Kerio Control NG300W
It lacks anti-spam, but the wireless-enabled NG300W appliance scores for both value and performance
Kerio’s range of UTM appliances has recently been expanded with two new wireless models – the lightweight NG100W and the more capable NG300W. This follows the same basic design as the standard NG300 UTM appliance, but adds dual-band 802.11ac wireless services, with support for up to eight SSIDs.
It’s built on a firm foundation: Kerio’s embedded Control software teams up a standard SPI firewall with deep packet inspection, IPsec VPNs, IPS, bandwidth management and quality of service (QoS). That’s supplemented here by Kerio’s own web filtering service and Sophos’ gateway antivirus, to keep your users well away from dangerous content.
The appliance is silent, as its chunky aluminium chassis functions as a heatsink. Inside beats a quad-core 2.4GHz Intel Atom C2558 – a powerful CPU for this sort of role – partnered by 4GB of RAM, 32GB of SSD storage and four Gigabit Ethernet ports. Kerio claims the NG300W can achieve firewall and UTM speeds of 900Mbits/ sec and 700Mbits/sec respectively, so it’ll handle the demands of most SMEs.
To buy the appliance with an unlimited-user licence costs £1,647 excluding VAT, but smaller organisations can save £554 with a 25-user licence. After that, ongoing costs are reasonable: unlimited and 25-user software renewals cost £478 and £316 per year respectively, including updates to the Control, Sophos AV and web filter services.
Installation took us just five minutes, with the web-based wizard setting up internet access and applying a base set of firewall rules for us. The appliance’s three LAN ports default to being members of one switch with DHCP services, but you can easily break them out and configure individual ports to provide their own services.
“Web filtering is a winner: Kerio offers over 150 URL categories to block or allow and we found very few websites escaped its net”
Similarly, each SSID can serve as a standalone wireless interface, or be assigned to the LAN port group. You can also specify an SSID as a guest interface, which isolates it from LAN ports and optionally redirects connecting users to a customisable welcome page, with an AUP and optional password request.
Setting up the firewall was a simple case of browsing the long list of predefined services, then configuring sources and destinations. Rules are shown in order of priority, and colour-coded to show clearly which block and which allow traffic.
Kerio doesn’t offer any anti-spam measures, but POP3 and SMTP traffic can be scanned for malware, along with HTTP and FTP. And web filtering is a winner; Kerio offers over 150 URL categories to block or allow, and we found very few websites escaped its net.
Bandwidth management and QoS controls are also available, and Kerio helpfully offers a pre-defined rule that reserves bandwidth for SIP VoIP services. The NG300W’s intrusion prevention capabilities aren’t to be sniffed at either – these are handled by the well-respected Snort, and can be activated for all traffic with one click.
If you need to manage multiple NG300W units – perhaps across remote sites – you can do so using the free MyKerio web cloud portal. VPN support meanwhile extends to the IPsec, PPTP and L2TP variety, and while Kerio doesn’t support SSL VPNs, its own VPN server is easy to configure. Control VPN clients are available for Windows, macOS and Linux, and performance is good, with file copies between local and remote Windows hosts averaging 50MB/sec and appliance CPU utilisation around 35 to 40%.
Anti-spam would have been a bonus, but we can’t fault the Control NG300W for anything else. It’s easy to manage and offers a good range of security measures for the price.
SPECIFICATIONS
Desktop chassis 2.4GHz Intel Atom C2558 4GB DDR3L 32GB SSD 4 x Gigabit Ethernet (WAN, 3 x LAN) 2.4/5GHz 802.11ac wireless
2 x USB 2 RJ-45 console external PSU 177 x 146 x 44mm (WDH) Kerio Control and Web Filter Sophos AV 1yr standard warranty. Options: 3yr extended warranty, £113 exc VAT with initial purchase