Barracuda Spam Firewall 600
I’m placing this review in the slot for the 600 model, but I will explain the differences between the various models of spam firewalls offered by Barracuda so you might be able to better decide which one is right for you (or your company). I worked with a few different models and the basic concepts of operation and theory behind what these do are the same across all models, the differences having mainly to do with sizing, capacity and redundancy. Of note here is that this product line is currently designed for use within an organizational network or as part of an email system which services multiple organizations and would represent a ridiculous overkill for home/individual use.
The basic function of this device is email spam protection. Calling this a firewall can be a little misleading at first if you are familiar with the use of a traditional perimeter firewall to protect an internet connected network, but you’ll have to get into the mindset of email or smtp traffic on its own first and then you may be able to relate to this appliance as being on the perimeter of an organization’s email interaction with the outside world and in this way it is true to the traditional definition of a firewall.
Where does a spam firewall fit into your network?
While there certainly may be some different methods of integrating this device into a network to achieve spam protection and to take advantage of some of its other features, such as monitoring and even filtering outgoing email, I’ll stick to a relatively simple implementation here which is designed only to deal with incoming email and protect against spam and viruses which are carried via that medium.
A basic installation of the Barracuda Spam Firewall to achieve our intended purpose would be behind the perimeter firewall. You would typically set up a rule to forward all of your incoming email traffic (everything on tcp port 25, which is smtp) through the firewall to the Barracuda. The Barracuda would in turn forward the email after processing/filtering to the appropriate smtp server (Exchange server if using MS).
How does Barracuda filter spam/viruses?
There are many methods typically used today to combat email spam and viruses and Barracuda combines no less than 10 different methods to identify and process email right out of the box. Barracuda combines rules and definitions dealing with spam and viruses which are contained in its own databases (updated to the Barracuda as often as hourly) and externally available block lists to identify undesirable email.
Here is a quick list and description of each method in the order that the Barracuda Spam Firewall applies them to an incoming message.
-Denial of Service and Security Protection Analysis. This is an initial analysis of the smtp connection being used to transfer email in order to insure that some basic indicators of legitimate email are observed and some obvious indicators of potential spam are picked up on. This entails such things as timing out an smtp session, limiting the number of messages per an smtp session, insuring domains are fully qualified, detecting and rejecting email from domains that don’t exist (fails a DNS query), controlling spoofing by denying external email in which claims it is from the company’s own domain,
-IP Block List. The next thing an email goes through is a comparison of the sending smtp server’s IP address with those on both a number of external blacklists (also called RBLs) and the database of spammers IP addresses contained in the Barracuda’s own software which is updated at regular intervals (called Energized Updates). For external RBLs, Barracuda supplies some popular ones which they recommend to use in your IP evaluations and you can choose to or not, and then allows you full control to add in any custom RBLs as you desire. Messages identified here can be either blocked, tagged or quarantined as spam by the Barracuda although blocking has less impact on performance, tagging will allow a user to still see the email just in case it might be legit and quarantine refers to the email being sent to a separate spam repository for each user which can be perused at the users convenience (kind of like bulk mail if you have a Yahoo email account).
-Rate Control. This simply sets a limit on how many separate connections a particular smtp server can make through the Barracuda within a specified period of time (1/2 hour) before subsequent messages from that server begin to be dropped. This type of activity on the part of a sending server typically indicates a compromised system or a spam system and can quickly mitigate attempts to flood your smtp server with connections which could possibly result in performance impacts or a denial of service. Barracuda allows you to configure IP ranges which can be exempt from this check as well in case you are knowingly performing some kind of smtp relaying into your system which might require many connections.
- Virus Checks. Next occurs a series of scans against a number of different virus definition lists which are contained in the device’s software and are refreshed with energized updates (hourly is recommended).
- User Specified Rules. Following the virus scans any user rules which have been configured are evaluated. These range from specific sender addresses or domains which can be either whitelisted or blacklisted, user defined keywords and characters which are contained in specific parts of an email (subject line, header or body), attachment types which have been specified as unacceptable, and email to specific recipients within your company which should not receive any email (such as people who haven’t worked there for years).
