.

Hardware Firewall Purchase

<<

Knb15

Jr. Member
Jr. Member

Posts: 50

Joined: Tue Feb 23, 2010 10:18 am

Post Mon Sep 13, 2010 3:28 pm

Hardware Firewall Purchase

Hey guys,

I would like your opinion on the subject of Hardware Firewalls.

I have been tasked to buy one for our company but since i have never bought one before, i would like to make sure i make a good investment by getting something good that serves our purpose.

I looked at about a dozen different types, different brands (Cisco, Dell, Barracuda, etc), different price ranges to see where we would possibly fit in.

Some info on the company it is for:
Small company, one server, 8 workstations, nothing top secret to protect, no trade secrets, but sensitive and confidential client information to protect.

Having said that, from my search it looked like something in the range of $500 to $2000 would be sufficient for us. But then again, like i said, i don't know much about these, so maybe it’d be worth spending some more money. I prefer not to set a budget here to see what opinions you guys have on it based on the size of the company and type of information we are protecting.

We'd be interested in something that would support VPN, VoIP, NAT, DMZ, with an IPS/IDS.

Any thoughts on what I should be looking for or what the best investment would be?

Thanks!

Knb15
<<

dynamik

Recruiters
Recruiters

Posts: 1119

Joined: Sun Nov 09, 2008 11:00 am

Location: Mile High City

Post Mon Sep 13, 2010 3:40 pm

Re: Hardware Firewall Purchase

Have you looked at the ASA5505 Security Plus with the Security Services Card? I believe Juniper offers something similar, and Checkpoint makes some solid products as well.

http://www.cisco.com/en/US/products/ps6120/index.html

http://www.juniper.net/us/en/products-s ... sg-series/

http://www.checkpoint.com/products/smal ... index.html
The day you stop learning is the day you start becoming obsolete.
<<

former33t

Full Member
Full Member

Posts: 226

Joined: Sat Feb 14, 2009 12:33 am

Post Mon Sep 13, 2010 5:56 pm

Re: Hardware Firewall Purchase

I looked at Astaro a couple of years back and they were pretty well on it.  The price range was about what you were looking for and they had all the features we needed:

http://www.astaro.com/solutions/network-security

Best of all, at the time they had a VMware appliance you could test drive and see if you liked the interface.  It's Linux based which was a real plus.  We ended up going with an ASA due to factors outside of my control (but cost more $$).
Certifications: CREA, MCSE: Security, CCNA, Security+, other junk
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Mon Sep 13, 2010 9:28 pm

Re: Hardware Firewall Purchase

It's hard to recommend a particular firewall.  I think it comes down to a matter of preference and familiarity.  You would probably find Cisco products to be the most supported, but they aren't cheap.  I know a bunch of people using Watchguard products (they have recently gotten much better).  They are affordable and you should be able to find something your price range.

