What is our primary use case?
I use it as a service for my customers. My primary target is to help my customers in the best way to protect them from the dangerous things from the Internet. As a solution, it's easy to maintain. The product is a good solver that also depends on good support and its availability of engineers.
I am using the latest version of Kerio Control. It is an old type of configuration with VPN connections. I still like the product very much.
It is mostly installed on the Linux software appliance. That's what I mostly use for my customers.
How has it helped my organization?
Most customers are not able to understand the technology behind it. I am always trying to explain it to my customers. When I show my customers the interface of Kerio Control and all the reporting features along with the security features within the logging, they're very impressed. I have a very good relationship with my customers because this is mostly based on trust. I show them, and if they have doubts, I always say, "Just hire somebody to check my work." For example, a year and half ago in the travel industry, there were new rules for travel agencies who give out credit cards that they must comply with PCI DSS standards. There were some things that had to be adjusted and Kerio was able to adjust for that. So, it met the demands of PCI DSS standards.
When one of the employees of my customers was using a VPN Client, I created it so they will always get a message. When the VPN Client connects to Kerio Control from the outside, they will get an email so they know when they are connected and when they are disconnected what is happening to their network. I can, as an administrator, look in the logging and see what's happening. If I really wanted to manage what is happening over a month, then I could go deeply within Kerio Control and make a text file of the logging. I could then order an export to Excel to give the customer an impression of what is happening.
Our customers don't want to worry about their IP. If it's implemented well, Kerio Control is very good product for this.
What is most valuable?
- Ease of use
- Ease of install
- Ease to recover
- The load balancing is very easy to maintain.
The login appearances are very strong. In case of problems, you're able to find anything you want. I am always able to help my customers. I really love this product. It's very good. With its many features, there is no comparison. Over the years, I have seen other types of firewalls but they don't have these functionalities within them.
You can create your users, groups, IP addresses, IP groups, and make rules. It can do protocol inspection and load balancing. You can have a backup line where all kinds of scenarios are possible.
It has security features, like an open source Internet protection system. This is well-known and a good solution to protect you from guys who try to hack systems. They have also integrated a fire scanner, a protocol inspection, and web content filter. You can adjust things depending on the types of organizations who are using it. Over the years, it has been very easy to maintain.
I haven't seen anything else that compares to the comprehensiveness of its security features because I'm working mostly with small to mid-range offices. Manageability is very important, and that is possible with it.
Kerio Control's firewall and intrusion detection system, Snort, uses tables that are available on the Internet and loads them automatically. Over the years, I never had problems with my customers. The stability is very important for the product. I use Kerio Control as a central security system for my customers. On the workstation, I mostly use a virus scan. There are also multiple virus detections through your firewall.
The VPN Client for users is a strong feature within Kerio Control. An important thing within the VPN Client is it also has the possibility for two-factor authentication, which I really like. For some customers, this is very important.
I like its malware features.
This is a very robust the product.
What needs improvement?
With Kerio Connect, they blew it. They were not able to pace up with the competition. I am working with a variety of customers: lawyer offices, travel agencies, big shopping mall accounts, and small accountancy offices. They have all kinds of needs. Kerio Connect did a new launch in the Netherlands for the ACG and GDPR, which are very strict for some companies, like lawyer offices. It is important within the mail server product that you're able to encrypt your attachments and have two-factor authentication. All these type of things are not within Kerio Connect. Therefore, this product is not interesting anymore for my customers since the Dutch law is that strict. For example, there was a judgment from a judge this year when a company was hacked. There was a guy who maintained this network gave some advice to the customer, but the customer would not pay for that solution. He was held responsible for about 60 percent loss of this business, because there was a ransomware within in the organization. These are the things we have to deal with in the Netherlands and in Europe. Within the Netherlands, this is a very important thing, so you can probably understand how important it is that the product is okay with the market demands.
After the takeover by GFI, one of the things that Kerio built was MyKerio environment. This is a cloud solution to have an overview of the statuses of all the firewalls that you maintain. When a firewall or primary interface goes down, then you get messages. It also has an app for iPhone or Android. You can then have a quick view about the status of the firewalls for your customers. If there is a problem with the Internet connection, whether it is down or there is an update, then you get a message. So, I can proactively help my customers. However, after the takeover, this has not been very reliable because I get many messages that MyKerio is not functioning. For some reason, there are things that they changed and it is not very reliable at this moment, instead I have to connect to the firewall to see what is happening.