- Spam Fingerprint Analysis. Evaluates email against an internal database (energized updates) for specific fingerprints and patterns which can further identify a message as potentially being spam.
- Spam Intention Analysis. This takes the above step a bit deeper and uses more generalized patterns and consistencies which are likely to indicate whether a message is spam. This evaluation criterion also comes from the energized updates from Barracuda.
- Bayesian Analysis. Barracuda allows this to occur both globally and as catered to individual users. The way it works is that both spam and non-spam messages that have not been identified by any other method are flagged by a user or administrator and these flagged messages build a Bayesian database from which specific patterns are incorporated into an algorithm which is applied to incoming email to help determine whether an email is likely to be spam or legitimate. The usefulness of this type of filtering increases as the database grows in size, and needs user input to be effective (or indeed to become active… Bayesian filtering doesn’t begin until 200 messages are flagged as spam and non-spam.
- Spam Rule Based Scoring. This is where each message that has passed unblocked to this point is evaluated a final time using all of the spam rules contained in the Barracuda’s software (energized updates) and a score is assigned to the message which determines whether the message is blocked, tagged, or quarantined (if this feature is being used) or delivered unhindered.
What is supposed to come out at the end is legitimate email. I think of this as kind of like the sorting machine at an apple processing plant I used to visit as a kid. Apples of all different sizes moved along a conveyor which was tilted to one side with a wall that had an opening underneath that got steadily bigger as it went down the line. Very small apples would fall through into chutes at the very beginning (and get turned into cider), while medium sized apples stayed on the conveyor until further along (those became apple sauce) and the largest ones stayed on until the end and were directed into a bagging machine which packaged those apples for sale as is to the public. Those big apples which made it all the way to the packaging phase represent the legitimate email that eventually gets delivered to the user.
How Well Does it Work.
The system isn’t perfect and some spam still does get through, but in a typical business day the Barracuda blocks or tags about 70 to 75 percent of all email it receives and on a weekend about 90 to 95 percent. That’s a lot of spam which would be getting through without this device. I’ve seen these numbers skyrocket within the last five years and cannot even fathom how we once existed without a spam firewall at all… (just prior to purchasing it I had been in the habit of identifying patterns and keywords from the spam I received each morning and manually loading the resulting rules into the network firewall. I had also been writing rules to check with specific RBLs. Needless to say they were going to quickly need more than one of me to maintain any kind of perimeter against spam keeping these rules updates manually).
The User Interface.
I won’t get too deep into the user interface here as much of the functionality that it offers has been touched on in my above description of the process. There is web based GUI to control all settings and configuration for the Barracuda Spam Firewall. It is intuitive and easy to navigate. Other than setting up configuration parameters the GUI provides you a graphical representation of email statistics and general heath of the appliance with things like fan speeds, CPU temperature, usage of storage space, and average system load percentages and latency times. Another key feature of the GUI is the message log which creates a log of every inbound smtp message which traverses your system. You can choose to be able to view the message bodies or not and GUI access can be set up to run in https which is recommended if you plan to be able to see email contents. This is very useful for troubleshooting and tracking requests from specific users to investigate spam they are receiving, or legitimate email that is being blocked or tagged as spam. It also has potential for abuse and as such access to the GUI should be restricted to only those who absolutely need it and are absolutely trusted within any organization.
Summary of Differences Between Models
All models of Barracuda Spam Firewall operate according to the above methodology. The variations between models are in capacity and additional features which allow them to integrate more easily into the large enterprise.
Model 200
The most basic model which is the 200 has standard features and capacities which are equaled or bettered by higher models. It can support up to 500 active email users, can process 1 million emails per day, and support 50 domains. It has rack mountable chassis and comes with 1 ethernet 10/100 port and has a built in hard drive for storage of the message log and firmware. Globally quarantined messages are sent to an email address and thus stored on the Exchange (or other email system) server. There is no individual quarantine support. The 200 is compatible with all email servers, is built with a hardened and secure linux OS, and can filter outbound as well as inbound email.
