Norman NetProtector 3000 review

Norman may have a well-respected range of personal and corporate anti-virus software products, but it still hasn't been able to resist the allure of the appliance. The NetProtector 3000 is its sole offering. It augments email virus scanning with anti-spam and firewall protection.

At its foundation lies a Celestix Scorpio II hardware platform, as used by Vircom for its ModusGate appliances. The Scorpio II runs Windows Server 2003 Appliance Edition, allowing vendors to embed their own security software. In fact, Vircom has a role to play in this solution, providing the anti-spam features that slot neatly into Norman's Email Protection (NEP) software. The NetProtector doesn't support operations as a transparent gateway though, as SMTP traffic needs to be forwarded to it, where it scans each message and passes it on to your own email server.

We found installation on our test network simple enough, but we did encounter a problem with DNS, manifesting itself as a fault on the web interface when the Status option was selected. Norman's support staff informed us the appliance doesn't support DHCP-assigned addresses, so DNS entries have to be provided manually. Other than that, we soon had the appliance integrated into our Windows domain and configured to scan email from our test clients before passing to the mail server.

The web interface is easy enough to use, but ActiveX controls are needed, so only Internet Explorer is supported. All NEP administration is accessed from a single interface, although for anti-virus there's little to do since it's mainly pre-configured and signature updates are run automatically. Three settings determine the level of ferocity for handling the file extensions of attachments, with offenders placed in the quarantine area. We passed spam and infected messages along with banned attachments and watched the appliance drop them into quarantine where we could review, delete or release them. Norman's SandBox technology makes a valuable contribution, creating a virtual machine within memory and loading dubious attachments into it. It provides the potential virus with all the virtual hardware it needs to reveal itself, even down to a video adapter in case it wants to display a stupid message. If Norman deems it dangerous, it will be dumped in the appliance's quarantine area.

Anti-spam measures are also mainly pre-defined, but you can add your own filters. However, the catch is you'll need to know how to use the Sieve mail-filtering language. ModusGate uses the usual reverse DNS look-ups, RBLs, black and white lists, and allowed and blocked sender lists. But, rather than use Bayesian analysis, it employs Vircom's SCA (sequential content analysis) engine. This uses statistical analysis based on regularly updated identification rules, and looks for spam-like patterns in each message.

Installation problems aside, the NetProtector 3000 offers a decent level of features. However, it won't be worrying Clearswift's MIMEsweeper appliance when it comes to value.

Author: Dave Mitchell