Feature Comparison Chart

Feature Description	Advanced Firewall & UTM Appliances	Express 3	Notes
Firewall:
Stateful Inspection	Yes	Yes
Local IP Addresses	Unlimited	Unlimited	F1
Users Supported	250 to 5000	n/a	F1
Dynamic Network Address Translation	Yes	Yes
Static Network Address Translation	Yes	No	F2
Outgoing (Egress) Traffic Control	Yes	Limited	F3
Support multiple public IP addresses	Yes	No	F4
Port Forward from public IP address to DMZ/local IP	Yes	Yes
“Round Robin” Port Forward to multiple DMZ servers	Yes	No	F5
Detection and blocking of port agile Peer to Peer traffic	Yes	No	F6
Administrator maintained IP Block list	Yes	Yes
Object based Port Rules	Yes	No
Internal Firewall	Yes	No	F7, A6
Traffic Blocking includes drop and reject options for both source and destination addresses	Yes	No

Networking:
Total Network Interfaces	20	4	N1
External Network (Internet) Interfaces	1 to 19 (of total)	1	N2
Internal Network Zones (Local Networks and DMZs)	1 to 19 (of total)	1 Local + DMZ + 1 Wireless	N3
Ethernet	Yes	Yes
PPP connections (ISDN, ADSL and analogue modem)	Yes	Yes	N4
PPPoA ADSL support	Yes	Yes
PPPoE ADSL support	Yes	Yes
PPTP ADSL support	Yes	No
Load balancing between multiple external network interfaces	Yes	No	N5
Split traffic between multiple external network interfaces	Yes	No	N5
Split external traffic based on source or port	Yes	No	N5
Fail-over from one external interface to another	Automatic	No	N6
Routing protocol support (RIP)	Yes	No
Configure static routes	Yes	No
VLAN Trunking (802.1Q) support	Yes	No	N7
Naming of Network Interfaces	Yes	No
Multiple local network subnets	Yes	No
Bind multiple IP addresses to a Green NIC	Yes	No
Red interface MAC address spoofing	Yes	No	N8
Configurable Maximum Transmission Unit (MTU) and TCP transmit/receive window sizes	Yes	No
Automatic Hardware Failover (HA)	Yes	No	N9
Inbound Load Balancing	Yes	No	N10

Proxies and Application Helpers:
Web Proxy (Transparent and Non-Transparent Mode)	Yes	Yes	P1
GUI configuration of Web Proxy Server	Yes	No	P2
SMTP (Email) Relay / Proxy	SmoothZap	No	P3
POP3 (Email) Transparent Proxy	SmoothZap	Partial	P4
SIP (VoIP) Registering Proxy	Yes	Yes	P5
Transparent SIP (VoIP) Proxy	Yes	Yes	P6
H323 (VoIP) Application Helper	Yes	No
PPTP Helper (for pass-through and forwarding)	Yes	No
DNS Proxy Server	Yes	Yes
IM logging and filtering proxy	Yes	Yes
Advanced IM logging and reports	Yes	No

Hardware:
Multi Processor support (SMP)	Yes	No
Hardware RAID (SCSI, SATA or SAS)	Yes	Yes	H1
Software RAID 1 (Disk Mirror) (SCSI, SATA, SAS or IDE)	Yes	No	H2
SCSI (No RAID) Disk	Yes	Yes	H3
SATA Disk	Yes	Yes	H4
SAS Disk	Yes	Yes
IDE Disk	Yes	Yes
IDE/SCSI CDROM support	Yes	Yes
10/100/1000 (Gigabit) Ethernet card	Yes	Yes	H5
Multi-port Ethernet card	Yes	Yes	H6
Full VMWare support including network drivers	Yes	No
USB ADSL modems and PCI ADSL modem cards	Yes	Yes	H7
ISDN cards and terminal adapters	Yes	Yes	H8
Analog modems	Yes	Yes	H9
Compact Flash support	Yes	Partial	H10
1 Gigabyte plus memory support	Yes	Yes
USB keyboard support	Yes	Yes
Serial Console	Yes	No
Display ADSL modem signal strength information	Yes	No	H11
Un-interruptible Power Supply support	Yes	No	H12
UPS Network Slave Mode	Yes	No	H12

