Enterasys XSR-3250

Deploying data security measures within a company bound to a single building is a relatively painless task. Scale this up to an enterprise with regional offices spread over diverse geographical locations, however, and it becomes an administrative nightmare. We've seen products such as Stonesoft's StoneGate appliances that are designed specifically to be deployed to remote offices and managed centrally, but these only deal with firewall duties. Enterasys' XSR series of routers aims to provide a distributed security solution. It brings together the complete gamut of features including powerful IP routing capabilities, QoS, site-to-site plus remote client VPNs and, of course, full firewall capabilities.

The XSR-3250 targets enterprise-level central and branch offices where high-speed WAN links need to be aggregated. It's designed to support just about any type of communications interface. The chassis has room for six optional NIMs (network interface modules), allowing it to support up to six T3/E3 or 24 T1/E1 links. There are plenty of other options, including single-port POTS and Annex A ADSL, single- and dual-port ISDN PRI or BRI and 2Mb/sec serial WAN modules.

The chassis is very well built and incorporates a controller board on a removable sled. This is located in the lower slot where it interfaces with the chassis backplane. All modules are supported by a pair of internal, load-balanced, redundant power supplies. The controller is well endowed as it sports a 600MHz, 64-bit Broadcom dual-core processor module, and the firmware is designed specifically to take advantage of this. The main board itself has an embedded 350Mb/sec VPN accelerator, supports two NIMs and offers a slot for additional CompactFlash cards. Network connections abound as it provides three 10/100/1000BaseT ports providing LAN, WAN and DMZ links, one of which is shared with an SFP (small form-factor pluggable) fibre gigabit port.

For installation and general configuration be prepared to get down and dirty with the CLI, as this is the primary means of communicating with all XSR routers. Remote browser access is supported but it's hardly worth activating the internal web server, as all you get is a single screen showing the current status of the unit and installed hardware. The stateful packet inspection firewall blocks all traffic by default; although we found it tedious and antiquated using the CLI to create new rules, this was made easier by the copious documentation. You'll need to set up RIP and OSPF routing as well andÊeven SNMP management access is switched off by default.

Without a browser interface the XSR-3250 relies heavily on management via SNMP, and Enterasys made a big noise some time ago with its early support for the more secure SNMP 3 across the majority of its products. If you tire of the CLI you could always use the optional Remote Services Manager (RSM) software, although don't try installing this tool under Windows Server 2003 as it will fail. Part of Enterasys' NetSight Atlas suite, RSM is designed to remotely manage multiple XSR devices and provides a tidy interface from where you can gather together and remotely access all your routers. It makes light of the process of creating, storing and deploying multiple firewall policies and, considering the modest asking price, we'd strongly recommend adding this to your Enterasys shopping list.

Author: Dave Mitchell