Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I realize that this is a subjective question, but I'm trying to get some experiences

We have Juniper firewalls in our organization (SSG-320M, SSG-5, and some old NS-5GT). We have the option of a yearly subscription for:

  • Deep Inspection Signature Updates
  • Juniper-Kaspersky Antivirus

I seem similar services available from other Firewall vendors.

We have Symantec Endpoint Protection deployed to all workstations and servers, plus a dedicated appliance for e-mail spam/virus filtering. So, I'm not sure what these firewall-base services will bring to the table that I don't already have.

I would appreciate some feedback from people using these firewall services (Juniper or otherwise).

Are these services generally worth it? Do they really catch anything? Do they interfere with normal traffic (false positives)?

share|improve this question

closed as not constructive by MDMarra, Chris S Nov 5 '12 at 19:01

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

my .00002 cents worth is can you afford it; if so then buy it, its just another layer in the defense in depth process. And yes they can interfere with normal traffic but thats usually a real small corner case issue. Also as far as dpi is concerned do you need to see into ssl traffic? if so then once again you'll need these updates. – tony roth Nov 5 '12 at 15:03
up vote 2 down vote accepted

I use Forefront TMG which provides a similar feature set. I find these features to be 100% worth the price. The antimalware and antivirus features stop suspicious traffic from entering the network. Forefront also provides URL categorization as a service. This is great for blocking whole categories of inappropriate content. The SSL inspection allows me to be sure that no malicious traffic is being passed across secure channels. That is a real problem in today's world.

Are there issues with false positives? Definitely. Not as many as you would think though. Just like any other technology you need to understand each aspect of what your product brings to the table.

If you're looking at starting out with a deep inspection firewall, antivirus subscriptions, ssl inspection, etc be sure that you do some testing in a lab environment first and enable only one of these services at a time. The most overwhelming thing in setting up a firewall with all these features available is delineating between which of the features is stopping traffic you need from getting through. Turning them on one at a time makes it much easier to troubleshoot.

EDIT - Forgot to mention one other thing. By using a firewall device with these services enabled it is possible to use a different antimalware / antivirus vendor than you do on your desktop. This provides me a great deal of peace of mind that I'm not solely relying on a single vendor for my security posture.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.