What SmartWall ONE Is
Corero SmartWall ONE is an always-on inline DDoS mitigation platform designed for ISPs and service providers. It deploys in L2 bridge mode at the network edge, sitting between your upstream router and downstream infrastructure and filtering attack traffic before it reaches your network. Current hardware models cover 100G to 400G throughput — the NTD 3400 supports 2x400G or 4x100G interfaces. As of 2025, Corero also supports deployment on commercial off-the-shelf (COTS) x86 hardware, allowing operators to run SmartWall software on locally-sourced commodity servers. The platform includes SecureWatch Analytics for reporting and visibility, and integrates with the Juniper Networks ecosystem.
The COTS Transition
The COTS hardware option introduced in 2025 is a meaningful operational change. It reduces capital expenditure and eliminates import delays that previously came with ordering proprietary appliances. Operators can now procure commodity x86 servers locally and deploy Corero software on them.
What doesn't change with COTS: SmartWall is still an inline network appliance sitting in your traffic path. It still runs under a licensed software model with Corero support contracts. It still provides network-edge protection only — not per-server visibility. The architecture, and therefore the coverage model, is identical to the proprietary hardware deployment.
What the Architecture Covers and Where It Ends
SmartWall protects the aggregate of traffic entering your address space at the edge. For ISPs protecting customer address blocks across their network, this is the right model — it filters before attack traffic reaches any downstream customer.
For hosting providers, the architecture creates specific gaps:
No per-server visibility — SmartWall sees traffic at your edge as an aggregate. It doesn't tell you which server is under attack, what the traffic breakdown looks like at a specific host, or whether the problem is inbound, outbound, or internal.
No host-level PCAP — post-incident forensics at the packet level require a tool running on the host itself. SmartWall's edge position does not provide that.
Independent reviewers and integrators note "constraints observed when focusing on more complex Application Layer attacks"[1] and deployment taking "from a couple of days to a week" depending on network complexity.[1]
Side-by-Side Comparison
| Feature | Corero SmartWall ONE | Flowtriq |
|---|---|---|
| Deployment | Inline appliance / COTS server | Agent on Linux server |
| Protection scope | Network perimeter | Per server, per packet |
| Per-server visibility | No | Yes |
| PCAP forensics | No | Yes |
| L7 detection | Limited (reviewer-noted)[1] | Yes |
| COTS hardware | Yes (2025) | N/A |
| Pricing | ISP-grade licensing (quote) | $9.99/node/month |
Evaluation Checklist
- Define scope — entire edge or individual servers?
- Assess IP address space — SmartWall is designed for operators with significant owned IP blocks
- Model appliance lifecycle — COTS hardware reduces capex; factor in software licensing separately
- Clarify per-server forensic requirements — if your team needs host-level PCAP after incidents, a second tool is required
- Confirm team's operational capacity — inline appliance management is ongoing, not a one-time deployment
Need per-server detection without an inline appliance?
Flowtriq installs on any Linux server in minutes. No re-architecting your network edge required.
Start free 7-day trialFrequently Asked Questions
What is Corero SmartWall ONE?
Corero SmartWall ONE is an always-on inline DDoS mitigation platform for ISPs and service providers. It deploys between the upstream router and network infrastructure, filtering attack traffic in real time before it reaches downstream systems.
Does Corero SmartWall run on standard hardware?
Yes. As of 2025, Corero SmartWall ONE supports deployment on commercial off-the-shelf (COTS) x86 hardware, reducing capital costs and eliminating import delays for operators who previously purchased proprietary appliances.
How long does Corero SmartWall take to deploy?
Independent reviewers and integrators note that deployment can take from a couple of days to a week depending on network complexity and existing infrastructure.
Does Corero SmartWall protect individual servers?
No. SmartWall protects the network perimeter — all traffic entering your address space. Per-server packet visibility and host-level PCAP forensics require a separate host-based agent.
What are alternatives to Corero SmartWall for hosting providers?
Hosting providers who need per-server detection, PCAP forensics, and per-node pricing often evaluate Flowtriq, FastNetMon Advanced, and Wanguard as alternatives or complements to network-edge protection.
Back to Blog