WatchGuard introduced Firebox in 1996 as an appliance-based network security solution running on a standalone, dedicated PC with its own embedded, hardened, real-time Linux-based operating system. First Sneak preview was released by Network Computing on September 24 1996.
WatchGuard positions the Firebox as a cost-effective, secured, easy to install and maintain firewall than others that based on general-purpose operating system. Its target markets are small to medium-sized businesses.
WatchGuard also targets the Education/School segment by its "WatchGuard SchoolMate" product which is a firewall designed specifically for use in schools. It composes of WatchGuard 100, WebBlocker and Graphical Monitor.
| Description | Firebox 100 | Firebox II | NetScreen-10 | NetScreen-100 |
| Dimension | 15"W x 4"H x 13"D | 15.5"W x 2.85"H x 10.5"D | 17.5"W x 2.06"H x 10.8"D | 17.5"W x 2.06"H x 10.8"D |
| Weight | 14 pounds | 8 pounds | 8 pounds | 8 pounds |
| Hardware | 166MHz Pentinum Class processor PC with a floppy drive | 200MHz Pentinum Class processor PC | Integrated circuit board with PowerPC processor | Integrated circuit board with Motorola RISC processor |
| Memory | 32 MB SDRAM | 64 MB SDRAM | 32 MB SDRAM | 64 MB SDRAM |
| serial port | DB-9 serial port | 2 DB-9 serial port | DB-15 console port | DB-15 console port |
| Flash Memory | None | 8 MByte | 4 MByte | 4 MByte |
| PCMCIA card slot | None | 2 Type II PCMCIA CARDBUS card slots | 1 Type II PCMCIA | 1 Type II PCMCIA |
| Network Interface | Three RJ-45 10/100 Mbit/sec ports | Three RJ-45 10/100 Mbit/sec ports | Three 10BaseT ports | Three autosensing 10/100BaseT ports |
| Operating System | hardened Linux | hardened Linux | Proprietary operating system | Proprietary operating system |
| Price | Discontinued | $6,500 plus options | $11,000 to 12,000 (1 year HW warranty included), Unlimited user licenses | $23,600 to 25,600 (1 year HW warranty included), Unlimited User licenses |
| Support Service |
|
Same as Firebox 100 |
|
Same as NetScreen-10 |
| Feature | WatchGuard | NetScreen |
| Firewall Technology |
|
|
| Installation Procedure | Configuration Wizard |
|
| Operation Mode |
|
|
| Optional third interface | Yes (called Optional Network) | Yes (called DMZ) |
| Administration Interface |
|
|
| Administrator Account | Two
|
One
|
| Authentication |
|
|
| Outgoing Addressing Scheme | IP Masquerading | Network Addressing Translation |
| Incoming Addressing Scheme | Port forwarding for SMTP and DNS services only | Two methods:
|
| Logging |
|
|
| Notification/Alert | various methods with launch interface and repeat
count specified
|
|
| Firewall Attack |
|
|
| Historical Reports | Additonal cost | WebTrend and Unix Syslog for Historical Reports |
| Graphical Monitor | Additonal cost | Central Management Software |
| URL Blocking | Additional cost - WatchGuard WebBlocker (Cyber Patrol by MicroSystem Software) | Additional cost - WebSense by NetPartners |
| Enhanced Management Package | Additional cost - package included Historical Reports, Graphical Monitor and WatchGuard WebBlocker | WebTrend, Unix Syslog, and Central Management Software |
| SNMP Support | None | MIB-II Support |
| Traffic Shaping | None | Included (10 & 100) |
| Load Balancing | None | Included with 100 |
| Redundancy | None | Yes with 100 |
| VPN |
|
Support IETF IPSec with
|
| VPN Remote Client |
|
|
| Central Management | WatchGuard Global Console on 95/NT/Linux | NetScreen Global on NT |
| Performance |
|
Network InterOp KeyLabs Firewall
Test:
|
| ICSA Certified |
|
|
| Year 2000 Compliance |
|
|
| Award |
|
|
| WatchGuard Weakness | NetScreen Strength | |
| Operating System Vulnerability | Linux has known network related vnlerability that required constant patching. Vulnerability Example | Proprietary Operating System with very minimal network stack and application level support |
| Startup Process | getting thru the Configuration Wizard takes a while by answering a bunch of questions and the Wizard is not that intelligent | the process requires only specifying the IP addresses for the ethernet interfaces |
| Incoming Services Supported in NAT mode | With IP Masquerading, it supports SMTP and DNS services only. If you have server running other services, it has to be connected on the External side of the firewall. With Port Forwarding, it exposes the Firebox's External IP address. | Supports all services with IP Mapping (MIP) and 6 services with Virtual IP (VIP). In both cases, the NetScreen's untrusted IP address is not exposed. |
| Detection and Blocking | Since the External IP address is exposed through port forwarding, features on detection and blocking port scanning tools are a must. This auto-blocking mechanism can turn into a denial-of-service attack. | External IP address is not exposed through any services except remote administration is enabled (HTTP protocol only). |
| Default Policy for New Service defined | Any Inside hosts have access to the Outside World with the newly defined service | defining new service is independent of policy definition. No access to outside with newly defined service until an outgoing policy is specified manually. |
| Firewall Policy Matching Performance | Implemented in software. The speed is totally depended on the CPU speed. 15 policies cut the performance more than 50%. | Implemented on a custom-designed chipset. Supports up to 4000 policies with wirespeed performance. |
| VPN performance | Implemented by software in network driver level. The speed is depended on the CPU speed and traffic load | Encryption function is implemented on a custom-designed chipset |