MyKerio is a cloud thing where you can easily see all the firewalls that you maintain for your customers along with the statuses behind them, providing a way to securely connect to your firewall appliances. This is a very strong feature of MyKerio. However, nowadays, I'm not really impressed about things they do with it. That needs improvement in my opinion.
Another thing is that you must be a specialist, like me, when you want to have more specific information, e.g., when there are incidents or things that are happening that need investigation, then you need to go to the shell prompts and logging, where you can perform anything. You can edit anything out of your log files. However, this is not possible within the Kerio Control admin interface. You can only search for one thing, but not for many things.
Kerio Control has a very good future, but it needs good marketing and knowledge around it.
For how long have I used the solution?
I have been working with it since the beginning (1997). When it started, it was called WinRoute. Now, the name is Kerio Control.
What do I think about the stability of the solution?
It is a very stable product, which over the years has been very good.
What do I think about the scalability of the solution?
The scalability is good. The VPN connections may need improvement. Because of all the security features within Kerio Control, e.g., it can do a deep packet inspection, this can slow down the traffic. Sometimes that creates a problem. For example, Kerio Control offers protocol inspection for the services that are available, and sometimes that gives problems because people are complaining that it is slow. The VPN connections from remote are not always very fast, so I think the throughputs of the VPN need improvement.
How are customer service and technical support?
In every software, sometimes there are problems. One of the strong things about Kerio was the support knowledge and the involvement of the employees within the support department. I used to have the impression that the people working there were part of the products. It was almost a pleasure to have contact with people who were really involved with the products. After the take over of Kerio Control and Kerio Connect by GFI, it was really disastrous because a lot of the people involved were gone. When I had a problem and I asked for support, then they are asking me questions that I think help, but they don't understand the product. This is logical, of course, because there was a takeover.
The GFI product support for Kerio Connect has been unacceptable for my customers and me because I had major businesses that were running with this software and very satisfied because of the user-friendliness. Error and problems cannot be cured, but they must be solved. For example, when I perform an update, the next thing will be a ruined email system, but nobody will be available for support. This is also when they know that an update is coming and I am calling after updating it. They promise to support us, but there is no support, which is terrible. This is the thing that I feel is very important when you use business-critical software, and they need to improve on. I want to be able to call their support and reach someone who has knowledge about the product.
It has a very sophisticated logging system. I need to be able to connect to the engineers behind it, who develop it, and tell them, "Okay, that's wrong." If I'm not able to connect to first level engineers and make them understand that they're not able to help me or they need deeper knowledge of the product, then there is a problem. While this is not an issue with Kerio Control because they have proven with the product that they are able to maintain it, the major problem for me with Kerio Connect was they ruined things in the past and I was unable to go back. So, I'm very interested in how they are improving the support to make things work again with MyKerio, as it is very good feature.
Which solution did I use previously and why did I switch?
I have worked with all the firewall systems, like Cisco. I see how people struggle of with it and also how much effort it takes to maintain it and implement rules. Kerio did a very good job with that. You can also, in a quick way, see inbound and outbound traffic and make your own filters.
How was the initial setup?
A basic initial setup is very simple and straightforward. They offer a straightforward set of rules to make it work, then you can create all the rules you need for the customer depending on their demands. It can do almost anything.
The deployment time frame varies. For example, if I am deploying to a shopping mall, that shopping mall has all kinds of offices. Every office has its own demands regarding the IP system that they use. Every shop has its own software supply and concepts. Sometimes things get complex, then I start from scratch to make sure everything is maintainable, but this is very easy in Kerio Control if you know how to do your job.
Because of the coronavirus, for people who want to work at home, it is very easy to set up VPN Clients because that is a piece of cake.
What about the implementation team?
When you look at Kerio Control, they are able to maintain it in a way that I had no problems because I was always careful with updates. I first test them on-premise before I roll it out to my customers. That's also no guarantee, but we are able to maintain it in a good way.
Implementation strategy changes per customer. Some customers have very strict policies about the sites that they can access via the Internet. Others have limited bandwidth. For example, I had a customer who could not visit some Internet sites because most of my customers have two Internet connections. I found out that connecting through the other interface wasn't a problem. It had to do this with the networks between them. It's very easy in Kerio Control to make another path where another Internet connection is used for that website.