Like former33t said, there are also a bunch of Linux-based firewalls out there, some offering commercial support.  Endian is one such example.  They sell a hardware solution as well.
~~~~~~~~~~~~~~
Ketchup
<<

Knb15

Jr. Member
Jr. Member

Posts: 50

Joined: Tue Feb 23, 2010 10:18 am

Post Tue Sep 14, 2010 7:43 pm

Re: Hardware Firewall Purchase

Thanks for the initial responses. I checked out your suggestions and may have two or three in my sights.

2 Questions:
1. Does a HW firewall come with an IPS/IDS or are they just "IPS/IDS" supported, and the admin has to add it to the HW firewall later?

2. Is there a way to determine whether a firewall either supports an IDS/IPS and/or whether it comes with it, if it does not explicitly say so in the specs?

The reason i ask is because for some of these i only see "IPS supported" for example, but no mention of IDS. So i was wondering if it supports one it also automatically supports the other, or maybe it doesn't work that way.
<<

hell_razor

User avatar

Jr. Member
Jr. Member

Posts: 90

Joined: Wed Jul 14, 2010 10:44 am

Post Fri Sep 17, 2010 9:14 am

Re: Hardware Firewall Purchase

Look at Fortinet.  They make a solid product at a competitive price.
A+, Network+, Server+, CISSP, GSEC, GCIH, GPEN, GCIA, GISP, GCFW
<<

sil

User avatar

Hero Member
Hero Member

Posts: 551

Joined: Thu Mar 20, 2008 8:01 am

Location: ::1

Post Fri Sep 17, 2010 11:21 am

Re: Hardware Firewall Purchase

hell_razor wrote:Look at Fortinet.  They make a solid product at a competitive price.


Solid?! Solid maybe for small businesses. There is a saying you get what you pay for.

"I no longer sell this product. The company is simply horrible at support and customer service"
http://aplawrence.com/Fortinet/

"Fortinet has the absolute worst technical support ever. It takes them 3 days to respond."
"We have 3 Fortinet Fortigate 60 and they suuuuuck"
http://community.spiceworks.com/product ... igate-100a


I managed a bucketload of firewalls and Fortinet, Sonicwall, Watchguard are among the worst I've had to deal with for many issues. To be quite fair about this, I have a Fortinet installed on my LAN for my LAN administrators (not my choice).

This is what's currently got in house to me: (sorry for the blur... Crackberry)

SSG20, NS204's (lab)
http://www.infiltrated.net/ehnet/IMG000 ... 7-1033.jpg

Stonesoft Stonegate SG1100 x2
http://www.infiltrated.net/ehnet/IMG000 ... 7-1033.jpg

Stonesoft Stonegate SG1100
http://www.infiltrated.net/ehnet/IMG000 ... 7-1033.jpg

Checkpoint + Sofware (separate boxes)
http://www.infiltrated.net/ehnet/IMG000 ... 7-1032.jpg

Sonicwall + Sonicwall's Remote Access
http://www.infiltrated.net/ehnet/IMG000 ... 7-1032.jpg

Fortigate 620b
http://www.infiltrated.net/ehnet/IMG000 ... 7-1032.jpg

Management wise, I can state over 20 SSG's in all forms, Sonicwall, Borderware, ASA, PIX, Sidewinder, Fortinet, Watchguard, etc. I use them all almost on a daily basis... Fortinet = horrible. If I had to rank them on:

FUNCTIONALITY
SSG
Stonegate
Borderware (pre Watchguard assimilation)
ASA/Pix
Checkpoint
Sidewinder (pre McAffee assimilation)
Sonicwall
Fortinet
Watchguard

Price
SSG
Stonegate
ASA/Pix
Sidewinder (pre McAffee assimilation)
Sonicwall
Checkpoint

Ease of use on CLI
SSG
ASA/Pix
Stonegate has no CLI

Ease of use on GUI
SSG
Stonegate
Checkpoint
Sonicwall
Fortinet
ASA/Pix
Watchguard

Small businesses (my recommendation to sites with under 50 devices)
SSG 5/20
Sonicwall
ASA/Pix
Watchguard

SMB's (50-200)
SSG
Stonegate
ASA/Pix
Checkpoint
Sidewinder (pre McAffee assimilation)

Big Boys/Big Toys (large companies)
Palo Alto 40xx (4020 ;))
SSG 520's
Stonegate SGxx
Sidewinder (pre McAffee assimilation)
ASA
Checkpoint
<<

JollyJokker

Post Sat Sep 18, 2010 4:01 pm

Re: Hardware Firewall Purchase

In our company, the Juniper SSG's (520 and 550) are used extensively. I believe they are excellent products with very good value for money. Even though we use the CLI (ScreenOS), the GUI is very good too.

However, I believe these appliances are for large organizations. But I believe that smaller siblings within the SSG family are reliable appliances as well.

http://www.juniper.net/us/en/products-s ... sg-series/
<<

Knb15

Jr. Member
Jr. Member

Posts: 50

Joined: Tue Feb 23, 2010 10:18 am

Post Sun Sep 19, 2010 6:52 pm

Re: Hardware Firewall Purchase

Thanks again for the replies.

Based on Sil's and Hordakk's post, it seems like the Juniper SSGs would be a good choice.

I am going to check them out tomorrow at work.
<<

hell_razor

User avatar

Jr. Member
Jr. Member

Posts: 90

Joined: Wed Jul 14, 2010 10:44 am

Post Mon Sep 20, 2010 1:01 pm

Re: Hardware Firewall Purchase

Each to their own re: Fortinet.  In my previous life we had > 50 of these units and the only issue we had out of any of them were early models CF cards going bad.  Otherwise they were rock solid.  Their support can be slow at times, but if it is an urgent ticket, calling will normally get things resolved more quickly than sending email.  However, I would have to agree that their support is a weakness, but stand by the statement that they are a solid product.

