Software or Appliance based Antivurs/Spam for SBS2011 Standard environment??

[LRB45]

So we are migrating from sbs2003 to sbs2011 in the very near future and I have been reading and searching for the best setup of Antivirus and spam filters.
What I am having a hard time with is if the better solution is having a software server based product such as Trend Micro Worry Free Security suite which will push out to the clients or using an appliance like Barracuda and load the A/V local on each client.
I've read several articles that claim having the full suite loaded on the server is just another process taxing the server which is worse on an SBS than others.

I'm leaning toward the Trend Miro Suite mentioned above if I go software or the Barracuda Model 100 if appliance based. As the administrator of the system and someone who is far from an expert I wanted to get some opinions from those far more knowledgeable than me.

 

[hairlessupportmonkey]

Im a fan of stopping it at the door.

Look at these Sophos UTM devices.



ACSS - SME
General Geek

 

[ShackDaddy]

Personally, I think an even better solution is to not tie up your bandwidth with any of it. I like to use hosted mail-hygiene systems like MXLogic/McAfee, Reflexions or Securance (I resell McAfee). They scan everything for spam and virus before sending it on to your network and also queue your mail for you (even allowing you to log on and reply to messages in queue) if your network/server is offline. These solutions average around 3-4 dollars per mailbox/month.

But if you weren't going to go that route, I'd try to handle it on your firewall: it doesn't have to be a dedicated device like a Barracuda: other appliances like Watchguard and SonicWall have built-in subscription-based anti-spam and AV features that can be utilized to prescreen mail before it gets to your server.

Lastly, Exchange 2010 has its own decent anti-spam features that are "dumbed down" for default installation. It can be configured to work with RBL lists like SpamHaus, do more aggressive content checking, and evaluate sender reputation.

There's a lot of debate about the best way to go on this, and I generally try to avoid running a 3rd-party mail-scanning AV product on an Exchange server: I'd rather handle it somewhere else and also on the workstations. I normally do run standard AV on the server, but not the Exchange-integrated AV, since they tend to make mail issues more complicated to troubleshoot and tend to be the source of the problem when something stops working properly.

Dave Shackelford
ThirdTier.net
TrainSignal.com