Installation / Maintenance:
Streamlined / simplified installer with basic and advanced modes	Yes	No	IN1
Includes security hardened Linux operating system	Yes	Yes	IN2
Smoothwall and Linux security updates	Free	Free	IN3
Installation from CDROM	Yes	Yes
Installation from network server	No	Yes
Installation from a USB CD/DVD Device	Yes	Yes
Configuration backup to hard disk file/floppy and restore	Yes	No
Backup/restore configurtion from USB device	Yes	No
Automatic configuration backup (time of day)	Yes	No
Backup to multiple remote targets	Yes	No
Partial configuration restore (time of day)	Yes	No	IN4
Backup to multiple remote targets	Yes	No
Partial configuration restore	Yes	No	IN4
Install new device drivers from floppy disk/CDROM	Yes	No
Automatic download of new updates	Yes	Yes	IN5
Install update automatically at configured time	Yes	No
Scheduled reboots	Yes	No
Bulk application of updates from CD at installation time	Yes	n/a	IN6
Automatic installation of any modules present on the firewall installation CD	Yes	n/a	IN7
Ethernet cable status reporting	Yes	No	IN8
Un-install modules	Yes	n/a
Pre-installed software	Yes	n/a	IN9

Configuration:
Configuration via a web browser GUI	Yes	Yes
Dashboard, configurable GUI Home page display of system status, VPN, firewall reports, traffic statistics etc.	Yes	No	C1
AJAX Enhanced GUI	Yes	Yes
Network interfaces (IP Address) configured via GUI	Yes	Yes
Restrict configuration access to specified public IP addresses	Yes	Yes
Restrict config access to specified local IP addresses	Yes	No
Administration users with limited access (eg reports, log viewers, VPN, Guardian web content filtering)	Yes	No
Drop down lists of common IP services/ports	Yes	Yes
On-line Help appears in a seperate pop-up window	Yes	Yes
All rule lists and log files can be sorted by any column	Yes	No	C2
Validation of configuration parameters as they are typed	Yes	Yes
Infrequently used options exposed by “Advanced” buttons	Yes	No
Tooltips	Yes	Yes
Realtime display of service status, web proxy stats	Yes	No
Config replication between master and slave systems	Yes	No	C3

Authentication:
Microsoft Active Directory (LDAP) User Authentication	Yes	No	A1
OpenLDAP User Authentication	Yes	No	A2
Novell eDirectory (NDS) User Authentication	Yes	No
Local User Authentication Database	Yes	No	A3
RADIUS Authentication	Yes	No
Authentication via Ident client for Microsoft Windows	Yes	No	A4
SSL Login page (transparent mode user authentication)	Yes	No	A5
Microsoft NTLM User Authentication (including password protected mode)	Yes	No
Smoothwall User Groups linked to Active Directory, eDirectory, LDAP user authentication	Yes	n/a
Guardian web access can be controlled by Group (user authentication)	Yes	n/a
Guardian web access controlled by IP/IP Address Range/Network Address	Yes	n/a
User Internet access controlled by Group (user authentication) or IP Address/IP Address Range/Network Address	Yes	n/a
Inter-zone access controlled by user authentication	Yes	n/a	A6
VPN user access controlled by user authentication	Yes	n/a	A7
Multiple Admin/Configuration Users	Yes	No	A8
Login page with configurable login messages and log-out facility	Yes	No

Intrusion Detection:
Intrusion Detection System	Yes	Yes
Intrusion Detection System on Internal Interfaces	Yes	No
Intrusion Alert Messages by email or SMS text messages	Yes	No	IDS1
Intrusion Prevention System	Yes	No

