لطفا منتظر باشید ...
Summary
Table 3.10 summarizes the comparison between ISA Server 2004 and its top competing commercial firewall products at the time of this writing:
Table 3.10: : ISA 2004 vs. Competing Firewall Products
1 Symantec Enterprise Firewall software that runs on 5400 series appliances can also be purchased as a software firewall that will run on Windows or Solaris.
2 Windows Server 2003 Standard edition supports 1000 PPTP and 1000 L2TP connections. Windows Server 2003 Enterprise and DataCenter editions theoretically support unlimited VPN connections, but the Registry restricts PPTP to 16,384 and L2TP to 30,000 on these editions.
Comparing Architecture
All of ISA Server 2004's competitors except CheckPoint, Symantec, and the open source products (IPchains, FWTK, and IPCop) are marketed as appliances with the hardware and software sold together. Most run on proprietary operating systems. Many use ASIC solid state architectures.
Although the appliance form factor offers some advantages-turnkey installation without having to install an OS or software, OS optimized for the software, high performance for ASIC hardware-it also offers disadvantages: more difficulty in upgrading, less flexibility in hardware configuration, inability of the hardware to 'keep up' with increases in processing power. In some respects, comparing an appliance to a software-based firewall or caching solution is comparing apples and oranges, especially in terms of price comparison. For example, important considerations in choosing an appliance include processor, memory, and number of network interfaces. With a software solution, you control these features by the hardware on which you choose to install the software, rather than being locked into one of the choices offered by the vendor.
As a software-based solution, ISA Server offers more flexibility in terms of hardware scalability than do the appliance-based solutions. ISA Server 2004 is also expected to be offered on security appliances by several vendors, allowing it to compete more directly with other appliance products.
Comparing Functionality
All of ISA Server's competitors except one (Blue Coat) compete in only one of ISA's dual functions: firewall/VPN or Web caching. Thus, although a PIX or NetScreen appliance might seem to offer equal firewall/VPN functionality at the same or a lower price than ISA Server, it provides no caching functionality. Adding that caching function raises the price of the alternate solution substantially, sometimes more than doubling it. When the cost of adding a caching solution to the competing firewall product is factored in, ISA Server generally offers a more attractive price point.
Blue Coat, which does provide both firewall and caching functionality, suffers from one drawback, but it's a big one: no VPN support.
Comparing Cost
When compared objectively (using comparable hardware, and factoring in the need for both firewall and caching functionality), ISA compares favorably in price to every competitor-except, of course, the open source products. You can't compete with 'free,' at least not on the basis of price.
However, the open source products fall short in other areas:
IPchains/FWTK and similar products based on aspects of the Linux or UNIX kernel provide only rudimentary firewall functionality. They are adequate packet-filtering firewalls but do not provide the sophisticated application layer filtering or built-in VPN gateway support taken for granted with all the commercial products.
IPchains/FWTK and similar products use command-line interfaces and text files for configuration and management. Considerable expertise and knowledge of the underlying *NIX operating system are required to use them. Because they are freeware, support from the developers is sparse or non-existent. Documentation is spotty, and you may have to rely on voluntary community support (mailing lists, Web boards) or pay big bucks for third-party support if you have problems.
Some freeware products, such as IPCop, are more user friendly and offer easy installation and graphical interface management. IPCop even includes a Web proxy/caching solution: Squid. It also includes the Snort intrusion-detection system. However, it is designed for home and SOHO users, not for large enterprise deployment. It does not provide deep application layer filtering, and it suffers the same lack of formal support as other open source products.
Every firewall product has advantages and disadvantages, and selecting the right one for your network is not always easy. If we seem to be excited about ISA Server 2004, that's because we are. We've been working with it and comparing it to other popular products for months, and we believe ISA Server 2004 stacks up well against all of its top competitors, based on cost factors, features and functionality, and ease of use issues. That's why we wrote this book.
This chapter provides you with a basis of comparison in selecting a firewall solution for your organization. If you select ISA Server 2004, the rest of the book will show you how to prepare for, deploy, configure, and manage it in a variety of real-world networking scenarios. We hope you'll come along for the ride.
