At my company, we are currently using TradeShield / iShield as our gateway to the internet. It is also our DHCP server, content filter, and internet usage monitor. However, I find that the software really sucks. I doesn't doesn't meet our needs, and I would like to replace it.
What I require in a replacement software package or hardware appliance, are the following features:
- an HTTP proxy, for caching of HTTP traffic, to reduce bandwidth costs, and improve speeds for commonly accessed sites.
- a DHCP server which allows fixing of IP addresses to specific MAC addresses
- assigning of friendly names to MAC addresses (e.g. : SalesPrinter, CCTV-PC, PastelServer) which will be used throughout the software.
- ability to setup "accounts", where an account is simply a list of MAC addresses linked to a user. The idea is to link a user and all his devices (i.e. MAC addresses) to an single account - this will allow him to connect to the network through his desktop, laptop, mobile phone, etc
- a monitoring tool, to monitor bandwidth usage by MAC address, or by "account"
- the ability to set usage limits per MAC address, or "account".
- a website/content filter, to filter out porn sites, warez/crack sites, etc.
- firewall (SPI, intrusion detection, etc...)
The main point is that we need to be able control internet usage on our local network, as well as act as our Gateway/Firewall to the internet. The network has about 30-40 users/machines, with some people working from home.
Problems I am having with my current solution: once TradeShield "sees" a new device on the network, it will pick up its name, and that name will remain forever linked to the MAC address of the Device. So for e.g. if I install a new PC, but don't change the default computer name assigned to it by Windows, and then connect this machine to the network, TradeShield will pick up the default name, e.g. Acer-User322304, and remember it forever. Now in the usage reports, I have several machines called Acer-2390..., or other weird names that make no sense, and I can't change this. So it's very difficult to figure out who the culprits are, without maintaining my own list of MAC address to User mappings.
Also, I am unable to allow usage of certain ports to only specific people. For e.g. some people have access to IM, but not email. I need to be able to configure such rules on a per-MAC address basis.
I believe what I am looking for is called a "Network Security Appliance" - this is a dedicated hardware device. However, I am also interested in Software Solutions. Currently, TradeShield runs on a Linux box, and I it would be nice if I could find a software solution that will also run on Linux.