Model 300
The next model up offers all of the above and adds capacity for up to 1000 active email users, can process 2 million emails per day, can handle email for 250 domains and has a 10 gb hard drive for storage of the quarantined message database. It also adds LDAP support, allows for individual users to have their own quarantine stores and settings, and supports syslog.
Model 400
Supports up to 5000 active email user accounts, can handle up to 5 million messages per day, will route mail to 500 different domains and has 50gb available for quarantine storage. It also adds the ability to cluster devices, has raided hard drives and offers the ability to set domain specific settings. It also supports single sign-on and has an SNMP/API.
Model 600
The 600 improves again on the 400 by handling up to 10000 active email accounts, processing up to 10 million messages per day, support 5000 domains and has 100gb of quarantine storage. It also comes with 2 x 1000mbs ethernet ports and in addition to raid adds ECC memory. It offers customizable branding and per user spam score settings.
Model 800
The top of the line model consists of a 2 unit rack mountable appliance which comes with hot swappable raided hard drives and hot swappable redundant power supplies in addition to all the features offered with the 600. It supports 22000 email users, 15 million messages per day and stocks 200gb of quarantine storage space.
Of course clustering (available from Model 400 and up) can increase these capacity numbers by multiples depending on how many units are clustered.
Some Key Considerations
Energized Updates
The Barracuda appliance, as exciting as it sounds, doesn’t stand well on its own. At least as important as the device itself is having the availability of energized updates which contain virus definitions and spam lists, rules, scoring, RBL lists etc from Barracuda which can be updated as often as hourly (usually the virus definitions database is updated 2 to 3 times per hour). The system would quickly become obsolete without these timely updates to its arsenal of spam and virus defending weaponry as fighting spam is all about keeping current up to the minute. Barracuda receives information from its installation base of Barracuda firewalls (if yours is so configured, they all are by default) which allows the company to constantly refine their spam databases and pattern algorithms using real time information incorporating new variations as they begin to propagate the internet. This service can be purchased as a contract from Barracuda and is an integral part of this spam solution.
Firmware Updates
These work in a similar way to the energized updates except deal exclusively with the firmware running your Barracuda. The company has been growing rapidly and improvements and bug fixes to the code are being released on a fairly consistent basis. This is a convenient and efficient way to stay abreast of these patches and releases and the whole process of firmware upgrades can be performed in a few minutes from the web bases GUI.
Backup and Redundancy
For models which don’t support clustering (models 200 and 300) the prices are probably low enough to consider keeping a hot spare on site in case of failure. You will find that your spam firewall will quickly become an indispensable device within your corporation and running without it for a day would amount in users being virtually buried in annoying spam. Barracuda does offer a next day replacement contract, but that one day wait could prove critical to you peace of mind (if not your job) so for the model 200 which runs about 1000 dollar I would recommend having a spare. The configuration can (and should) be automatically backed up nightly via an FTP transfer to an FTP server in your network which would allow you to reload all of your settings into the spare in the event it needed to be put into production.
Conclusions and Recommendations
There are many spam firewall products on the market today as their need has exploded over the last couple of years. Barracuda has always priced itself competitively and as a result has earned market share and the company has grown rapidly. This isn’t always good for any company in terms of innovation and service, but Barracuda has managed thus far to ride the wave and improve as they have grown.
For anyone looking at Barracuda’s line of spam firewalls the prices are quite competitive for their entry models, but of course rise considerably as you go up the ladder. With the speed of the technology development cycle of these products thus far it is certainly advisable to consider only acquiring about as much capacity as you require at present. Thus if you only have 500 users, you’ll probably be throwing money away by acquiring a model that supports 5-10 thousand users because by the time you are able to take advantage of that capacity there will likely be a whole new model line available to move to… and at a better price.
