NETGEAR ProSecure UTM25

NETGEAR UTM25 Overview:

View Product Demo (Pop-up)

ProSecure™ Unified Threat Management (UTM) appliances combine performance with comprehensive security coverage for small businesses. The flexible modular software design architecture leverages patent-pending Stream Scanning technology to scan files and data streams up to 5x faster than conventional methods. This architecture in turn enables ProSecure UTM to utilize virus and malware threat databases from NETGEAR and Sophos™ that are over a million signatures in size – up to 400x more comprehensive than legacy small business UTM platforms.

Key Features & Advantages:

• All in one Unified Threat Management
• Best of Breed Virus Detection Partnered with Sophos™
• Patent Pending Stream-Scanning Technology Ensures Minimal Latency
• Hybrid In-the-Cloud Anti-Spam Requires No "tuning" to Work
• Hybrid In-the-Cloud Web Filter, P2P & IM Control Enforces Internet Usage Policies
• Zero Hour Threat Protection stops Unknown Threats in Real-time IPsec & SSL VPNs for Remote Access
• Simple Subscription Options
• No Per-User Licensing

Unified Gateway Security for Growing Businesses - Without Compromise

The ProSecure UTM series of all-in-one gateway security appliances combine best-of-breed enterprise-strength security technologies from Commtouch®, Mailshell™, and Sophos™ with patent-pending Stream Scanning Technology to protect businesses against today’s Web, email, and network threats. Malware hosted on Web pages, phishing attacks, spam, virus infected emails, hackers, denial-of-service attacks, and other threats are now all part of a regular repertoire of sophisticated blended attacks that bypass traditional firewalls with ease. Because comprehensive network security solutions require an abundance of processing power to examine network traffic in real time, existing all-in-one security solutions often use rudimentary security technologies that trade comprehensiveness for speed. True security must satisfy the requirements in both speed and coverage.

All-in-one Network Security - Redefined:

ProSecure Unified Threat Management (UTM) Appliances combine performance with comprehensive security coverage. Patent-pending Stream Scanning Technology enables the ProSecure UTM to utilize virus and malware threat databases from ProSecure and Sophos™ that are over one million signatures in size - up to 400x more comprehensive than legacy all-in-one platforms at a speed that is up to 5x faster than conventional methods. This architecture, combined with best-of-breed hybrid in-the-cloud Web filter and anti-spam technologies along with proven firewall, IPS, and VPN functionality, form the ideal growing business gateway security solution.

Revolutionary Stream Scanning Platform:

Given the high performance requirements of scanning latency sensitive Web traffic, incorporating enterprise-grade security software technologies onto traditional all-in-one platforms has been a very difficult task. Traditional batch-based scanning methods introduce large amounts of latency into network traffic and can slow Web browsing to a crawl. All-in-one solutions in the past have tried to overcome this by minimizing the malware signature set, scanning only a select few file types, or by avoiding Web scanning altogether. This exposes an entire vector of the network to malware-based attacks. The ProSecure UTM features patent-pending Stream Scanning Technology which analyses data streams as they enter the network. This significantly reduces latency and allows the use of an extensive malware signature library for scanning – thus offering an unprecedented combination of speed and coverage in an all-in-one solution.

Simple Setup, Ease of Management:

The ProSecure UTM will easily replace any existing firewall or router. A simple 10-step setup wizard guides you through installation and the UTM will be up and running in minutes. Administration is performed through an intuitive Web-based interface. Set granular policies and alerts, check summary statistics and graphical reports, drill down to IP address-level data, and integrate log data with standard network management tools using SNMP. Malware and IPS signature, software, and firmware updates are all handled by the UTM - online and automatically.

For many administrators and IT personnel one of their biggest nightmares is the management of individual licenses or “seats.” Buying additional licenses when computers and personnel are added to the network is time-consuming and costly. The ProSecure UTM offers Web and email protection subscriptions with no “per-user” licensing.

ProSecure UTM Features and Highlights:

• Best-of-breed Anti-malware Engine
  • Enterprise-class malware scan engine
  • Up to 400 times the coverage of legacy all-in-one solutions
  • Over 1 million malware signatures
  • Hourly automatic signature updates
  • Zero hour heuristic based threat protection
     
• ProSecure Patent Pending Stream Scanning Technology
  • Data streams are processed as they enter the network
  • Low latency Web traffic scanning
     
• Distributed Spam Analysis Anti-spam Technology
  • Hybrid in-the-cloud architecture
  • Gathers threat data from over 50 million global sources
  • New spam is classified and detected within minutes
  • No learning period, works right out of the box
  • Minimal false positives
     
