Allied Telesis AR Series Technical Manual page 29

Selecting a Security Solution
internal hosts. This method of security is inherently more secure than stream-based scanning.
However, this reduces the number of concurrent connections per second and the recommended
number of users.
Features required for each scenario
The following table shows the features to use to support each scenario, and the licenses that
contain each feature:
VPN
Application Control
Web Control
URL Filtering
IP Reputation
Malware Protection
Anti-virus
UTM Offload
a. UTM Offload enables the router to offload processing of IP Reputation, Malware Protection, URL
Filtering and IDS/IPS to a secondary physical or virtual machine that is automatically managed by
an AR4050S. It is supported from version 5.4.8-1.2 onwards on AR4050S only. Use of UTM offload
is not recommended with Web Control or Anti-virus.
Performance guidelines
When deciding which scenario best matches your requirements, consider:

The number of concurrent users.

Other network functions or services the UTM Firewall is performing (for instance, BGP or AMF
Master), as these could affect the available CPU resources.

Whether to configure UTM Offload, which can potentially double WAN connection throughput for
real-time threat protection.

The level of protection your network really requires. While enabling all licensed features may give
the strongest protection to the network, it will also give it the lowest throughput. Therefore, please
consider the needs of your network carefully before selecting a specific platform and security
feature combination.
C613-22104-00 REV B
LICENSE
Unlicensed
Advanced
firewall
license
Advanced
threat
protection
license
a UTM
Offload
VPN APPLICATION-
AGGREGATION AWARE
FIREWALL AND
WEB CONTROL
Yes Optional
-
-
-
-
-
-
-
Advanced Network Protection
REAL-TIME
THREAT
PROTECTION
Optional
Yes -
Yes -
- Yes
- Yes
- Yes
- -
- Optional
Selecting a UTM Firewall
HIGH
SECURITY
GATEWAY
Optional
-
-
-
-
-
Yes
-
|
Page 29