WatchGuard XTM 515 review
Combines a heady blend of gateway security measures with excellent performance and a reasonable price
Review Date: 4 Feb 2013
Reviewed By: Dave Mitchell
Price when reviewed: £1,011 (£1,213 inc VAT)
Features & Design
Value for Money
WatchGuard’s latest XTM 5 Series of security appliances aims to deliver enterprise-level performance at SMB prices. In this exclusive review, we look at the XTM 515, which has a high quoted throughput of 850Mbits/sec.
The appliance delivered the goods in our performance tests. Hooking up the 515 to the lab’s Ixia XM2 chassis and Xcellon-Ultra NP load modules, we created a test that simulated web clients on two Gigabit ports accessing web servers on two other Gigabit ports.
The IxLoad tool reported a top throughput of 860Mbits/sec, with all universal threat management (UTM) features switched on in the firewall policies. The appliance can be upgraded with a feature key to an XTM 525, which increases throughput to 1Gbit/sec.
The XTM 515 isn’t short of features either, and the price shown above is for the one-year Security Bundle. This includes WatchGuard’s LiveSecurity support plus IPS, web-content filtering, anti-spam, gateway antivirus, application controls, HTTPS inspection and WatchGuard’s “reputation enabled” defence. The latter uses an online server to flag up URLs with good reputations, so the box doesn’t have to scan every item of traffic.
Mixed-mode routing is the most flexible deployment method since it allows all the ports to be defined as separate interfaces. We opted for this and had the appliance up and running in minutes thanks to a wizard-based setup routine. It becomes trickier from here on in, however, as you need to configure application proxies for each of the security services. Even so, there’s a fine choice, and it includes HTTP, HTTPS, FTP, SIP, H.323, POP3 and SMTP.
After proxy configuration, actions are assigned. These include functions such as exceptions, alarms and logging requests. Firewall rules are then used to apply each proxy and its associated actions to selected network interfaces.
WatchGuard’s application awareness makes the XTM appliances stand out, since it allows admins to control Facebook and other social networking sites. It can be linked with Active Directory authentication, so you can fine-tune access on a per-user basis and decide who can log in, edit their profile, access webmail, view video, transfer files, play games or chat.
Web-content filtering requires a separate Windows system to host the WebBlocker URL category database, although we found a basic Windows 7 PC can run this happily. The same system will be needed to run the logging and reporting servers as well, but these also have a light footprint.
With WebBlocker there are 56 categories of URL that can be blocked, and we found very little sneaked past it. The Commtouch hosted anti-spam service is no lightweight, either: when tested previously, it delivered a detection score of 99% in our live tests.
Along with a performance boost over the older Series 5 XTM appliances, the latest WatchGuard Fireware 11.6.1 firmware adds new features. WebBlocker database updates are now fully automated, the web interface offers a handy policy checker service, and the appliance supports even more VPNs than before.
Larger businesses with branch offices can use WatchGuard’s System Manager tools for remotely managing multiple appliances. These now allow you to schedule feature key synchronisations, reboots and OS upgrades across groups of appliances.
High UTM performance usually comes with an equally high price, but the XTM 515 bucks the trend. It’s far better value than most competing products and offers a superb range of security measures.
Author: Dave Mitchell
no mention of its VPN capabilities - number of licenses included, protocols supported etc.
Also, does it need to have the monitoring services loaded on servers on the network, like earlier Watchguards?
By big_D on 4 Feb 2013
Here are teh vpn details;
VPN Throughput 250 Mbps
Branch Office VPN Tunnels (Max.) 65
Mobile VPN with SSL/L2TP (Incl/Max) 65
Mobile VPN with IPSec Client Licenses (Bundled) 75
Mobile VPN with IPSec Tunnels (Max.) 75
As for your question on the monitoring software. If you want logging and reporting then yes you will need to install it on a windows base machine.
By Watchguard on 5 Feb 2013
thank you. That is much appreciated.
By big_D on 5 Feb 2013
RE: VPN [@Watchguard; @big_D]
Please also note that by "VPN tunnels" in the licensing, WatchGuard means each individual route within the tunnel setup. E.g. in the tunnel config, adding the route " Local 192.168.1.0/24 Remote 10.0.1.0/24 " consumes one "tunnel" license. This is very good to keep in mind; I've burned myself on this before. Thank goodness they have a really fast upgrade model. ;)
By AriinPHD on 8 Feb 2013
- Will HP finally split into two companies?
- Chromebooks get version of Photoshop
- Toshiba beats retreat from consumer PC market
- Ellison steps down: but who's really running Oracle now?
- Microsoft set to make more job cuts
- Is Peter Pan panto tickets email genuine? Oh no, it isn't
- Intel triples Xeon E5 chip performance, adds DDR4
- Patch Tuesday targets critical IE flaw
- Microsoft refuses to hand over customer emails
- Microsoft yanks Windows 8.1 update after crash reports
- Google Glass: mugger bait, pub problem and other lessons learned from two dangerous weeks
- Twitter, please don't fiddle with my feed
- How Satya Nadella can get some pay-raise karma
- Windows 10: a step back to go forward
- Michael Dell: Cloud infrastructure is the roads, bridges and highways of the 21st century
- How to check your identity hasn’t been sold to the hackers
- Tim Cook: this is how much TV has changed since the 70s
- Westminster wins the .London battle
- 20 years of PC Pro: from deep pan pizza to virtualisation
- Five reasons why the Apple Watch leaves me cold
- How to set up a wireless hotspot for your business: give customers free or paid for internet access
- Five worst SMB security threats... and how to solve them
- Doing business in a social era
- How to configure SysLookup for your network
- The 18 best Outlook tips for increasing productivity: become an Outlook expert with these lesser-known tips
- Office: should you buy it, rent it - or dump it?
- Small server vs cloud: which is best for SMBs?
- The best mobile apps for business
- Windows XP: Microsoft’s ticking time bomb
- gTLDs: what your business should know about new domain names
- How to sell more ebooks on Amazon
- 10 ways to make your business more secure
- Top five VoIP mistakes
- How to add in-app purchasing to an iPhone, Android or Windows app
- Remote-control ransomware: TeamViewer and software hardball
- Why laptops with serial ports matter to the Internet of Things
- Make your mobile battery last longer
- Small steps into handling Big Data
- Nexus 5: does it really run stock Android?
- How to get broadband to a garden office