Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our IT director has left for greener pastures, and I'm acting as the interim director while we find someone new (I manage the Helpdesk). He budgeted about 20k for a new front end to our internet connections, though, and I'd like to get in place sooner than later.

Out current setup uses two Ecessa Powerlink 100s to aggregate our two WAN connections for failover, and two Fortigate 300As as the secondary firewalls.


WANs - Ecessas - DMZ - Fortigates - LAN

We've rolled to Lync 2010 for our phones, and it's choking up the fortis and powerlinks... We'd like to consolidate, but I just don't know much about Cisco firewalls aside from a PIX sitting in the ewaste pile. We have Catalyst 4510R, 6509, 4500s etc internally, but nothing on the perimeter.

Can anyone recommend a good rig that can replace our current 4 pieces into one (or preferably two in HA)?

share|improve this question

closed as off topic by EEAA, David Schwartz, Ward, Mark Henderson Jan 14 '12 at 7:26

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Hi Ixoebelle, welcome to Server Fault. Shopping Questions are Off-Topic on any of the Stack Exchange sites because of their very limited lifespan. See Q and A is hard, lets go Shopping and the FAQ for more details. – Mark Henderson Jan 14 '12 at 7:26
up vote 1 down vote accepted

It is rumored (e.g. by Gartner) that Cisco will release a next-generation firewall product to replace the ASA product line in 2012. Current Cisco firewalls provide "traditional" port-based network security but do not offer any kind of "next-generation" protection against application-layer threats.

With the budget that you mentioned, I would be considering a Palo Alto Networks PA-2050 or perhaps a cluster of two PA-500s or PA-2020s. Your organization's specific needs in terms of throughput, simultaneous sessions, and firewall/router ports would drive a more specific choice within your stated budget.

If you're a help desk manager, you are probably very familiar with the reality that certain types of threats are able to get past your existing perimeter devices, and that your existing firewall logs provide only very limited information on the nature of your network traffic. For example, you can see that a device made an outbound connection to port 80 or 443 to a WAN IP address, but you may not know whether the application was actually web browsing.

Switching to a next-generation firewall is a night-and-day difference:

  • A traditional firewall knows that three certain IP address made outbound connections to certain IP addresses on specified TCP ports.
  • A next-generation firewall can tell you that user johnd just sent a file called "Trade Secret Meeting Notes CONFIDENTIAL.docx" to an FTP site in China, that user jerryt's computer is generating traffic indicating that it's infected with the BirdFlu worm, and that user florencen (who perhaps has access to social networking sites for marketing purposes) is sending an awful lot of Facebook Chat messages.
  • Even more impressively, I have observed that Palo Alto firewalls present this type of information in a way that is clean, well-organized, accessible, and actionable.

As of January 2012 Cisco doesn't even pretend to offer a firewall with this type of application-layer visibility. Sonicwall and Watchguard are trying very hard to market their firewalls as having similar feature sets, but they do not stand up to a side-by-side comparison. So far, the only firewall vendors that have come up with genuinely compelling implementations of application-layer deep packet inspection are Palo Alto and possibly Check Point (with which I have very limited personal experience).

Personal background: A company that I used to work for has a pair of PA-500s, and I can attest personally that nothing else I've seen even comes close. These were for two sites, one with about 80 employees and another with about 120; each site had 2 internet connections adding up to about 60 Mbps of WAN bandwidth. I do not make my living selling firewalls, but clients often pay me to install new firewalls and/or configure them for security and audit compliance.

share|improve this answer
I was about to mention Sonicwall's effort before you made your edit. I haven't actually tried it but gee, they want me to read about it every other week. – Mark Henderson Jan 14 '12 at 7:28
It's kind of like everything else in a Sonicwall: if you are using it exactly the way they envisioned it being used, it might work most of the time. Great value for a typical small business on a tight budget, where the feature set might otherwise be completely unavailable for reasons of cost, but an absolutely bizarre choice for an enterprise. – Skyhawk Jan 14 '12 at 8:34

We are in the process of replacing all of our Cisco ASA's with Juniper SRX 220's.. the fact that they can actually route is making them replace both routers and firewalls for us. We could never get our 5510's to handle failover very well at all. Plus, more ports, clustering is dead simple, (an actual active/active cluster, not just failover) and they cost about 25% the price of the Cisco ASA's (and not counting any routers you might need in front.. Remember, the ASA is not a router. It will do basic routing, and then bite you in the butt when you want to do anything that should be above absolute basic level)

We have the SRX cluster acting as the router and firewall for 4 different Internet connections coming into the building, for 2 different internal networks. Failover has been awesome. We can pull down any of the outside links, and our VPNs stay up to our remote sites.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.