6

Which firewall would you advice to use to meet following 1Gb line and most anti hacking modules. Price range 10k-15k$.

3 years warranty on site, full support online.

About modules, i don't know what role antivirus has in firewalls because this firewall gonna be used for IIS applications but definitely against DDOs types of attacks... Not good enough to say more.

Thanks...

2
  • 2
    Why the down vote? Seems like a perfectly reasonable question to ask. +1 to counter the unfair down vote.
    – Bryan
    Dec 10, 2009 at 12:37
  • Thanks Bryan, got no idea why by myself. Edited my post with few more details
    – eugeneK
    Dec 10, 2009 at 13:02

6 Answers 6

2

This question still needs more details if you expect actual suggestions for specific solutions. But I think you should be able to answer this one on your own with some more research. Cisco, Juniper, FortiNet, SonicWall, etc will all have a solution that fit your needs. The speed and number of WAN links you're trying to protect is going to be the biggest factor in sizing the unit, aka what model you need. Beyond that it's going to boil down to price and features that you need for all your requirements.

I personally prefer FortiGate units from FortiNet over the Cisco ASA's but it's a personal preference. I've never used the Juniper solutions so I can't speak on those but I've heard good things about them.

This is a little OT, but don't get lazy on hardening the IIS server or application just b/c it's behind a firewall. Everyone loves to jump to the conclusion that the security check box is checked b/c they have a firewall but it just takes one misconfiguration to get past your security. Also IDS/IPS systems are not 100% affective and have to be configured properly for your environment or you'll get a lot of noise from them.

2
  • Thanks, mate. I'm currently for Fortigate 800 as a solution. I'm not lazy to get all info you need simply because things you ask me i have no idea about. i'm just a programmer and not sysadmin. My company always gets cheated by those who sell these advice or any kind of hardware this is why i need answers and info form decent lads in here. Thanks for the answer
    – eugeneK
    Dec 11, 2009 at 9:49
  • The Fortigate 800 is an excellent box. It has 4 gigabit interfaces that you can use for WAN, Internal, DMZ, you can even setup two different DMZ's if you wish. Take a look at their listed specs though to make sure your ok with the throughput on it's IPS, VPN, and AV capabilities. It looks like the slowest figure is the AV portion which is 150Mbps, which is still a fast WAN link around 18MBps. You can just apply protection profiles that include AV to the firewall rules that need it. Good luck and if you have any specific questions post another question. Dec 11, 2009 at 14:36
3

I wouldn't bother with a black box solution. I'd go for an x86 cheap box with SmoothWall or IPCop, and three network cards to cover your incoming, outgoing and DMZ requirements.

5
  • +1; out of curiosity - do you run it [whatever black box it is] near 1Gbit/s speed... with majority of short packets in the traffic? how well does it perform? it's been quite a while since i've done such benchmark last time.
    – pQd
    Dec 10, 2009 at 11:14
  • In South Africa, we're lucky to get 4Mbps for Internet (ADSL), so this isn't a factor I've had to consider. 384Kbps - 1Mbps is the average DSL speed. I put the gigabit NIC on the internal segment to go directly into the gigabit switch, but usually the line usage is very low.
    – user3914
    Dec 10, 2009 at 12:50
  • Another thing: if you put good NICs on this cheap solution, it performs very well. You can get away with 256MB of RAM and an old Pentium or Celeron then.
    – user3914
    Dec 10, 2009 at 12:52
  • SmoothWall do offer a couple of hardware solutions - use the link in my answer.
    – user3914
    Dec 10, 2009 at 13:28
  • Something international would be better. I won't find support of such small companies in where i reside... Thanks anyway
    – eugeneK
    Dec 10, 2009 at 15:36
1

You probably need to specify more. Packets per second? How much VPN traffic? Juniper or Cisco can be alternatives. If you don't know exactly what you need, you should probably turn to a consultancy firm to get help evaluating it and candidate hw firewalls.

As mention earlier, a Linux or BSD based firewall could very well do this pretty cheap. (Actually run two plus CARP for high availability).

3
  • Plus, do you want support? Anti virus? What type of warranty? etc ..
    – 3molo
    Dec 10, 2009 at 12:06
  • I would also like to add that if you're using IDS/IPS, anti-virus, anti-spam etc, the firewall will not be able to handle nearly as much as the specification states. Divide it by 5 or even 10 to be sure :-)
    – 3molo
    Dec 10, 2009 at 12:09
  • I have edited my post...
    – eugeneK
    Dec 10, 2009 at 13:04
1

1Gbit is not enough to give you an answer. You need to share with us if it will handle VPNs, if so how many. What type of data would you be pressing? Small packets, big packets etc. Depending which features you need, such as IPS/IDS and VPN performance you need a very big firewall to cope, think ASA5580 or cisco 6500 with FWSM.

But you need to supply a more detailed description of what your needs are.

1
  • What small packets and big packets mean? What are the things i need to look for in firewall besides info i've asked ?
    – eugeneK
    Dec 11, 2009 at 9:50
1

Nokia IP290
(source: nokia.co.jp)

Our corporate network has Nokia IP290, which is really easy to mantain and it's bulletproof. Highly recommended. Cost was about 4.5k$ (tax incl.) with 1 year subscription.

Datasheet with specs is here.

4
  • What's the subscription for? Warranty? Support? Anti-malware (does it do it?)
    – Massimo
    Dec 10, 2009 at 11:16
  • Nokia boxes run checkpoint. I seem to recal that they've been taken over / sold to checkpoint directly. The nokia boxes run a form of freebsd; the checkpoint "splat" boxes run linux and I'd expect the support for the ipso firewalls to be even crappier than before. Oh, and they're basically just server class hardware boxes with a crypto acccelerator card (that made our firewall crash at random). Oh, and our 1260 couldn't do full logging in our config with a probably garbage rule set and rare peaks of 300mb/s of traffic and more typically 100mb/s of traffic. I don't like the platform at all
    – chris
    Dec 10, 2009 at 13:12
  • Massimo, when you purchase such unit you need to buy at least 1 year subscription for checkpoint software. After this period will expire, there is no need pay except if you need software updates. Dec 10, 2009 at 14:28
  • Chris, that's weird. We are really happy with this unit. Behind it we have 2 Proliants, each splitted on 4 vm's, plus couple of Ded's. We have quite a complicated setup with balanced bandwidth and got no problems so far. Can't tell much about logging as we are using it only for problem solving, and are keeping the logs only for short period. Dec 10, 2009 at 14:35
0

I would think you would be able to find a CheckPoint dealer in your area. We used to run a hot failover setup on a pair of Nokia boxes. Very nice rig.

Not the answer you're looking for? Browse other questions tagged .