Winfrasoft Security Gateway 9500-DE
Strengths: Easy deployment, extra software increases value, quality hardware platform that can be field-upgraded, user-friendly warranty
Weaknesses: Microsoft's buggy reporting tools, anti-spam for Exchange only
Verdict: Winfrasoft delivers Forefront TMG on a classy hardware platform that can be user-upgraded and its extra software adds a lot of value
UK-based Winfrasoft has traditionally offered a wide range of Microsoft-powered security appliances, but aims to go further by providing more sophisticated hardware platforms and superior features. In this exclusive review, we look at its Security Gateway 9500-DE, which has Microsoft's Forefront TMG 2010 preinstalled and ready to go.
Winfrasoft scores highly on the hardware front, as the 9500-DE is a classy Dell PowerEdge R710 rack server. This well-built 2U chassis is equipped with a pair of quad-core Xeons, 16GB of memory and quad SAS hard disks in a RAID array.
This gives Winfrasoft a big advantage over vendors that use proprietary hardware: its open-box policy means users can field-upgrade the appliance themselves. As long as you use Dell-certified hardware, you won't invalidate the warranty on the 9500-DE.
Winfrasoft's warranties are a cut above the rest; the price includes the standard Dell three-year, onsite, next-business-day service. If you want a faster response, you can upgrade this to Dell's silver or gold support services.
The 9500-DE has Windows Server 2008 Standard 64-bit and TMG preloaded and, for the latter, Winfrasoft lets you choose any version. Unlike some vendors that only provide specific versions of TMG with their appliances, the 9500-DE is powerful enough to run any; you can choose from TMG Workgroup, Standard, Branch, Enterprise Array and Enterprise EMS. The price shown is for the 6500-DE with TMG Workgroup.
Installation was simple, as you start with a local connection. On first contact, it runs Winfrasoft's wizard, which helps configure its four Gigabit ports for LAN, WAN and DMZ functions. This also starts its own monitoring agent that looks after software updates, alerting and remote support.
From this point onwards, you can stick with local management or use an RDP connection for remote access. Either way, you load the TMG management console, which fires up its own deployment wizard.
This runs through network port plus system configuration and also offers four different deployment templates. For testing, we chose the edge firewall option, but you also have a one-arm mode with a single network adapter, back firewall and a three-leg mode for LAN, WAN and DMZ ports.
At this stage, we also deployed the TMG client to our test systems. This is a handy utility that automatically finds the TMG server on the network and configures the host's proxy settings for you. It also provides HTTPS inspection notifications and enhanced logging and reporting.
TMG provides the same core features as the elderly ISA Server 2006, so you get an inbound and outbound security gateway with IPsec VPNs, forward and reverse web proxies and web caching. New features include SPI firewalling, HTTPS inspection as standard and NIS, which scans traffic looking for specific Microsoft exploits.
AV scanning and URL filtering are optional and require a separate subscription to Microsoft's Web Protection Service. Costs will depend on your Microsoft support agreements. Anti-spam is also optional and comes courtesy of the Forefront Protection for Exchange, which does not support any third-party mail servers.
Firewall policies consist of source and destination networks or hosts, allow or deny actions, protocols and AD groups and users. Wizards are provided for security functions and include help for securely publishing LAN resources, ie Exchange web access, SharePoint sites or web servers.
URL filtering provides a choice of over 70 categories and this was effective during testing, with few dubious sites slipping through TMG's net. We were impressed with the AV scanning options, as you can choose from Kaspersky, Authentium, Norman, VirusBuster and Microsoft engines.
The only complaint we have is directed squarely at Microsoft, as its TMG SP1 breaks the reporting tools where they all come up empty. Winfrasoft did provide us with a script supplied by Microsoft that gets them going again, but a proper fix is still in the pipeline.
Another annoyance is that because TMG still uses the Dailysum utility from ISA Server, you can't raise reports on current activity until the following day. These have been such a problem that many users have had to shell out for separate report packages such as GFI's WebMonitor.
Features unique to Winfrasoft's solutions are plentiful, as the price includes a five-user licence of its VPN-Q 2010 utility. This monitors VPN connection attempts and will quarantine remote clients while it runs endpoint scans to check that they have required components such as a firewall, anti-virus software and patches.
Server backup and disaster recovery haven't been missed by Winfrasoft either, as it also includes a fully-licensed copy of Paragon's Drive Backup 10 Server Edition. This runs scheduled file and disk image backups of the server and provides file and disk recovery tools, plus bare metal system restores.
Next up is the Winfrasoft Appliance Management (WAM) console. This handy little screen offers quick access to the appliance wizards, TMG console, Paragon software, VPN-Q 2010, Windows updates and network monitoring tools.
Winfrasoft's choice of hardware platform sets it apart from the competition, as this doesn't lock you in to proprietary solutions with limited or non-existent upgrade paths. TMG 2010 is preinstalled and ready to deploy out of the box and the 9500-DE looks even better value, thanks to the extra backup software and VPN tools included as standard.