Check Point 600 Appliance review

Dave Mitchell Read more January 24, 2014

Image 1 of 2

£300

Price when reviewed

SMBs need just as tough network security as enterprises, but many unified threat-management solutions can be overly complex and expensive. Check Point’s new 600 Appliance series avoids all of these problems, since it’s designed to be plug and play, and very affordable.

All models use the same compact, fanless desktop chassis and are licensed for different throughputs. The 620 has Check Point’s full next-generation threat prevention (NGTP) package, and is good for ten users, while the 680 can serve up to 50. If you find your 620 is running out of steam, you can simply buy a new licence to upgrade it to a 640 or 680. If you wish, you can lower costs even more by only purchasing the firewall and VPN components.

Eight Gigabit ports handle LAN duties, with two more for WAN and DMZ functions. The appliances all come with an integral 802.11bgn wireless AP and ADSL2+ modem, each of which can be enabled by applying a licence.

Installation is a cinch: point a web browser at the appliance’s default address and follow its quick-start wizard. This runs through securing administrative access, setting up an internet connection and deciding what to do with the LAN ports.

These default to an eight-port switch, but you can break them out into individual ports, each with separate security policies. In switch mode, DHCP is already configured, avoiding the problems of earlier Check Point appliances where this could only be created from a CLI sysconfig command. Management has also been simplified, and the appliances are now fully configured from a web browser. Check Point’s higher-end appliances require its SmartConsole software suite, which is overkill for small businesses.

The 600 uses most of the same software blades as Check Point’s enterprise offerings. Along with an SPI firewall and VPNs, the full NGTP licence opens up IPS, application controls, URL filtering, antivirus, anti-spam, user awareness and QoS. The intuitive web interface makes it easy to locate the various security features. There isn’t much to do, though, since the appliance is set up out of the box with most of them already running.

A dashboard provides an at-a-glance status view of each software blade, with quick links to configuration and performance graphs. There’s no need to mess about with firewall rules, since you can pick from Standard or Strict policies with a single click.

Application filtering has a predefined policy that blocks high security risks, torrents and other P2P apps. A preset URL-filtering policy blocks inappropriate content such as gambling, and you can choose from an extensive list of other apps you may want to stop as well.

With two clicks, you can apply rate limits to bandwidth-hungry apps and decide whether to log all blocked traffic. Enable the QoS blade and it will automatically identify and prioritise traffic such as VoIP, and ensure VPN traffic gets a set percentage of bandwidth.

If enabled, the optional wireless AP is set up by the wizard to provide WPA2 protected access. The hotspot option allows wireless internet access, but blocks clients from seeing any LAN systems. You can mix this with standard protected access for other users by using multiple virtual APs, each with their own encryption settings.

The user awareness blade links usernames to machines, allowing security policies to be applied to user identities. Support for remote workers is excellent: they can connect using Check Point’s mobile desktop client, a remote app for iOS and Android, SSL VPNs and L2TP.

Most small businesses will be well protected using the default settings, but customisation is possible. For example, URL filtering can use custom groups created from a huge list of category choices – including 11 for Facebook alone – and you can present users with a web portal asking if they wish to proceed.

The 3D monitor and its hourly graphs keep you posted on all security events, along with the most popular apps and websites, and you can see all active computers and logged-in users. You can’t export them, but the security reports provide a wealth of information for hourly, daily, weekly and monthly intervals.

Check Point’s 600 Appliance may be small, but it’s no security lightweight. It’s very competitively priced, too. We found deployment and ongoing management easy, but businesses that don’t want even this minor hassle can pay a monthly fee of around £20 for the optional cloud management, and let Check Point do it all for them