Logging on routers is usually inadequate, because routers do not keep track of connections and log only blocked packets. Sun's Sunscreen includes a form of stateful inspection in a hybrid product. These products also include complete logging and alarm capabilities not found in router-based packet filters. Obviously, most people would prefer a security solution whose failure mode is in the closed position. If the access control rules on a router are deleted or deactivated, the failure mode leaves the gate to your enterprise wide open.
Failure mode is an important consideration in any security mechanism.
Circuit gateways use access control rules to determine which host may use the gateway and can log information about the host name, identity of the user, number of bytes transferred, time and remote host. Circuit gateways do not understand the applications they support, so they can't log the names of files transferred using FTP or prevent users from sending files. You Can See Through It Circuit gateways and packet filters are, by their nature, transparent. One disadvantage of total transparency is that such products cannot authenticate users. Some transparent solutions attempt to identify users with a protocol known as identd or authd .