The Safe@Office 225U device, from Check Point subsidiary Software Technologies, provides fail-over capabilities for the company that wants unlimited users to receive Internet access backup. It also includes Check Point's Firewall-1 and VPN-1 software.

The VCR cassette-sized metal box packs plenty of features. Check Point provides software add-ons to the basic hardware, so you can configure the system you need. For example, if you want remote management, Web filtering, email antivirus, or expanded logging and reporting, grab a price list for their subscriptions.

The box didn't let us set the range for IP addresses doled out by the unit's DHCP server, but at least the box sees other IP addresses, so it doesn't give out addresses already in use. The Web administration application is clean and usable, if a bit loud with its orange and yellow colour scheme. Firewall rules are set through a pop-up wizard, but without extra filtering modules the service options to control are slim (less than 10).

Our focus was on the fail-over capabilities, however. Unlike some of the other boxes on the market, the Safe@Office 225 doesn't plug both broadband modems into connectors on the unit itself. You must plug the broadband modems into a separate (not included) wiring hub, and connect that hub to the WAN1 port on the box. We were fooled by the DMZ/WAN2 label on the front of the device and plugged the WAN2 router there, which doesn't work but doesn't give an error message either, until we dug deeper into the 250-page manual and discovered the unorthodox connection method.

Weird or not, it works. Usually the system fails over from cable to DSL automatically with no Web surfing delays, but occasionally the primary WAN link must be disabled in the administration to kick-start the fail-over. Streaming audio seemed to always hang up during the fail-over process, and required manual intervention.

Email traffic always went to the cable modem WAN link, keeping SMTP traffic flowing. And since the box doesn't support load sharing, no connections got linked to the slower DSL line. That means two comparable broadband connections won't provide any possibility of a speed boost, as they can do on other boxes. Still, the Check Point box will work quite well when fail-over is the most important goal, as when the two broadband connections differ widely in speed (such as cable and minimum-speed DSL).


If all you need is fail-over to a backup line this will do the trick but if you want to load-balance across two connections, look elsewhere.