• Distributed Web Analysis URL Filtering
  • Hybrid in-the-cloud architecture
  • Hundreds of millions of categorized URLs
  • Real-time classification into 64 categories
     
• IM and P2P Application Control
  • Blocks access to public IM clients
  • Blocks peer-to-peer (P2P) clients
  • Preserve productivity and save bandwidth
     
• SSL & IPsec VPN Remote Access
  • SSL VPN - clientless remote access, anywhere, anytime
  • IPsec VPN - secure site-to-site tunnels and client-based remote access
  • No additional licenses to purchase
     
• Built-in SPI Firewall
  • Dual WAN Gigabit Firewall* provides load balancing and failover
  • Four Gigabit LAN ports, one configurable hardware DMZ port
  • Stateful packet inspection (SPI)
  • Denial-of-service (DoS) protection
  • IPS prevents hackers from penetrating the network perimeter

UTM Series Comparison:

 

*Available on the UTM25
¹Throughput measured in a lab environment. Actual performance may vary.

Screenshots:
 

 

Sizing Guidelines:

ProSecure™ UTM appliances are situated between an organization's internal network and the Internet. The UTM acts as a stateful packet inspection firewall, keeping track of TCP connection state for every connection that is maintained through the UTM. Moreover, the UTM manages an organization's Internet usage and protects these organizations from Internet borne malware, spam, viruses, and inappropriate web surfing. With the ProSecure™ UTM appliance sitting between the organization and the Internet, it is critical that the UTM appliance is sized appropriately and matches the performance needs of the organization.

There are no industry-standard metrics for determining the model to select, as every organization is unique and displays different network traffic characteristics. Moreover, the performance of the UTM can vary widely depending on a number factors including the complexity of the firewall rules loaded, the number of current active VPN users, the IPS signatures employed, the number of active connections used by each user, and a host of other metrics, including, last but not least, the number of protocols inspected by the Antivirus engine and the number of signatures applied to the AV engine.

As such, NETGEAR highly recommends that you contact your ProSecure™ authorized VAR who is well versed in UTM sizing to benchmark your organization and recommend the best model for your needs. That said, NETGEAR generally uses several specifications to roughly evaluate the applicability of an UTM appliance:

Firewall Throughput:

A starting point is to estimate the throughput your organization requires between its internal network and the Internet. As the UTM appliance sits between your internal network and the Internet, firewall throughput number is the total amount of traffic that can be passed with the UTM in place.

Concurrent Sessions:

Users typically engage in a host of activities that consume TCP sessions. Web browsing over HTTP and HTTPS, FTP file transfers, Email over POP3, SMTP, and IMAP, Instant Messenger, Peer to Peer Traffic, TELNET, SSH and streaming audio and video all consume TCP sessions.

On the average, "normal" users typically consume 100-300 active TCP sessions. Virus Infected PCs turned into zombies can often consume upwards of 1000 active TCP sessions, although ProSecure™ UTM appliances have administrator-definable limits to contain infected PCs from consuming an excessive number of TCP sessions.

Anti-Virus Throughput & Virus Coverage:

Anti-Virus scanning can be performed against files or data embedded in time-sensitive applications such as web browsing over HTTP(s) or in latency-tolerant applications such as Email. Because Anti-Virus speed is directly correlated to the number of signatures applied in the scanning process and in the protocols being scanned, Anti-Virus throughput can typically be inflated by reducing the signature set size or reducing the numbers of protocols scanned. Thus, Anti-Virus effectiveness is often a balance between speed and thoroughness. ProSecure™ UTM appliances employ signature sets that are up 400x larger than competing legacy small business UTM solutions while employing patent-pending Stream Scanning technology to vastly increase Anti-Virus throughput.

UTM Appliance Model Comparison
 

 

ProSecure Technology Solutions:

Web Security

In 2007, security experts received approximately two million unique malware samples. By the end of 2008, that number is projected to surpass 15 million. Web-based threats are an exponentially growing problem, with new threat types and attack vectors continuously emerging. As a result, IT managers must develop comprehensive security measures which consider the wide array of threats.

The ProSecure™ security appliances use a best-of-breed security architecture to protect business networks from viruses, worms, spyware, trojans, rootkits, keyloggers, and other Internet-based threats - without impacting network productivity. All inbound and outbound content over HTTP, HTTPS (secure HTTP), and FTP is inspected for millions of known threats and unknown threats, proactively discovering and blocking threats to the network.

Instrumental to ProSecure™ security appliances, the patent-pending Stream Scanning Technology scans data streams as they enter the network, rather than waiting for the entire communication to download before a scan can be performed. This enables the ProSecure appliance to process large amounts of data quickly, using a single scan to stop malware at the gateway before it infiltrates the network.

