• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Re: Symantec 200R Firewall/VPN Appliance

Xtremist

Golden Member
I'm contemplating purchasing this little device, but I am curious if anyone here has any advice on other products or even if it will suit my needs at all. I believe it will. Let me describe what I would like to do.

I work at the University of Utah and one of the perks of my job is that they pay for my DSL connection. The only caveat is that it must be through their internal ISP, that is, the department on campus that runs our telephone and network systems. Unfortunately, their QOS leaves much desired. Their single line to the Internet (however 'big' enough) isn't very assuring to me. I was spoiled by my old ISP as far as reliability and competence is concerned. I have had a few experiences with "Netcom" (the campus department) that don't make me feel very safe in their hands. As such, I am seriously contemplating the need and desire of a 'backup' or secondary broadband connection, even if I pay for it. I am considering cable for this service (AT&T). I would probably opt for another DSL line on my second phone line to another ISP, however if I'm going to have multiple connections, I might as well 'try' and make them as geographically seperate as possible. At least this way (hopefully) if the physical phone line is damaged in some way, I wouldn't lose BOTH connections.

So my first requirement is that the device supports 2 WAN connections, specifically DSL and cable. From my research the 200R does this... Comments? It also has a auto-dial external modem backup method that I would probably utilize since it wouldn't be very expensive at all (the cost of a modem).

The second issue involves personal circumstances. My house is in close proximity to my parents house. They currently have DSL as well and pay the monthly fee for it. I think it's rather stupid for both of us to have connections and have been thinking of a method to share them, without running Cat-5 between the homes if at all possible 😉 I have come to hope a simple WAP would do the trick, perhaps the Linksys model, although I haven't decided for sure yet... We're close enough that distance isn't an issue... Here IS my issue however. WEP is fairly shotty IMO. I don't trust it very much and am extremely timid about implementing it at all. It was a required evil I was going to shut up and swallow until I found this device. From my understanding, it would be entirely possible to utilize the VPN functionality of the 200R to provide the data security that WEP attempts to provide. As such, I could use NO encryption at the wireless level and leave it to the 200R to process via VPN. Am I correct in assuming this?

There are a few other things I would actually like to do, but I think if these issues are resolved it shouldn't be too difficult to implement the rest (getting my grandmother who lives about 2 miles away connected is also a goal 😉) sometime in the future. Thanks for your responses, I have personally found the 200R to be a fascinating product, especially given its price. Cheers!

Some additional general questions:

1) Does anyone know if I can hard code specific non-routable IP's to specific layer-2 addresses with the 200R? For instance, even though I'll be doing all of this through VPN, I'd still like to be able and maintain a table of MAC addresses that map to specific IP's (static non-routed IP's assigned via DHCP). It would add another level of security (however needless) that would make me feel better about doing this.

2) I have read that the firewall will actually filter content at the application level. Does anyone know if this should be taken as "program" or filetype? For instance, I might want to restrict access to certain filetypes (mp3, etc...) and am curious if this device would do this...
 
The 200R is a good choice for most of the things you want to do. As far as I know, the box does *NOT* have any content filtering capability. You would need a Watchguard or SonicWall class of box for that, which also requires subscription fees. ATT Cable is prob a bad choice though, since they are blocking outgoing server ports. Initially, you might want to obtain 2 IP's on diff segments from the school's network and just load balance them between the 2 WAN Ports. You can do some limited QoS between the channels. Also, a nice feature of that box is that it has a built in firmware client for running DYDNS or TZO so you can have DNS independent of school. As for allowing your parents to have access through your gateway, you would need to *FIRST* get permission from the school. This would be considered a breech of security otherwise. Once you gain permission, the way I would recommend you do this is with 802.11a wireless. That will give you much better range and resistance to EMI than 802.11b I would also strongly suggest you make them access your gateway using the Raptor Mobile VPN. ( 200R comes with 10 client license )That will keep your connection quite secure. Be prepared to spend about $2K+ to get this all together though. Here are couple other places you might look for info and pricing.


