sonicwall ups enforcement, features in vpn
by sean michael kerner
january 13, 2009

in today's economic climate, remote access is becoming increasingly important as organizations downsize their on-site operations. in a move that aims to better cashing in on the trend, secure virtual private network (vpn) vendor sonicwall is now ramping up its aventail product offering, with enhancements that aims to make it easier for window, mac and linux users to connect to enterprise assets.

sonicwall acquired ssl vpn vendor aventail in 2007 and last updated the aventail firmware in january 2008 with version 9. the aventail 10 release is the first major update since then, and also marks the first new hardware platform for aventail since the acquisition.

"this is the biggest firmware release that we've done probably since 2005," chris witeck, director of remote access products at sonicwall, told internetnews.com. "we really had two design goals for this release, acknowledging the fact that the ssl-vpn market is maturing rapidly with new features, and really focusing on making the product easier to manage."

the release also features the new sonicwall aventail e-class secure remote access (sra) hardware platform, which replaces the aventail ex series -- a legacy from prior to the sonicwall acquisition. witeck noted that the new hardware offers improved scalability and integrates with the same look and feel of other sonicwall appliances.

on the firmware side, aventail 10 introduces new endpoint control capabilities with improved integrity and validation checks -- including scheduled check to ensure users remain in compliance.

"one of the big enhancements is how we conduct the checks," witeck said. "previously, checks were only done at user login. the issue there is if the user did something after connecting that changed the state, we wouldn't have known about it."

additionally, the aventail endpoint control capabilities are now the same across windows, mac and linux users. that had been a goals for the aventail 10 release, witeck said, adding that aventail used to have features in endpoint control that were only available to windows users, but that's no longer the case.

he said that demand on linux has been static, though sonicwall is seeing a surge in demand among mac users.

"we've always seen an interest in mac for the work-at-home user, but now we're seeing organizations looking at mac as from an it-managed perspective," witeck stated.

the new aventail release also aims to make it easier for administrators. witeck explained that there is a new user session monitoring capability which gives the administrator a simple online way to view users' authorization attempts as well as the applications they access. previously, that information had been buried in log file data, and not as easily accessible.

though the new sonicwall aventail release includes improved endpoint control, it does not yet directly include network access control (nac) integration or direct integration with federated identity information stores. earlier this week, novell released its access manager 3.1, which includes an ssl-vpn that provides authentication integration.

aventail also does not offer support for security assertion markup language, or saml , a common method of supporting third-party authentication. however, aventail does have an api for authentication engines so that third-party vendors can integrate with them.

"we have flexibility and experience to be pretty open on how we receive credentials and pass them on," witeck said.

in addition to the sonicwall aventail e-class secure remote access (sra) release, sonicwall today is also rolling out a new mid-level tz 210 unified threat management (utm) appliance. the tz 210 includes an ssl-vpn in it as well, though it's not the aventail 10 release. one reason is that the tz 210 is intended for a far fewer number of concurrent users -- one to two.

but john gordineer, a project manager at sonicwall, told internetnews.com that the tz 210 benefits from the lessons learned in developing the larger product.

"it's not a derivation of aventail 10 release, but our ssl-vpn team is largely made up of aventail people," gordineer said. "so now we have a lot of industry knowledge and that that technology trickles down."