Are all UTM appliances the same? - Cyberoam

I'm a little bias, but I think the Cyberoam CR series UTM (Unified Threat Management) offering is head and shoulders above other UTM appliances on the market.

Some people will consider all UTMs the same, rather than looking at the components that make up the whole, or they consider it a point solution where only one or two features are used, rather than making the most of the whole solution.

Why do I consider the Cyberoam CR series a better solution, well here are some of my findings:

• Identity based UTM, to allow rules to be applied to users, rather than IPs
• A stateful firewall, that supports high availability and IP v6
• Gateway anti-virus and anti-spyware solution provided by Kaspersky
• Real time anti-spam solution provided by Commtouch
• IPSEC VPN that supports PPTP and L2TP, as well as a VPN client provided by GreenBow
• SSL-VPN functionality on the appliance
• Web content and application filtering, including IM filtering
• IPS, including the ability to create your own signatures
• Multi-link/Multiple WAN links supported on all the appliances, including USB 3G dongle support

The Cyberoam CR series solution is very cost effective and can go head-to-head with all the major UTM appliances, and in my opinion out shine them as well!

To help compliment this solution, there is also the Cyberoam Centralised Console (CCC), which can manage multiple Cyberoam UTM appliances, as well as software based solution to offer Data Protection & Encryption, Device Management, Application Control and Asset Management.


Don't just take my word for it, organise an evaluation of one from e92plus

UAG - Activating your configuration

The first few times I used UAG, I wondered why it took so long to activate the configuration.  Even though the finish screen came up, the configuration would not always be live.

There is an easy way to check this by using the messages.  On the main UAG screen, click on "Messages" and select "Filter Messages...", then select "Informational messages".

So the before the finish button would appear after activation:

But if you have a look at the following screen, you can see it takes a bit longer before the activation is completed.

UAG - RDP set up

I've been struggling with publishing RDP on my test UAG appliance, as it was not the same as IAG.

First of all, publish the application which is located on the "Terminal Services (TS)/Remote Desktop Services (RDS)", where you have "RemoteApp" for use with Windows 2008 Terminal Services, Remote Desktop (Predefined and User defined), as well as the two options available from IAG.

I can't use the two options from IAG, as they do not support 64-bit clients (and I use Windows 7 64-bit).

Publish the application as Remote Desktop, either predefined so no user interaction, or user defined where the user will need to specify the desktop to connect to.

Give the application a name, set up the appropriate access policy, define the server to connect to, configure the client settings, ensure the portal link information is correct and ensure the authorisation is correct.

As I found out, this alone will not work and your will receive an error, which points to certificate issues.

As the UAG appliance is the Remote Desktop Gateway, a certificate will need to be applied to it.  Go to the Start menu, and select "Administrative Tools/Remote Desktop Services/Remote Desktop Gateway Manager".  From there expand the server, and you will see an option to apply a certificate to the gateway.

Apply the appropriate certificate and enjoy remote access!

Microsoft UAG Update 1

Microsoft released UAG Update 1 last month, which updates the following areas:

• Remote Desktop access from Windows Vista and Windows XP: Client endpoints running Windows Vista and Windows XP can now access RemoteApps and Remote Desktops published through Forefront UAG.
• Support for Microsoft SharePoint Server 2010: Forefront UAG now supports SharePoint Server 2010.
• Support for MSOFBA: Forefront UAG now supports the Office Forms Based Authentication protocol to allow rich clients to directly access applications published through Forefront UAG.
• Support for site cookies: Forefront UAG now supports the use of site cookies for non-alternate access mapping applications, in addition to domain cookies.
• Support for large CustomUpdate files: Forefront UAG now supports CustomUpdate files up to 1.5 GB in size.
• Changes in Group Policy Object (GPO) provisioning for DirectAccess clients: Update 1 fixes an issue that caused the export script that creates GPO objects to fail, and an issue that caused the GPO to be applied to all authenticated users in the domain (including computer accounts), instead of to DirectAccess clients only.

More information regarding this update can be downloaded from here

Cyberoam Version X is here!

Cyberoam, the identity based UTM manufacturer, has revamped their multi award winning product, which can now run the new version of the firmware, Version X.

The older graphical user interface was criticised with being a little cluttered and not intuitive.  Version X is a visual treat, with a very crisp and modern.  The interface and components are well laid out and very intuitive within Version X.

More information regarding this major update can be found here: http://cyberoam.com/versionx/

Contact e92plus, if you would like to see or evaluate the Cyberoam product range.

VMWare View on Microsoft IAG

VMWare View has been a bit of a pain to a number of people, but here what I have done in the past to get it to work.  (Thanks to Andrew Button for helping to remind me of some of these bits!!)

Let me be clear, I am not a VMWare expert in any fashion, and I have little knowledge of VMWare View!

1. Ensure VMWare View works internally first
2. Ensure a VMWare Security Server has been deployed (this tip was thanks to my  friend, Google)
3. On IAG, publish a "Enchanced Generic Client App (hosts optional)"
4. Give the application a name and the right access policy
5. Give the server name that is hosting the VMWare View server, with the correct port (probably 443, if you are using HTTPS), iexplore as the executable, and the argument is the full URL for the service
6. Finish the wizard
7. Go into the properies and ensure that the Socket Forwarding Mode is set to VPN
8. Publish and test

I have been struggling with making this SSO, but no joy.  If this changes, I will update this post!

Show season is here: Infosec 2010 at Earls Court

The biggest information security show in Europe is upon us and Infosec 2010 will be hosted Earls Court from Tuesday 27th to Thursday 29th April.

A number of our vendors will have stands there, including:

Barracuda - Stand J65
Celestix - Stand J72
Lumension - Stand H50
VASCO - Stand G40
Websense - H10
WinMagic - F82

If you want a chat or a catch up, drop me a mail.

See you there and enjoy the show!

- Posted using BlogPress from my iPhone