Virtual Private Network (VPN):
SSL VPN for mobile (Road Warrior) or home users	Yes	No
L2TP VPN for mobile (Road Warrior) or home users	Yes	No	V3
IPSec VPN for site-to-site network connections	Yes	Yes	V1
IPSec VPN for mobile (Road Warrior) or home users	Yes	No	V2
Configure which Internet connection each IPSec tunnel should use	Yes	No
VPN Tunnels	20 (Included) to 500	See note	V4
AES Encryption (256 bit)	Yes	No
3DES Encryption	Yes	Yes
x509 Certificate Authentication	Yes	No
Certificate Authority included	Yes	No	V5
Pre-Shared Key (PSK/Shared Secret) Authentication	Yes	Yes
NAT Traversal (NAT-T)	Yes	No	V6
VPN secure local (wireless) connection	Yes	No	V7
Logging of Road Warrior VPN connections (with option to send alert messages)	Yes	No	V8
PPTP forwarding and pass-through	Yes	Yes

Logging and Reporting:
Disk logging of all firewall/IDS events, web traffic etc.	Yes	Yes
Configure/enable individual logging functions	Yes	No	L1
Configure how long log files are retained (day/weeks)	Yes	No	L1
Forced log file rotation in the event of low free disk space	Yes	No
Log files on RAM disk	Yes	No
Log filtering (eg by Source IP/Port, Destination IP/Port)	Yes	No
Google-like paginated log file viewers	Yes	Yes
All rule lists and log files can be sorted by any column	Yes	No	L2
Scheduled report generation / scheduled email reports	Yes	No	L3
Outgoing (egress) traffic reporting/analysis	Yes	No	L4
Real-time AJAX traffic graphs and log viewers	Yes	No
Selectively log blocked traffic	Yes	No
Network analysis tool for displaying network traffic info	Yes	No
SNMP Support	Yes	No	L5
Remote Syslog support	Yes	No
Service availability checking (including systems behind the firewall)	Yes	No
Physical hardware monitoring (eg disk status)	Yes	No
User designed reports using templates	Yes	No
Export log files in multiple formats (csv, tsv, xls etc)	Yes	No
Advanced reports in HTML format	Yes	No
Multiple report formats (csv, tsv)	Yes	No
Reports in Microsoft Excel format	Yes	No
Reports in Adobe PDF format	Yes	No

DHCP Server:
DHCP server support for local (Green) networks	Multiple	Single
DHCP server support for DMZ	Multiple DMZ	No
View DHCP leases granted	Yes	No
Display list of MAC addresses on local/DMZ networks	Yes	No
DHCP Relay	Yes	No
NTP, network boot, TFTP and automatic web proxy detection options	Yes	No

Miscellaneous:
NTP service for computers on local networks/DMZ	Yes	Yes
Modularization of core services/components (eg Web Proxy server, DHCP server)	Yes	No	M1
Timed/delayed shutdown/reboot	Yes	No
Inbuilt ClamAV anti-virus	Yes	POP3 only	M2
Network Doctor diagnostic tool	Yes	No

Available Modules:
Web Security/Content Filtering (SmoothGuardian)	Yes	No
Bandwidth Management/QoS (SmoothTraffic)	Yes	No
VPN Gateway (SmoothTunnel)	Integrated	No	V1-8
Internet Access Control/Outbound Rules (SmoothRule)	Integrated	No	F3
Incident Alerting and Reporting (SmoothMonitor)	Integrated	No	L3
Support for Multiple DMZ Servers (SmoothHost)	Integrated	No	F4
Email Security (Anti-spam/virus and relay) (SmoothZap)	Yes	No

System Requirements:
Processor	PIII 500 MHz	Pentium	S1
Memory	128MB	64MB	S2
Hard Disk	4 GBytes	1 GBytes	S3
Flash Memory (alternative to Hard Disk)	256 MBytes	n/a	S3

Commercial Support:
Technical support by Phone and Email from Smoothwall	Yes	No
Global support from Smoothwall Reseller Partners	Yes	No
Technical Training Courses from Smoothwall Ltd.	Yes	No

Firewall:
F1	Advanced Firewall supports 250 authenticated users as standard, expandable to 5000 users with the addition of user license packs.
F2	Static Network Address Translation (SNAT) (Source Mapping) is an integral component of Advanced Firewall.
F3	Outbound (egress) traffic control (user access to Internet services) is an integral component of Advanced Firewall
F4	Support for multiple public aliased IP address is a standard feature of Advanced Firewall.
F5	For load balancing, where for example high traffic applications are served by multiple web servers responding to page requests from a single public IP address.
F6	Egress Filtering incorporates traffic inspection technology to can detect and block Peer to Peer (P2P) traffic such as KaZaA, Bit Torrent and eDonkey, regardless of which port the file sharing software attempts to use.
F7	Internal firewall segregation of local networks into physically independent zones. Inter zone access (bridging) controlled by user authentication (eg only system administrators allowed admin access to DMZ servers)

