Clearswift MIMEsweeper SMTP Appliance EN10

Clearswift made the move from security software to appliance based solutions only a year or so ago but the end result is a product family that delivers an excellent range of features. It built these products from the ground up as rather than use its existing MIMEsweeper software, the appliances all run a heavily customised Linux kernel.

Along with standard SPI firewalling they provide a solid serving of message security with web content filtering, anti-spam and anti-virus measures on the menu. The kernel has recently been updated with v2.4 delivering plenty of new and improved features.

The appliance family now consists of five products with the EN10 on review targeting enterprises scaling over 1,000 mailboxes. Some vendors think they can get away with nondescript boxes cobbled together from obsolete components but Clearswift gets a pat on the back for its choice of hardware platform. It has opted for good quality Dell rack servers across the board with the EN10 using a PowerEdge 1850 1U chassis as its foundation. The hardware specification isn't to be sniffed at either as the price includes a pair of 73GB Ultra320 SCSI hard disks in a mirrored array.

From experience we can say that Clearswift's appliance is a lot easier to install than its Windows MIMEsweeper software. Point a web browser at its default IP address, follow the wizard based setup routine and you're up and running in a few minutes.

We had no problems on our test network as we provided the appliance with the IP address of our internal mail system and modified our clients to use it as an SMTP server. High availability is an important new feature although Clearswift has implemented a far simpler system than alternatives that use mirrored appliances and heartbeats. You can place multiple appliances on the same network and merely create a new DNS MX record for each one. Each has a different priority so if the primary appliance fails then the secondary one comes into play. Peer grouping is also new and groups appliances together using their IP addresses. This allows security policies to be replicated across all appliances simultaneously so they remain synchronised.

Clearswift's web browser interface sets it apart from the masses as it is extremely well designed and very easy to use. Each function has been separated into different Centres and the home page opens with easy access to each one and a quick status summary of the appliance. Clicking below the graph takes you straight to the System Centre and a detailed health readout on the appliance itself plus all message related activity. Policies define how the appliance behaves and it can start filtering straight away as a predefined active policy is created during the quick start process.

Clearswift's filtering policies employ a combination of content rules and routes which tell the system what to look for, how a suspect messages should be handled and who should be notified. Usefully, the appliance comes ready with a pile of preconfigured rules allowing new policies to be swiftly created.

Routes can be anything from an individual user to all outbound or inbound messages and things are made even easier by the inclusion of pre-defined references for use in rules. The latter could be a message annotation such as a company disclaimer, a list of filenames to be detected or multiple quarantine areas defined for different routes and rules. It's also worth noting that unlike many other messaging security products Clearswift can scan inside message attachments such as PDFs and Office documents.