I just finished a hellishly large test for Network World of enterprise-class UTM firewalls. You’ll be able to read the full results in print and online Nov. 5. One of the tough questions I had to wrestle with is the definition of UTM when it comes to these gigabit behemoths.

In the SMB environment, UTM is pretty easy: firewall, antivirus, maybe IPS and antispam, content filtering, a handful of VPN tunnels. But at the enterprise level, it’s nowhere near as clear. I talked to a lot of my consulting clients, and while some were interested in some UTM features — IPS mostly — there was a lot of hesitation about piling anything new on top of existing firewalls.

Some of that fear is well-founded. For example, in the area of antivirus, most firewalls (SonicWall’s PRO is an exception) scan only a handful of protocols on predefined ports. You’re not scanning nonstandard protocols; you’re not scanning nonstandard ports; you’re not scanning encrypted traffic. Sure, there’s some value there, but is the value great enough to make it worth the cost and performance hit?

My conclusion is that the most likely scenario for additional protection in the enterprise firewall is going to be IPS, a natural and complementary technology. By coincidence, last week Gartner released its most recent “Magic Quadrant” on enterprise firewalls with a similar conclusion. Of course, Gartner had to create a new term for it, specifically tossing UTM to the SMB and branch-office market and calling these enterprise-sized devices Next-Generation Firewalls. But the conclusion is the same: At the high end, the norm for UTM will be IPS and not much else.