Networking:
N1	Advanced firewall will support 4 NICs as standard, license expandable to 20 NICs and VLAN trunk (802.1Q) interfaces by license.
N2	Smoothwall Express supports a single active External Network (Internet) connection. Smoothwall Express supports a single External Internet (Red) interface, a DMZ (Orange) and a Local Protected Network (Green). Advanced Firewall can support multiple active External Network connections as any NIC can be designated as External (Red), Local Protected (Green) or DMZ (Orange).
N3	Multiple internal network zones allow the physical separation of different user groups, internal servers, publicly accessible servers etc. Inter-zone access rules permit strictly limited access from one zone to another (by server/IP address, port/service etc.).
N4	Advanced Firewall and Smoothwall Express can all support a single active PPP (dial-up) connection (eg ISDN, ADSL modem or analog modem). Multiple connection profiles (eg ISP details) can be stored.
N5	Outgoing traffic can be load balanced between multiple external network interfaces, with a weighting facility to control the proportion of the total traffic being routed via each interface in the load balancing pool. Both NAT and web proxy traffic can independently be subject to load balancing. Specific IP addresses, such as mail-servers can be excluded from being load balanced. Alternatively, traffic can be split between multiple external (Red) network interfaces according to the IP address, IP address range or network address of the originating computer. Traffic may also be split according to port (protocol) in order to separate web and email traffic, for example.
N6	If an Internet connection should fail then Advanced Firewall can be configured to automatically route all traffic from the failed interface to another. There is no limit to how many interfaces can be set in the failure cascade path, nor is there any limitation on the type of interface that can be used (Ethernet, ADSL modem, ISDN or analog modem).
N7	802.1Q VLAN trunking support allowing communication with VLAN capable switches and the routing of traffic between VLANs.
N8	For easier support of cable modems which will typically only communicate with the MAC address from which the modem or Internet connection was initially configured.
N9	Advanced Firewall can be used in an Active/Passive High Availability (HA) configuration with fully automatic failover should one appliance fail.
N10	Inbound traffic may be load-balanced over two or more Internet connections for increased bandwidth availability and resilience (in the event of an Internet connection failure).

Proxies and Application Helpers:
P1	Squid caching web proxy server (reduces page display times and Internet bandwidth utilization).
P2	Configuration options include: cache size, max object size, logging options and domains not to be cached.
P3	Reconstructs and relays incoming email to a protected mail server located within a local network zone or DMZ, with support for an unlimited number of domains. Transparent relay of outgoing SMTP email.
P4	The transparent POP3 proxy provided by the SmoothZap module for Advanced Firewall ensures that all POP3 email, whether company or personal email, is subject to anti-virus and anti-spam controls without any configuration changes to users’ email client software. Express includes a POP3 proxy for anti-virus purposes only.
P5	SIP registering proxy for inbound connections to SIP phones and softphones (PC clients).
P6	Transparent SIP proxy and gateway for the protection of VoIP telephone systems, supporting the use of a remote SIP proxy at an Internet Telephone Service Provider (ITSP).

