Symantec Firewall/VPN 200
Reviews First Looks Clone Cleaner Pro Networking Symantec Firewall/VPN 200
PC Magazine is your complete guide to computers, phones, tablets, peripherals and more. We test and review the latest gadgets, products and services, report technology news and trends, and provide shopping advice and price comparisons.
https://www.pcmag.com/apple-touch-icon.png
PCMag Australia
The Symantec Firewall /VPN 200 provides arguably the most well-rounded set of features among the products in our story. We have included the Nexland Pro800turbo here because this product is the basis for the Firewall/VPN 200—though Symantec has produced its own user interface and added a secure VPN client. The features of the firewalls are very similar except for minute differences in their interfaces. But we were disappointed in both products' througHPut.

A firewall or router can easily be a single point of failure, severing your network from outside connectivity if it or your connection goes down. These two devices address the latter threat by each providing two WAN ports, which can be independently configured as backup ports if you have signed up with a second ISP for an additional Internet connection. Even so, we recommend the more expensive approach of having two firewalls or routers configured for fail-over. That way, if one fails, the other acts as a backup.

Both the Nexland and Symantec devices are equipped with only 10-Mbps WAN interfaces, offering significantly lower througHPut than the SonicWall and WatchGuard firewalls. This shouldn't cause problems if you use one of these devices on the edge of your network, where your WAN connection would be your bottleneck, since DSL Internet connections provide a maximum of only 8 Mbps anyway. But if you plan to use the device as an internal or departmental firewall, it could prove to be the bottleneck, because your LAN can probably run at 100 Mbps.

In addition to eight LAN ports and two WAN ports each, the products offer serial ports, which can provide additional backup via analog modem or ISDN terminal adapter—an impressive feature in entry-level firewalls. But you cannot disable ICMP response on these devices' WAN interfaces. This leaves the firewalls open to ping scans from the Internet—often the first way hackers identify possible targets.

Security, external access to virtual servers on your LAN, and even access to internal traffic are all controlled from three menu categories: Access Filters, Special Applications, and Virtual Servers. These menus let you fine-tune protocol use based on configurable TCP and UDP port selections. Group filtering, defined in the Host IP & Group section, is a feature unique to these two products; it adds flexibility and security by letting administrators bind certain host names, MAC addresses, and IP addresses to groups.

At times, we found these products' interface layouts a little awkward, and we were disappointed by their limited logging and reporting capabilities. Excellent online help makes up for these shortcomings somewhat. And while we were impressed with the devices' abilities to open ports dynamically for applications like videoconferencing, we would like to have seen some default entries. Determining the port number for a given two-way application can be quite tedious.

Another notable feature of these products is the ability to place one internal node into a DMZ (demilitarized zone), an option usually found only in more expensive firewalls. This is useful for hosting game servers or other specialized applications where node ports must be left open to the outside.

We also like the Expert Level control panel, which provides access to advanced features and lets you adjust IPsec, NAT, RIP, and SNMP parameters to fit your network's needs.