Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there such thing as an Antivirus appliance that would sit at the top of your network and identify/block threats? I'm just thinking that it would be nice, if all the traffic is being scanned by the antivirus software on individual computers anyway, to just have an appliance instead of rolling out software and virus definitions to every computer on the network.

share|improve this question
up vote 5 down vote accepted

Many different firewall appliances provide antivirus protection at the perimeter of your network. However, perimeter protection vs. endpoint protection is not an "either/or" question.

Two examples might help to illustrate the point:

  1. A perimeter firewall cannot protect a workstation from an infected USB device or CD-ROM, nor can it protect against infection from another computer on your internal network.

  2. The vast majority of antivirus firewalls in today's real-world installations either cannot or do not decrypt SSL traffic (e.g. for lack of a trusted wildcard certificate) and therefore cannot protect against malware delivered via HTTPS.

Decent enterprise-grade antivirus software provides simplified tools to deploy, manage, and monitor your network's antivirus protection. Definitions can be downloaded once to a server and propagated throughout your network. I normally recommend ESET NOD32 antivirus, but any top-tier enterprise antivirus product should provide decent tools for centralized monitoring and administration. I would encourage you to do your own research about feature sets and performance.

Be aware that some enterprise antivirus software performs extremely poorly in terms of detection/removal rates. Additionally, some of the most popular antivirus products may result in unacceptable system performance, particularly on older workstations and busy servers, even if you enable exclusions for legitimate applications and services. Try before you buy.

share|improve this answer
Miles, very good explanation. We currently have Symantec End Point and aren't happy with how it crushes the performance of the PCs. I've tried to get the boss to consider ESET in the past, but he had never heard of them and they were more expensive so he decided against it. One thing tough--isn't is kind of an either-or deal? What is the point of having an appliance if the endpoints still need protection? The traffic is just being scanned twice then. – Sam Mar 9 '12 at 0:15
@Sam: Belt and suspenders. – Evan Anderson Mar 9 '12 at 3:47
The current anti-virus product that you mentioned is one of the worst offenders in terms of performance hit, both on workstations and on servers. If you are interested in demonstrating another antivirus product to your boss, be sure to ask the vendor for a free trial. Most antivirus vendors are very happy to provide 30-day trials (sometimes longer if you ask). Especially if you have 100+ seats, remember that all AV subscription prices are negotiable and that major discounts are commonly available. You can ask for 3 years for the price of 2, new install for the price of a renewal, etc. – Skyhawk Mar 9 '12 at 3:55

There are hardware/appliance devices from the likes of Barracuda or Watchguard, or for example you could repurpose an old box (preferably a server) and run something like Untangle (with Kaspersky addon) or pfSense with HAVP package.

However, I would only ever think of such devices as an extra layer of security against virii. Even if you had a totally perfect product filtering for any (un)known virus at your network perimeter, that doesn't help if one of your internal client machines gets infected and tries to infect the rest of your machines.

Bottom line, every machine needs to be adaquately protected.

share|improve this answer

Look around on Juniper's and Barracuda's products. They have plenty of products for this

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.