Hardware:
See the Hardware Compatibility Guide: http://www.smoothwall.net/support/hcg for full information on the hardware supported by Smoothwall Security Software.
H1	Supported RAID controllers will Include Compaq, Dell PERC and DAC960.
H2	Software RAID Software RAID 1 (Mirroring) using two IDE, SATA or SCSI disks which do not have to be of identical size. The firewall will remain operational in the event of a single disk failure. Automatic mirror rebuild.
H3	SCSI controllers from Adaptec, Future Domain, Sym Bios, Initio, Advansys and BusLogic are supported.
H4	Smoothwall Express supports a limited set of SATA disk controllers. Advanced Firewall supports all common SATA controllers.
H5	Gigabit Ethernet cards from Intel, 3Com, Broadcom and other manufacturers.
H6	Multi-Port NIC support includes Intel quad and dual port cards, 3Com dual port cards and the DLink DE580 4 port card.
H7	Over 30 types of USB ADSL modems are supported, along with Ethernet connected ADSL modems and the BeWAN PCI ADSL card modem.
H8	Drivers for numerous PCI ISDN cards are included, together with support for USB ISDN and RS232 connected ISDN Terminal Adapters.
H9	Hayes compatible RS232 connected analog modems and several ISA card modems are supported.
H10	Compact Flash can be used as an alternative to hard disk for appliance applications. Advanced Firewall includes logic to operate with reduced space relative to hard disk operation, a minimum flash memory capacity is 256 MByte with 512 MByte recommended. The flash memory must present itself as an IDE device. Express can also operate on flash memory but does not include the extra logic to reduce space requirements. Logs will be stored in a non-persistent (volatile) RAM disk, thus the use of Syslog for off-box log recording is recommended.
H11	BeWAN PCI ADSL modem.
H12	Supports APC models. Advanced Firewall can support UPS slave mode operation, where up to 5 systems (eg Advanced Firewall, Unix/Microsoft Windows system running apcupsd software) on the network can share the same UPS.

Installation / Maintenance:
IN1	Advanced mode installation provides full set of Setup configuration options whereas Basic mode installation applies sensible default values to reduce the number of configuration questions presented during installation.
IN2	Smoothwall Security Solutions are based on a cut-down security hardened version of the Linux operating system, where all unnecessary components have been removed from the operating system, reducing disk and memory utilization, improving security and performance.
IN3	Security updates and bug fixes are supplied free of charge for all supported Smoothwall products.
IN4	To be able to select which rules/configuration information to restore from a Smoothwall Configuration Backup (allowing specific rules, such as Port Forward rules, to be copied between systems).
IN5	Option to automatically download and store any new updates on the firewall, which can then be applied at a convenient time by administrator command.
IN6	All updates (patches) present on an installation CD will automatically be applied.
IN7	Any modules present on the same CD as the firewall software will be automatically installed (single disk installation).
IN8	MAC address of each Network Interface Card (NIC) displayed. Network cable status (present/not present) displayed to help identify a particular NIC when multiple NICs of the same type are installed.
IN9	Smoothwall and its authorized Resellers can supply pre-installed versions of Advanced Firewall, providing pre-configured installations.

Configuration
C1	Configurable home (Control) page options allow the display a variety of information, including alert messages, system status, VPN status, traffic statistics, firewall reports, update/blocklist status and various information from the SmoothGuardian web filtering add-on module.
C2	All rule lists and log files can be sorted on any column (eg IP address, source port etc.).
C3	Master to slave configuration replication can be to automatically propagate configuration changes from say a head office system to remote branch office systems.

Authentication:
A1	Integrated Kerberos user authentication system to work with LDAP authentication systems such as Microsoft Windows 2000® and Microsoft Windows 2003® Server using Active Directory.
A2	Support for the common InetOrgPerson (RFC2798) schema.
A3	With Advanced Firewall, this authentication database can also be used to control users’ access to Internet services (outbound/egress rules) and inter-zone access.
A4	An Ident client for Microsoft Windows™ operating systems can be used to identify the computer user to the Smoothwall system.
A5	The SSL Login page automatically senses from the users’ browsers if it should display in English, German, Italian, Spanish, Danish, Dutch, French or Swedish.
A6	Multiple internal network zones allow the physical separation of different user groups, internal servers, publicly accessible servers etc. Inter-zone access rules permit strictly limited access from one zone to another (by server/IP address, port/service etc.). User authentication can be used to control which access control policies (rule-sets) are applied to a user session.
A7	Access for VPN users to internal servers and services can be controlled by user authentication, ie determines the policies (rule-sets) are applied to that VPN session.
A8	Multiple users with configurable access rights (eg reporting only, network configuration etc.)

Intrusion Detection:
IDS1	Email and SMS text message alerting is an integrated into Smoothwall’s commercial software. Alerts are generated based on intelligent monitoring of hardware, user and network activity, whilst reports are scheduled for regular delivery.

