to
better performance.

Bottom Line: If you are planning to buy a mid-ranged
VPN product then you can opt for SonicWall. But, watch out for configuration
issues. Most likely, you won't be having the in house expertise to configure
it and so would have to take company's help.

Anindya Roy