It is rumored (e.g. by Gartner) that Cisco will release a next-generation firewall product to replace the ASA product line in 2012. Current Cisco firewalls provide "traditional" port-based network security but do not offer any kind of "next-generation" protection against application-layer threats.
With the budget that you mentioned, I would be considering a Palo Alto Networks PA-2050 or perhaps a cluster of two PA-500s or PA-2020s. Your organization's specific needs in terms of throughput, simultaneous sessions, and firewall/router ports would drive a more specific choice within your stated budget.
If you're a help desk manager, you are probably very familiar with the reality that certain types of threats are able to get past your existing perimeter devices, and that your existing firewall logs provide only very limited information on the nature of your network traffic. For example, you can see that a device made an outbound connection to port 80 or 443 to a WAN IP address, but you may not know whether the application was actually web browsing.
Switching to a next-generation firewall is a night-and-day difference:
- A traditional firewall knows that three certain IP address made outbound connections to certain IP addresses on specified TCP ports.
- A next-generation firewall can tell you that user
johnd just sent a file called "Trade Secret Meeting Notes CONFIDENTIAL.docx" to an FTP site in China, that user jerryt's computer is generating traffic indicating that it's infected with the BirdFlu worm, and that user florencen (who perhaps has access to social networking sites for marketing purposes) is sending an awful lot of Facebook Chat messages.
- Even more impressively, I have observed that Palo Alto firewalls present this type of information in a way that is clean, well-organized, accessible, and actionable.
As of January 2012 Cisco doesn't even pretend to offer a firewall with this type of application-layer visibility. Sonicwall and Watchguard are trying very hard to market their firewalls as having similar feature sets, but they do not stand up to a side-by-side comparison. So far, the only firewall vendors that have come up with genuinely compelling implementations of application-layer deep packet inspection are Palo Alto and possibly Check Point (with which I have very limited personal experience).
Personal background: A company that I used to work for has a pair of PA-500s, and I can attest personally that nothing else I've seen even comes close. These were for two sites, one with about 80 employees and another with about 120; each site had 2 internet connections adding up to about 60 Mbps of WAN bandwidth. I do not make my living selling firewalls, but clients often pay me to install new firewalls and/or configure them for security and audit compliance.