Virtual Private Networking (VPN):
V1	X509 certificate authentication is recommended or Pre-Shared Key (PSK)/Shared Secret authentication can be used. Smoothwall Express supports site-to-site VPN tunnels using Pre-Shared Key (PSK)/Shared Secret authentication.
V2	IPSec VPN connectivity for single computers (mobile/laptop/home user/Road Warrior users) is an integral component of Advanced Firewall.
V3	Layer 2 Tunneling Protocol (L2TP) VPN connectivity for single computers (mobile/laptop/home user/Road Warrior users) is an integral component of Advanced Firewall.
V4	Advanced Firewall supports 20 VPN tunnels as standard (any combination of IPSec site-to-site, IPSec Road Warrior or L2TP Road Warrior tunnels). This can be expanded to a maximum of 500 tunnels by the addition of VPN license packs. The lack of individual tunnel management facilities in Smoothwall Express makes it impractical to establish and control more than a few VPN tunnels.
V5	Advanced Firewall includes a Certificate Authority (CA) for the creation and issue of self-signed x509 certificates. Alternatively an external Certificate Authority, such as Microsoft Windows 2000/2003 Server may be used, or an external certificate provider such as Verisign or Thawte.
V6	NAT Traversal (NAT-T) mode for IPSec VPN connections is supported as standard.
V7	Either L2TP or IPSec VPN can be used for local as well as remote (Internet) VPN connections with Advanced Firewall. This is principally used for Wireless (WiFi) access, providing secure L2TP connections with the user PC authenticated using an x509 certificate and the data encrypted using the 3DES encryption algorithm. IPSec internal subnet routing can also be configured.
V8	The Firewall will log each connection and disconnection by mobile/laptop/home user/Road Warrior VPN users, with option to display an alert message on the GUI Home (Control) page or send Alert message by email or SMS text message.

Logging and Reporting:
L1	To reduce disk space utilization for non hard-disk operation (eg flash memory).
L2	All log files and rule lists can be sorted on any column (eg IP address, port, time etc.)
L3	Advanced Firewall includes scheduled reporting, which is available for most reports and integrates with all add-on modules.
L4	Advanced Firewall provides more detailed traffic statistics than Smoothwall Express, with the option to generate an alert message reports if the current inbound or outbound traffic exceeds a configurable threshold. There is also a volume threshold where an alert can be generated if the total traffic volume exceeds a configurable limit for a daily/weekly/monthly limit.
L5	Query an Advanced Firewall system to report management information, including disk utilization and traffic information.

Miscellaneous:
M1	Modularization of many components/services, such as the DHCP server and the Web Proxy, allows them to be removed as desired. This allows the system to be customized and the memory/system requirements reduced if desired. The required modules can be configured at install time, thus the system can be tailored to the target hardware.
M2	The ClamAV anti-virus engine supports the SmoothGuardian (web security/content filtering) and SmoothZap (email security/anti-spam) modules. Automatic updates to virus signatures.

System Requirements:
S1	For Advanced Firewall the minimum recommended processor is a Pentium III 500 MHz (2 GHz+ recommended). Compatible processors from AMD and VIA are supported.
S2	For Advanced Firewall the minimum recommended memory is 128 Mbytes DDR or similar fast RAM. For Smoothwall Express minimum memory is 64 Mbytes with 96 Mbytes recommended. For Advanced Firewall the maximum useable memory is 4 GBytes; for Smoothwall Express the maximum useable memory is 950 MBytes. More RAM memory is beneficial for web proxy cache performance and is necessary for operation of the SmoothGuardian web content filtering module.
S3	For Advanced Firewall the minimum recommended hard disk capacity is 4 GBytes. Alternatively Advanced Firewall can utilize compact flash memory instead of a hard disk, when 256 Mbytes flash memory is the minimum recommended figure. The compact flash must appear as an IDE device, with logging to non-persistent (volatile) RAM disk.
For the latest information and prices for currently available products please see our web site: www.smoothwall.net.

About

Twitter

@Smoothwall

There's still time to stop by the Smoothwall stand at Education ICT. See you there! http://t.co/UvbAPa4ZJD