Summary of the Functional Differences Between NetScaler Application Firewall 8.0 and Application Firewall 5.5

Summary

This article describes the functional differences between Citrix Application Firewall 5.5 and Citrix NetScaler Application Firewall 8.0.

Detailed comparison

As of May 2007, the General Availability release of NetScaler Application Firewall 8.0 has many functional differences from Application Firewall 5.5. NetScaler Application Firewall 8.0 has many new features and improved performance over Application Firewall. Refer to the following outline and table for more information:

High-performance NetScaler operating system Application Firewall:

• Integrated as a module in NetScaler 8.0

• Also available as a standalone device

Offloads all network housekeeping to the NetScaler operating system:

• TCP Session Management

• Distributed Denial-of-service (DDoS) Protection

• SSL Termination

• Compression

Improved performance:

• NetScaler Application Firewall basic mode is up to 10 times faster than Application Firewall 5.5 Standard Edition

Policy engine integration:

• Greater flexibility in security policy creation

• Uses feature-rich, Perl-compatible regular expressions instead of basic POSIX regular expressions

Network and Application Management

NetScaler Application Firewall 8.0 provides additional deployment options within a network for more flexibility. Refer to the following table:

Deployment Options

NetScaler Application Firewall 8.0 supports routing traffic across multiple VLANs both in front and behind the Application Firewall. Also supported for specific deployment scenarios is using a single interface for all incoming (WAN), outgoing (LAN), and management instead of the mandatory three interfaces required by Application Firewall 5.5. Finally, NetScaler Application Firewall 8.0 can also work in a transparent layer 2 bridge mode where IP addresses are not required to route traffic.

Some functions available in the Application Firewall are not yet implemented in NetScaler Application Firewall. The following table lists the most significant ones:

ICSA Certification testing is in process and certification is expected soon.

FIPS L2/L3-compliant NetScaler 9000 hardware will be available in Q3 2007.

NetScaler Application Firewall 8.0 currently supports Uniform Resource Identifier (URI) and header rewriting. Full URL body rewriting will be available in a later release.

Citrix NetScaler Command Center (an optional product) is required to manage NetScaler Application Firewall 8.0 clusters.

Performance Chart