The Juniper SSGs are also a good product line, but they are not in the same price point.  It all depends on what you need and what your budget is.
A+, Network+, Server+, CISSP, GSEC, GCIH, GPEN, GCIA, GISP, GCFW
<<

sil

User avatar

Hero Member
Hero Member

Posts: 551

Joined: Thu Mar 20, 2008 8:01 am

Location: ::1

Post Mon Sep 20, 2010 3:25 pm

Re: Hardware Firewall Purchase

hell_razor wrote:The Juniper SSGs are also a good product line, but they are not in the same price point.  It all depends on what you need and what your budget is.


You're quite right. In fact here is a comparison with the links for validation. Keep in mind, I never pay list on anything anyway. Even with my vendors Fortinet works out to be higher not to mention support... Non existent. At least I can buy same day support for Juniper and save myself a headache:

Fortinet 620B $20,848.00
http://www.shopping.com/xPO-Fortinet-In ... M-COMPLETE

Key Features
Connectivity: Wired
Firewall Features: Intrusion Prevention, Antivirus Filtering

Performance
Clear Text Throughput: 16000 Mbps
VPN Throughput: 12000 Mbps
Concurrent Connections: 600000

Protocols
Transport Protocol IPSec

VPN
VPN Tunnels: 20000
Included Licenses: Unlimited Users


Juniper Networks SSG 550M $8,316.00
http://www.shopping.com/xPO-Juniper-Net ... -Appliance

Key Features
Connectivity: Wired
Firewall Features: Stateful Packet Inspection (SPI), DoS Prevention, URL Filtering, Spyware Filtering
NAT Support: Policy based, PAT, NAT Traversal

Performance
Clear Text Throughput: 1024 Mbps
VPN Throughput: 500 Mbps
Concurrent Connections: 128000
Installed RAM: 1 GB

Ports
LAN Ports: 4

Protocols
Transport Protocol: IPSec, L2TP, NetBEUI/NetBIOS, PPPoE
Routing Protocols: OSPF, RIP Version 1, RIP Version 2, BGP, Static Routing
DHCP Support: Client, Server, Relay
Remote Management Protocol: SNMP, HTTP, Telnet, SNMP 2, HTTPS

VPN
Authentication: RADIUS, XAUTH, RSA SecurID, LDAP, Secure Shell (SSH)
Encryption Standards: DES, 3DES, AES, MD5, IKE, SHA-1
VPN Tunnels: 1000
Included Licenses: Unlimited Users


Juniper High to low
Highest: $14,250.00
http://www.google.com/products?q=ssg+52 ... scoring=pd


Fortinet 620b
Highest: $50,358.92 refurbished
http://www.google.com/products?q=fortin ... scoring=pd

Don't get me wrong, Fortinet is ... "eh", I'd use it before Sonicwall and Watchguard (haven't seen them post Secure Computing purchase) but they're not all that. Not to mention when you get into the managed space, nothing beats NSM.

Need more?

http://www.austinnetworking.com/assets/ ... et400A.pdf

Let's also not forget I can do routing if I choose with my Junipers and throw on all kinds of modules:

Fortinet
Maximum Firewall Throughput  16 Gbps (base) 20 Gpbs w/AMC
Maximum IPSec VPN Throughput 12 Gbps (base) 15 Gpbs w/AMC
Maximum Antivirus Throughput 350 Mbps
Maximum IPS Throughput 1 Gbps
Maximum Concurrent Sessions 1,000,000
Network Interfaces 20 Copper GigE 10/100/1000 Base-T 4 GigE SFP w/AMC
AMC expansion bays 1 single-width


Juniper
ScreenOS 6.2
Firewall Perf (Large Packets) 1+ Gbps
Firewall Performance (IMIX) 1 Gbps
Firewall Packets Per Second 600,000 PPS
3DES+SHA-1 VPN Perf 600 Mbps
Concurrent VPN Tunnels 1,000
Max Concurrent Sessions 256,000
New Sessions/Second 15,000
Max Security Policies 4,000
Max Security Zones 60
Max Virtual Routers 16
Max Virtual LANs 150
Fixed I/O 4x10/100/1000
Physical Interface Module (PIM) Expansion Slots 2
Enhanced PIM (EPIM) Expansion Slots 4
Convertible to JUNOS Yes

Notice: Convertible to JUNOS Yes which means at the end of the day, I can toss the router (and the cost of it) away something Fortinet is not capable of. But alas, you're right to each their own.
<<

Knb15

Jr. Member
Jr. Member

Posts: 50

Joined: Tue Feb 23, 2010 10:18 am

Post Fri Sep 24, 2010 11:34 am

Re: Hardware Firewall Purchase

Any experience with or comments regarding the SRX100 Services Gateway?

Also, our server is Dell, and i noticed Dell also has these SRX100 on their site, and when i spoke with a Juniper representative, they said Dell is one of their resellers.

On dell's website, i noticed the Dell brand name on the SRX100 and a slight product name change to "PowerConnect J-SRX100 Services Gateway" (http://www.dell.com/content/products/pr ... t-j-srx100). Is that just an effort have Dell's name on the product instead of Juniper, but still the same product? I assumed the "J" stands for the JUNOS software that it runs on, which is Juniper's, so...probably the same product.

Would love some feedback once again. Thanks in advance!

http://www.juniper.net/us/en/products-s ... es/srx100/

Knb15
Last edited by Knb15 on Fri Sep 24, 2010 11:36 am, edited 1 time in total.
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Sun Sep 26, 2010 11:41 pm

Re: Hardware Firewall Purchase

I had no idea Dell made firewalls.  From experience with their switches, the interface and language seems to be pretty similar to Cisco's.  I am guessing they license the code.  The boxes and hardware are significantly different.  I like Dell's support much better than Cisco's.  I am not a big fan of rebranded hardware, but I do like Dell's support. 
~~~~~~~~~~~~~~
Ketchup
<<

