ZyXel ZyWall: The little firewall that could

Bottom Line

The ZyXel ZyWall USG1000 wraps a lot of features in an unassuming box, but those features don’t make themselves available without some real work on the part of the security administrator. You’ll need to know what you’re doing to get the most out of an appliance that carries a surprising amount of capability for the price.

Of the four UTMs we tested, ZyXel’s ZyWall USG1000 is by far the most affordable. At a fraction of the cost, the ZyWall outperformed the Astaro ASG425 in throughput, and it trounced both the Astaro and the WatchGuard in attack protection, blocking 69 percent of our attacks. Given its remarkably low price, the ZyWall is a terrific value. Nevertheless, we would gladly pay more for if it were a bit easier to set up and manage.

ZyXel’s management interface is straightforward and distinctive. A tree of command families runs down the left side of the screen, while details are filled in through a tabbed interface on the larger right-hand side. Network settings, from interfaces to routing information and DDNS configurations, are available in the primary screen. Status information and configuration are available through the same interface; you see status in the main view, then click an icon to enter the editing process.

Remote access options are plentiful and flexible with IPSec, SSL, and L2TP VPNs available. With ZyXel’s policy-based control, remote access becomes easier even if you’ve inherited a huge wash list of legacy remote offices. One of ZyXel’s cooler options is the ZyWall P1, a portable USB-powered personal firewall and IPSec gateway. Instead of shoehorning troublesome IPSec clients onto already overloaded laptops, you can give this tiny box to your mobile users.

Test Center Scorecard
	15%	15%	15%	15%	15%	15%	10%
ZyXel ZyWall USG1000	7	7	8	7	7	7	9	7.4 Good

Small, not simple

The ZyWall gives the physical impression of being a simpler, “lightweight” UTM, but don’t be fooled. First, it doesn’t have wizard-based setup; you need to know what you’re doing. Second, it’s not terribly lightweight from the features standpoint, either. Although it doesn’t come close to the Astaro’s broad selection of possibilities, there’s no shortage of options for protecting your network through the ZyXel interface. The shortage lies in the absence of wizards to ease the pain of bouncing among numerous screens for setup and configuration, and to keep naming and rules in the realm of best practices.

AppPatrol is an optional set of capabilities that allows you to set rules for common Internet-based applications, including VoIP, IM, streaming media, and P2P apps. Functions include restricting time of access for different groups of users, enforcing bandwidth quota against certain types of P2P applications, and prioritizing VoIP traffic to ensure best call quality over slow WAN links. These are standard features in an enterprise-class UTM device, but surprising in $3,400 product.

Anti-virus, intrusion detection and prevention, anomaly detection and prevention (abnormal protocols and flows), and content filtering are available through the Anti-X tabbed interface, with virus signatures from Kaspersky or ZyXel AV. Unlike many other UTMs on the market, ZyXel doesn’t charge for anti-spam updates, so this box is an even better deal. The rest of the UTM features can be purchased either bundled or a la carte, depending upon your needs and level of paranoia.

Bargain bundle

As with just about every UTM we’ve ever touched, AAA functions are built in. In addition to LDAP and RADIUS back ends, Active Directory is supported — a nice plus. The ZyWall provides an internal storage facility for PKI certificates as well.

Two ZyWalls can be set up to work together in a high-availability configuration with automatic fail-over — a must-have in an enterprise setting. Surprisingly, the ZyWall even includes port aggregation, a throughput-maximizing feature missing from many higher-end units, including the SonicWall E7500 we tested.

[ Read more about InfoWorld’s UTM acid test and the test tools: “How to stress a UTM” | “Ixia IxLoad’s multithreaded testing” | “Mu’s Internet attacks in a can.” ]

The ZyWall USG1000 takes a backseat to Astaro and SonicWall in ease of setup and management, and it’s far behind SonicWall and WatchGuard when it comes to performance. It stood up to the 200 VPNs we threw at it, but a couple dozen VPNs and a handful of travelers are more its speed. It would be a good choice for a branch office, large or small. Although the price might suggest that the ZyWall is a good option for very small businesses, the lack of a set of wizards for setup could spell trouble for inexperienced staff. But in the right hands, it’s a terrific value.