UserGate: What This Corporate Security Gateway Can Do

UserGate started in the 2000s as an office proxy server: share internet, count traffic, close entertainment sites. Since then the product has grown into a security gateway the industry calls an NGFW, or next-generation firewall. The name stayed and the class of tasks changed, and it is most interesting as a representative of that class: all modern corporate gateways are built in a similar way.

Its place on the network

The gateway sits at the border: all office traffic to and from the internet passes through it. Hence both its abilities and its responsibility: this is the easiest place to filter, count and protect, and also a single point of failure, so larger configurations run as a redundant pair. It ships both as hardware and as a virtual machine, and mid-size offices usually do well with the virtual version.

Main modules

The key word everywhere is "user". The gateway integrates with the directory service, and rules are written for people and groups instead of IP addresses: one thing for accounting, another for development, a third for guest Wi-Fi. TLS inspection deserves a separate caveat: technically it is a managed opening of an encrypted channel with certificate substitution, which requires installing a corporate certificate on devices and honestly informing employees. Banking and medical categories are normally excluded from inspection.

Policies tie the modules into scenarios. A real-life example: the marketing group may use social media but cannot upload files there; contractors get only a list of work services; everyone else has file sharing and freshly registered domains closed, a favorite phishing tool. Each rule comes with a report, so the argument "I need this site for work" gets settled with data instead of raised voices.

Who needs it

• Companies with regulatory requirements. For Russian organizations it matters that the product is certified by local regulators and remains supported.
• Educational institutions. Mandatory content filtering is handled by built-in categories and blacklists.
• Offices of fifty people or more. Below this threshold a good router usually suffices; above it begins a zoo of shadow services that stays invisible without application control.
• Networks with remote work and branches. VPN, unified policies and reports in one place.

Open alternatives to this class exist: pfSense and OPNsense cover the firewall and VPN for free, and plugins add filtering. The cost comes from opposite directions: open solutions cost administrator time and hand-built reporting, commercial ones cost money for module subscriptions. What usually decides is people ready to live with a solution for years, more than features.

How companies choose and deploy

This class gets bought through a pilot on your own traffic rather than a feature list, since all vendors look alike there. Deploy the gateway in monitor mode, with no blocking, for two weeks: reports show the real traffic picture and the load. The main figure to take from the pilot is throughput with TLS inspection and IPS on. Datasheet throughput is measured without them and falls several times with the full set of checks, and this is where people get hardware sizing wrong. The second pilot result is a list of what to exclude from inspection, from banking clients to video calls, and each company has its own.

1. Define the policy in advance: what you block, what you watch, whom you leave alone. A gateway enforces policy and does not replace it.
2. Count users and peak bandwidth with two years of headroom: licenses and hardware are bought for growth.
3. Check integration with your directory service and how the network tolerates a gateway failure: do you need a bypass or a redundant pair?
4. Clarify the subscription contents: filtering, IPS and antivirus databases are licensed as modules, so the bare box price is misleading.
5. Appoint an owner. A gateway with nobody reading its reports turns into an expensive router within a year.

Do not confuse it with commercial proxies

A corporate gateway and proxy services like ours solve opposite tasks, even though both are called "proxy". A gateway controls your employees' outgoing traffic: visibility, filtering, discipline. A commercial proxy changes the exit point for work tasks: geo data, address pools, accounts, as we covered in our review of proxy server tasks. The first is about "we see and limit our traffic", the second about "our traffic looks the right way from outside". In a mature company they live together calmly: a gateway at the office border, address pools with marketing and analytics. The gateway should know about colleagues' legitimate pools, or one day analytics will run into its own security system, and fixing that misunderstanding will take longer than the whole setup. We showed where such a gateway fits in the rest of the server infrastructure in our overview of server types.