Astaro Web Gateway AWG1000 review

Astaro’s latest Web Gateway appliances aim to offer companies that already have firewall and IPS protection a point solution for web content filtering at the gateway. There are four members in the new AWG family and here we take an exclusive look at the entry-level AWG1000.

Deployed as a 1U rack chassis, the AWG1000 offers a reasonable hardware specification although this all-Supermicro affair is too noisy for an office environment. It’s designed to operate in standalone mode and does not support the high availability feature offered by its larger brethren. However, a valuable feature is Astaro’s licensing model which does not have any user restrictions.

We found installation in the lab a simple process as you connect a PC to its Eth0 port, fire up a web browser and run through a quick start routine to license the appliance and secure administrative access. A number of operational modes are supported making the AWG1000 quite versatile. The transparent proxy doesn’t require any client browser configuration but only supports HTTP over port 80 whilst a standard mode listens on port 8080. Plenty of user authentication methods are on offer as the appliance has its own local user and group database but also integrates with Active Directory, RADIUS and LDAP servers and Novell’s eDirectory.

At its foundation lies the Websense URL filtering service and its remote database is used so you don’t need to download it to the appliance and constantly update it. Both HTTP and FTP proxies are provided but Astaro has yet to add HTTPS support to the list. Astaro employs a pincer movement for anti-virus measures as you get the open source ClamAV and the lesser known Authentium scanner. During testing the scanners worked well with them blocking all our attempts to access infected web and FTP sites.

The appliance’s proxy profiles allow the AWG1000 to be configured for a wide range of scenarios. Uniquely, you can use them to deploy the transparent mode for some users and enforce authentication for others. The profiles also contain sets of URL filtering categories along with custom black and white lists and these are applied to network definitions which can be anything from an individual host to an entire subnet.

Websense offers a choice of eighteen main URL categories with each containing up to seven sub-categories. Some customisation is possible as you can make a sub-category a member of more than one category. IM and P2P apps can also be controlled as you can block them completely or just stop file transfers. A selection of the more common apps is provided and Astaro now includes Skype.

Websense is a top choice for filtering as our tests confirmed. We searched for on-line bingo sites and with the gaming and gambling categories blocked we gave up after our visits to seventy sites were all thwarted. Reporting is fairly basic but the well designed web interface provide lists for all proxy activity whilst an executive report can also be emailed regularly to selected addresses and provides a complete summary of all activity.

The AWG1000 offers tough web content filtering and its policies allow a range of AUPs to be easily enforced. The appliance is too noisy to sit in an office and reporting is basic but the price includes unlimited users making it comparatively good value.