CHANNEL PROS have many questions as the rollout of COVID-19 vaccines promises a light at the end of the global pandemic tunnel. One of the first and most important is, “What will the new normal look like?” Everyone has a different answer, some more optimistic than others, but it distills down to a simple response: “It’s complex.”
Businesses of all sizes have found ways to keep people working during the crisis, which includes shifting as many employees as possible, sometimes entire operations, to remote work-from-home scenarios. That has triggered or accelerated the move of on-premises infrastructure to the cloud. It has also introduced massive security challenges to protect users as they work from insecure networks and devices. Pre-pandemic, many business owners never entertained the idea of remote workers. Now they face a reality that flexibility could very well spell survival in the future, and may be demanded by those same employees who have grown accustomed to working from home.
SMBs face the challenge of scaling their networks to support flexibility while keeping users secure. In all likelihood, their existing firewalls aren’t up to the task. Zyxel Networks hopes its USG FLEX network security appliances will win the day with higher performance, flexible licensing, and top-rate security.
Overview
The USG FLEX is a series of unified threat management (UTM) gateways, henceforth referred to as “firewalls.” Zyxel debuted the series earlier this summer with the FLEX 100, FLEX 200, and FLEX 500 models, and has recently added a wireless variant of the FLEX 100 and a higher-end FLEX 700. As you go up the chain, the feature set remains consistent (with the exception of AP management in the 200-plus models and the wireless capabilities of the 100W), but adds LAN/WAN ports, throughput, and concurrent VPN connections. This review focuses on the entry-level USG FLEX 100.
On the Outside
The first thing you’ll notice about the FLEX 100 is that it’s compact (8.50 x 5.80 x 1.30 inches), but with a solid feel and weight that imply quality. The exterior is silver metallic nearly all the way around, with red accents on the left and right sides of the front. There are ample cutouts for ventilation along the top and sides, which is important given this model is passively cooled.
The front face sports status indicators for the various ports, a reset button, and a USB 3.0 port for the addition of external storage or a 3G/4G modem. The business side is on the back, where you’ll find four LAN/DMZ ports, WAN port, SFP port, RJ-45 console port (it does include a serial adapter in the box), power connector, and power button (pictured right).
The FLEX 100 isn’t rack-mountable (other than the tray) given the size, but it is wall-mountable via the holes on the bottom, and also includes rubber feet in the box for placing it on a shelf or desk.
Setup and Configuration
Zyxel put a lot of effort into simplifying the setup and operation. It was box to UI in less than 10 minutes, and most of that was setting up a Zyxel account and registering the device to activate the various licenses (more on this later).
Other models in the series sport multiple WAN ports, but it’s important to note that the FLEX 100 can be configured with multiple WAN scenarios thanks to the SFP/OPT ports and support for 3G/4G USB modems. There are multiple algorithms for load balancing, as well as fallback options.
The UI is clean and attractive, adopting a web feel with major sections in tabs on the left and subsections along the top. It’s great to see companies like Zyxel working so hard on the user experience, as generally firewall UIs often look like 90s holdovers with simplistic hierarchies and endless checkboxes.
The most impressive section is the dashboard, which gives a bird’s-eye view of important information like active sessions, logged in users, and Tx/Rx stats (pictured left). The Threat Protection tab highlights important security information on scanned traffic, including an overview on any threats encountered.
Don’t let the small size fool you. The FLEX 100 is a full-featured firewall and threat detection device, and that means a dizzying amount of configuration options. Zyxel has managed to make the configuration area navigable and a little less overwhelming, but with it all crammed in one place it was hard to avoid the sprawling menu tree of options. It works, though isn’t always intuitive, as you’ll often have to click around to find what you’re looking for.
Flexible VPN
The FLEX 100 supports the latest VPN protocols including IKEv2, IPSec, SSL, and L2TP/IPSec. With remote access so important right now (and likely going forward), Zyxel has made setting up VPN connections easier (don’t mistake that as calling it “easy,” though) through some wizard-like walkthroughs to speed up and automate some of the process (pictured below).
Given the size business this firewall is targeted for, its VPN chops will be quite an upgrade for many. It’s rated for 270 Mbps VPN throughput, and can handle 40 concurrent VPN tunnels, 30 SSL VPN users, and 64 concurrent logins. Models up the chain can handle additional capacity.
Security and Performance
Like most UTM appliances, the FLEX 100 has a lot of important security features, far too many to cover here in detail. Among the most important are a stateful packet inspection firewall with highly configurable policies, as well as anomaly detection and prevention with customizable profiles. The Application Patrol service allows for certain applications to be prioritized, throttled, or blocked outright. A powerful content filter has extensive configuration options to block content, URLs, and more, and there’s an anti-malware feature to scan files. Intrusion detection and prevention (IDP) with deep packet inspection (DPI) can be enabled to detect threats, like hacking attempts, from nefarious third parties (albeit at a significant impact to performance). There’s a robust email security service as well.
All of that can feed back data (in anonymous, semi-anonymous, or full detail) to view in Zyxel’s SecuReporter tool in the cloud, which provides centralized visibility of network activities, further threat analysis, and the information needed to help prevent future threat events.
That’s just the tip of the iceberg, but it’s important to note that most of these are locked away behind yearly licensing. There is flexibility, however (hence the FLEX in the name), as licenses can be purchased individually or in a bundle (in most regions), and even transferred from older USG devices.
With a firewall, it’s hard to talk about security without also talking about speed given that turning on security features negatively impacts performance. There are some bold performance claims, and Zyxel relies heavily on its cloud query service to pull them off. The FLEX 100 not only offers impressive UTM performance, but also a higher detection rate.
Throughput is where the rubber meets the road for firewalls, and the FLEX 100 doesn’t disappoint. The SPI firewall is rated for 900 Mbps throughput, which is in line with my testing. Enabling IDP or any feature that requires DPI will chop that number to the low 500s, while enabling anti-malware will drop throughput into the mid 300s. That’s impressive for a fully unified threat management appliance, and actual performance will improve as known apps, services, signatures, and URLs are whitelisted from impacting performance.
Summary
People may someday soon get a vaccine for the coronavirus, but SMBs will need a shot of powerful networking, VPN, and threat protection capabilities to survive in the post-COVID world. The Zyxel FLEX 100 may very well be the cure your customers are looking for.
SPECIFICATIONS AND PRICING (Courtesy of Zyxel)
MODEL—USG FLEX 100
PRICING … $259 for hardware only; $375 with a 1-year license bundle
FEATURES
0/100/1000 Mbps RJ-45 ports … 4x LAN/DMZ, 1x WAN, 1x SFP
USB 3.0 ports … 1
Console port … RJ45
SPI firewall throughput … 900 Mbps
VPN throughput … 270 Mbps
IDP throughput … 540 Mbps
Concurrent SSL VPN users … 30
Security features … Anti-malware, IPS (IDP), Application Patrol, email security, web filtering, SecuReporter Premium
Dimensions (WxDxH) … 8.50 x 5.80 x 1.30 in.
Weight … 1.87 lbs