I built a large network of freelancers over the years in the Netherlands and foreign countries to get the best solution for each customers. I am working with all types of people who are trustworthy and have good knowledge of the product. I tell my customers, "The IT world is the same as the medical world. You don't go to a heart specialist for an eye operation, and you don't go to your normal doctor for a heart operation. They're all specialists on their specific terrain." That is the way I operate for my customers.
I handle the deployment and maintenance of Kerio Control myself.
What was our ROI?
I have seen ROI over the years. It is part of the complete solution that I offer to my customers. Over the years, it has offered me a reliable platform for my customer and allowing me to build trust with my customers. That's the most important thing of Kerio Control.
If the support is not good, then I have a problem with my customers and it will cost me money. That's one of the things that GFI did after the takeover: It cost me a lot of money. Because there were a lot of problems, not with Kerio Control, but with Kerio Connect. It really cost me with unsatisfied customers.
What's my experience with pricing, setup cost, and licensing?
It's not a very expensive solution from my point of view. Because it is not only about buying a product, but how much time does it cost to implement the features that the product offers? I haven't found another product that is able to do the things that Kerio Control can do for the money.
It is a good fit for SMBs because of its maintainability. When you want to keep your costs low, then Kerio Control is a very good solution. It's not an expensive product that is well integrated. It has a complete set of features within it that make it a very strong product.
GFI has made a stupid decision regarding small office licensing. For offices where there are only three to five employees and had five years towards a five user product, they now force these customers to a 10-year user license. I really don't understand it. It's a stupid decision for the small offices who want a good solution for security because they'll probably decide to go to another product. Why should they buy something that they don't use?
I don't use the Kerio hardware because they're too expensive and difficult to maintain.
Kerio Control has the ability if you buy it (it's a separate option) to know malware sites. Then, they will be blocked and the user is informed.
Which other solutions did I evaluate?
I have used Cisco, FortiGate, pfSense, and then more simple router things that have integrated software. However, mostly in business, I don't want to use just a router with integrated software. I don't believe in that concept. My customers are of a size that the stability of the product and the way it is maintained are very important to me. That's one of the strongest things about Kerio Control. It has proven to me over the years, and with my customers as well, that it's a very stable product. I haven't seen another product that compares to it within its price range. However, I also have to help my customers when they are having problems when connecting to a site or when they are having problems in general. When I contact their IT to find out what's happening on their side, it is difficult to get an answer why things are going wrong.
I can't find a comparable product to Kerio Control that offers the same set of features for the same money.
I found another product that can do a lot more than Kerio Connect, and that's IceWarp. IceWarp is a very strong product. IceWarp is a really strong competitor within this market. I was impressed with the software's ease of use because it's completely web-based. It's not only a mail server product, which offers secure attachments with out-of-the-box Office, but offers two-factor authentication. It also has a web-based text editor and Excel sheet, where you can make a basic presentation. With the same interface, there is the possibility to do OneDrive or Google Drive. They built it with the same depth that you need to log in to your IceWarp environment as a user. You can store your documents and sync them with a Mac or Windows PC. However, there is not much to find about this product.
What other advice do I have?
Kerio Control is very good. The way that you can maintain it, it's very easy. I had an employee who built a copy of the product, which was a very basic interface for the open source community. You can find it on the Internet. He was impressed by the way Kerio built this firewall solver, because most firewalls are very difficult to maintain due to their complexity. If you are working in complex environments, it is not easy to maintain firewalls, because things are always changing. This is the part of Kerio that is very good.
Every IT guy that I show the interface of Kerio Control is impressed with the product because it's very easy to view how things are working (when you know what you're doing).
Ransomware is protected only when the system is able to detect, "Okay, this is coming from a link and that link is known, and it is within the protection."
I don't use the solution’s high-availability/failover protection because the hardware is needed as well and I wasn't able to test it. I want to test it first, because it's not only the testing, but what are the costs of ownership for the customer? Over the years, the Internet connections in the Netherlands are very stable. I always tell my customers that if they have an Internet connection that they should have a backup connection. The hardware that I use is mostly recent, stable hardware. So, it's not for my type of customers. This is not a very important feature because the hardware is well-maintained. However, that's a thing that I take care of since most hardware fails because there is not a good cooling environment or a lot of dust is in hardware. I make sure that things are running well as part of my services.
I'm still surprised that sometimes I need something which I thought was not within Kerio Control, and it was within Kerio Control. That's mostly the case.
Biggest lesson learnt: Stick with suppliers for software products who are able to give very good support.
I would rate the product as a nine (out of 10). It is very good.
Which deployment model are you using for this solution?