tturner

User avatar

Sr. Member
Sr. Member

Posts: 435

Joined: Thu Jun 26, 2008 4:50 pm

Post Tue Sep 28, 2010 9:22 pm

Re: Hardware Firewall Purchase

Fortinet support was so bad at our last job, our CISO rewrote the kernel for them. They had one really neat feature patch that removed the GUI for the MAC/IP binding tab (DHCP reservations) which was joyous for all our Windows centric GUI lovin sysadmins that had to then use the CLI. Some feature. We had somewhere in the neighborhood of 500 or so units, mostly wifi60's and 60s that got upgraded to 100a's and a few 400's and 800s and some high end units at HQ that I never saw. (I worked primarily in the field with peripheral duties managing those boxes at the sites - roughly 60 in my region) I had a 100a as my gateway box with a persistent vpn to HQ in my house for the last 2 or 3 years I was at that employer. That tunnel bounced more than any other platform I've used. Maybe they are better now, I wouldn't know. I use Juniper these days.
Certifications:
CISSP, CISA, GPEN, GWAPT, GAWN, GCIA, GCIH, GSEC, GSSP-JAVA, OPSE, CSWAE, CSTP, VCP

WIP: Vendor WAF stuff

http://sentinel24.com/blog @tonylturner http://bsidesorlando.org
<<

hell_razor

User avatar

Jr. Member
Jr. Member

Posts: 90

Joined: Wed Jul 14, 2010 10:44 am

Post Wed Sep 29, 2010 2:10 pm

Re: Hardware Firewall Purchase

Obviously you and Sil have had different experiences with the Fortinet products than have I.  We used quite a few (~50-60), mostly in the 60/60b/80c range with a few 300 as well.  We did not have much trouble out of them and often did not run bleeding edge code on them.  We did use IPSEC and SSLVPN without issue, and yes, the missing GUI for mac reservations was irritating, but not a show-stopper.

They also support routing, up to and including BGP (though I can say I never used BGP on one since ours were too small).  OSPF and RIP worked perfectly, though.  We used them for nearly all of our non-core routing without issue at our WAN sites.

All that being said, we also used a SA4500 SSLVPN from Juniper that was far ahead of Fortinet's SSLVPN offering.  That would stand to reason, though, since Fortinet's was  bolt-on to list a feature (though it was quite usable for small implementations).

Fortinet support was not so good, but to be honest, we rarely had reason to call them.  Support is definitely a weakness for them that they will have to work on in order to improve market share.  Additionally, I think QA in their software side is next in line to get spanked if they do not improve.

In my experience, for the products we were purchasing, Juniper could not compete on a bang-for-the-buck comparison.  When we demoed Fortinet initially, we compared them to the Pixs and the NetScreens (now Juniper) and chose them due to simplicity and cost (and I really do not like Cisco products outside of routers for the most part).  As I stated before, each to his/her own.
A+, Network+, Server+, CISSP, GSEC, GCIH, GPEN, GCIA, GISP, GCFW

Return to Hardware

Who is online

Users browsing this forum: No registered users and 1 guest

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software