ProSecure™ security appliances employ NETGEAR Hybrid In-the-Cloud Distributed Web Analysis technology to filter malicious and unwanted URLs. With a virtually limitless master database of over 100 million URLs located in the cloud divided into 64 categories, data feeds from HTTP connectors deployed "in the cloud" at service providers throughout the world are analyzed and categorized by the NETGEAR URL Classification Center in real-time. The NETGEAR® Distributed Web Analysis URL filtering engine automatically self adapts and categorizes new URLs that have previously been unknown – unlike less effective approaches that force administrators to manually "submit" new entries one by one. The Distributed Web Analysis not only blocks access to unwanted sites, but also blocks sites containing malware and other security threats.

Email Security

The ProSecure™ STM Series is a best-of-breed solution to proactively protect users and IT infrastructure from spam and Email-borne threats. While traditional spam filtering techniques limit their search to specific header content that is often useless against most new threats, the STM Series detects and blocks outbreaks in real time, based on their rapid and wide distribution behavior.

The NETGEAR® in-the-cloud Distributed Spam Analysis architecture continuously gathers data from more than 50 million sources from around the world. Using this information, it accurately assesses an Email's legitimacy in real-time by analyzing its distribution patterns, rather than its header information. Once an Email is classified as spam, the scanner assigns it a signature and immediately generates a corresponding pattern file - effectively stopping an outbreak before it becomes widespread.

The benefits of the NETGEAR® STM Distributed Spam Analysis architecture include:

• High Detection Rate – blocking upwards of 97% of spam
• Effectiveness against all spam – including double-byte languages and image-based spam
• Low False Positives – Less than 1 in 1.5 million reported false positive

The ProSecure™ security appliances protects business networks from Email-borne viruses, worms, spyware, trojans, rootkits, and keyloggers - without impacting network productivity. All inbound and outbound content is inspected for millions of known threats, as well as scanned to proactively discover and block any suspected threats that have not yet been identified.

Network Security

ProSecure UTM appliances include firewall functionality that deploys an array of network security technologies such as stateful packet inspection (SPI), Intrusion prevention (IPS), and denial-of-service (DoS) protection to protect the network from threats such as hackers, port scans, DoS attacks, and TCP/UDP floods.

The ProSecure UTM's network intrusion prevention and detection system utilizes a rule-driven language, which combines the benefits of signature, protocol and anomaly based inspection methods, preventing hackers from penetrating the network perimeter. IPS is not only important, but a necessity for any network security architecture.

The IPS engine performs protocol analysis, content searching/matching, and can also block or passively detect a variety of attacks and probes, such as buffer overflows, stealth port scans, web application attacks, and SQL injections amongst other attacks. Attacks are dropped as they are taking place.

In addition to protecting the network from outside threats, enforcing company network usage policies can prevent internal users from pulling in threats due to misuse. The ProSecure UTM's application controls can be used t block access to public IM clients such as Skype, Yahoo!® Messenger, MIRC, and MSN® Messenger and save bandwidth by blocking peer-to-peer (P2P) clients like BitTorrent, eDonkey, and Gnutella.

Remote Access

The ProSecure™ UTM appliance with SSL & IPsec VPN offers the best of both worlds by offering two types of virtual private network (VPN) tunnels, Secure Sockets Layer (SSL) and IP security (IPsec), for optimal secure connection to your network. SSL VPN tunnels provide clientless remote access to your corporate data for individual access anywhere and anytime while IPsec VPN tunnels provide both secure site-to-site tunnels and legacy support for client-based remote access.

Working Remotely via SSL VPN Tunnel Protocol Redirection
Because corporate laptops are already loaded with the applications employees need to do their jobs, they require full corporate network access for file sharing and email connectivity. The ProSecure UTM appliance is able to connect to the corporate network using VPN tunneling, enabling users to securely and privately transfer information.

The ProSecure UTM appliance enables easy, secure and cost-effective clientless remote access for any employee without complicated installations or PC administrative access. VPN tunnel protocol redirection enables users with administrative access to their PCs to:

• Use any application on their corporate PC
• No need to install, configure, and maintain IPsec software clients on corporate PCs
• Freedom from complex network limitations associated with IPsec such as NAT Traversal, multiple PCs from one public NAT address, etc.
• Freedom to access VPNs from any PC with a browser
• Use only a browser to connect – no software installation necessary
• Securely connect through a dissolvable Java/ActiveX agent

Figure 1: Connecting through VPN tunnel protocol redirection is as simple as clicking the icon

Figure 2: Dissolvable Java/ActiveX agent

Documentation:

Download the NETGEAR UTM Series Datasheet (.PDF)