DSL Reports Forums

802.11 Wireless Networking Site

Review of Nexland 800ProTurbo Router ( Symantec is same box + VPN )

Another Review of 800ProTurbo

Review of 800Pro Turbo on CableModemInfo.com

Nexland - The actual maker of the Symantec Box

Hyperlink Tech - Reseller of WAP , Amps and Antenna

Intel Wireless Networking

 
Xtremist,

I have two of these boxes (long story) and I work for Symantec, so I'm pretty familar with them. For your questions, #1 yes you can preassign IP's to MAC's. #2, no the device doesn't have any content filtering ability. As for your parent and your house, I suspect you might be overblowing the security issue as it pertains to your connection. Yes, WEP is broke and yes, I can break it quiet easily. That said, are you the target I'm going to go attack and break wep against so I can see your parents traffic? Probably not. You might want to consider two wireless gateways and a custom (or even homemade) directed antenna. Let anyone break it as long as they stand in the line of sight between your two houses (mount them on the roof to make it more challenging 😉)

If you wanted any more details on the box, drop me a pm or email.

Best,
Bill
 
wlee,

Content filtering isn't really the important, it just would've been a cool feature that I'd probably never use 😉 I'm not interested in filtering mp3's out of my brother's download habit. I might get another DSL line installed, I'm still not decided on that issue yet. I don't think it'd be through the campus Internet service though since that wouldn't offer very much redundancy 😉 Plus their service sucks "AS-IS". I don't think I need permission since I'm not really doing anything they don't all ready have users doing. When it comes down to it, I'm simply running a wireless network at my home. And they have nothing specifying the way you have your home network setup. This isn't a "school connection". It's a DSL connection through Qwest with the school's DSL provider. I believe anyone could get access through them, dialup, DSL, etc... I'm not 100% sure on that, but I'm not very concerned with needing their permission. I doubt they'd have a first clue about what I was talking about anyway... Thanks for the concern however.

As far as which 802.11 technology to implement, I would like to implement one of the higher bandwith technologies (and perhaps safer in that it's new and less people have equipment for it), however one thing I need to make sure of is that 1) the equipment isn't excessively more than standard 802.11b devices and; 2) I can, at my option, get a high gain antennae for the device so that I 'could' transmit a further distance than a normal standalone access point/bridge would be able to transmit... Are these issues?

I believe the 200R actually comes with unlimited seats for their VPN client. That's what I've read at least. Is this different than the client you refer to? If so, how? Thanks for your response!



Bill,

Sweet! Preassigning IP's to MAC addresses gives the concept a level of security (or obscurity perhaps 😉 that is comforting. Like I said earlier, content filtering is probably something I'd never even implement. I'd probably just "play" with it on a personal basis... Overblowing security... Is it possible? 😉 Seriously though, I understand completely what you mean and half-agree. Let me explain my "vision" however. I work in IT at the UofU and my manager has shown great interest in wireless technology. We're implementing one of the campus's first wireless networks right now and plan on rolling it out in force in a year or so (I believe). I've talked to him briefly about the possibility of transmitting directly from campus to my house. He seems interested in the notion however 'security' is a HUGE issue with him (rightly so). I'm almost a fanatic with certain things and spend way too much money on overkill, however I find it very interesting a lot of the time, especially with things I have little hands on experience with. I'm just trying to think of the "big" picture (even if it doesn't exist), even though I don't really need to. So I guess it might be overkill, but it's something I definately want to play with. Just to see how distance, various types of encryption (WEP, VPN, WEP+VPN, etc..) affects throughput, etc... All of these things really interest me, and so it's worth a little time and money for me to figure them out...

After I read the links wlee posted and think about it a little more, I think I'll email you some more questions. For now though, I just have one...

Q: If I implemented this wireless network as described and wanted to transmit large distances, I would have to use antennaes with very narrow ranges, like 5 degrees or something (just a number). Would my data get screwed up if I have multiple of these transmitting and receiving antennaes mounted in close proximity, but pointing different directions? I can't answer this one 🙂 Thanks!
 
> Q: If I implemented this wireless network as described and wanted to transmit large distances, I would have to use antennaes with very narrow ranges, like 5 degrees or something (just a number). Would my data get screwed up if I have multiple of these transmitting and receiving antennaes mounted in close proximity, but pointing different directions? I can't answer this one Thanks!

I'm afraid neither can I 🙁 I'll have to lurk and see what other responses you get on that one and learn something too.

Best,
Bill
 
Back
Top