Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a small office network with about a dozen servers and <50 users. The internet connection is currently a T1 through a cheap netopia firewall. I'd like to upgrade and get ssl vpn. I'm very confused as to what product to get.

Could someone provide feed back on any of the following products:

  • Cisco ASA 5505
  • Juniper SA 2500
  • Citrix Access Gateway
  • Sonicwall 2500 SSL VPN

I'd like feedback on the following items:

  • Real cost of the equipment + licensing for 25 users (including 5 concurrent SSLVPN sessions).
  • Complexity of managing the hardware.
  • Confirmation that the appliance provides SSL VPN and firewall
share|improve this question

closed as too localized by Mark Henderson Jan 15 '12 at 5:30

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

7 Answers 7

I don't have experience with the firewalls you listed, but I can tell you that SmoothWall (www.smoothwall.net) covers the features you are asking about.

For hardware, they do sell pre-built appliances or you can use any PC hardware of your choice as long as the hardware has known linux driver support. We've had good luck with Dell Vostro equipment for small firewalls and Dell PowerEdge equipment for when hardware redundancy is desired.

Please note the following prices in this answer are current prices, anyone reading this answer in the future should check with a reseller for current pricing.

Licensing, they do not charge per user licensing unless you want to do content filtering with the Guardian module. Corporate Firewall runs about $500 currently with a $150 annual support renewal (for version upgrades and patching). 10 VPN license pack (no 5 pack) about $400 with $100 annual support renewal.

With a T1 and multiple servers, you probably will also want the SmoothHost module which allows you to alias multiple IP addresses on your public interface and map which internal addresses should use which public addresses. That is currently $300 with an $80 annual renewal.

Configuration is quite easy, install is very straight forward and is a full system install, does not require OS configuration first. Post-install configuration is handled through a web interface that gives you everything you need.

The latest version, Corporate Firewall 2008 does support SSL VPN.

You can find a list of resellers at http://www.smoothwall.net/partners/reseller.php

There is a free version of SmoothWall available at www.smoothwall.org but I cannot speak to the feature differences as we only use the corporate versions.

share|improve this answer

Citrix Access Gateway:

Approximate Costs:

The hardware:

   Citrix Access Gateway (Model 2010) Appliance with 1 Year warranty £1800.

The user licenses (concurrently licensed)

   Standard License   £50 each
   Universal License    £75 each

Universal allows you to run Standard, Advanced or Enterprise editions. (Enterprise edition requires a different hardware appliance worth around £10k, but the option to upgrade is there should you ever require it). If you just want a standard SSL VPN, stick with Standard Edition.

Yearly Running costs:

  SSL Certificate     $20 from www.godaddy.com seems to work ok.
  Renewal cost        About £7 / user / year.

Setup:

  • Can be easy to setup if you can have one interface on your internal network and one interface on your external network. Little more tricky if it needs to be sitting completely in your DMZ.
  • Reasonably easy to get it to authenticate users against your Active Directory using LDAP queries.

Woohoo's:

  • VPN Client is downloaded from the web logon page on the Appliance (ie. You don't need to pre-install the client on users laptops, they can do it themselves)
  • Obviously works well with a Citrix XenApp farm if you have one, to securely access applications remotely.
  • It's SSL, so you don't get blocked by firewalls when you're out and about.
  • Seems to do the job well, it's pretty much set and forget.
  • Citrix Forums are quite helpful

Bummers:

  • Does not do Firewall duties (so that might rule it out right there)
  • No x64 client support yet, though
    Windows 7 32-Bit does work ok.
  • You cannot make a connection out from the internal network to the VPN user (perhaps for remote maintenance)
  • Documentation is typical Citrix. (IE. Not the best)
  • Citrix Support contract is expensive...

Alternatives to look at for pure VPN:

Microsoft Forefront Unified Access Gateway (UAG) * Coming Soon to replace IAG 2007

Alternatives to look at for VPN & Firewall dtuies:

Watchguard Firebox Edge X20e

share|improve this answer

I can only speak in the most vague terms about the the options you offered.

Cisco ASA 5505 - I looked last year, and Cisco was expensive. Don't know if that has changed. I have used Pix and was continually frustrated trying to make adjustments. I believe it can do all that you ask, but features are separately licensed. No one was ever fired for buying Cisco.

Juniper SA 2500 - I have never used .. when I was looking last year Juniper was also expensive. My brother is a network security architect at a huge company in our space, and has installed Juniper and has nothing but good things to say. Not sure if it can do VPN; it might do static VPN but not client VPN.

Citrix Access Gateway, Sonicwall 2500 SSL VPN - these are VPN only; they do not replace a firewall. I imagine both are excellent; the companies both know their stuff. I have used a SonicWall firewall, but (see below) I found Astaro to be a better choice.


Since others have offered alternates, I will whole-heartedly recommend the Astaro Security Gateway. I deployed 5 last year to replace Cisco Pix in a WAN, and it was smooth and straight-forward, including multiple site-to-site VPNs and remote access.

As to remote access, the ASG has both SSL VPN and IPSec VPN. I have used the SSL VPN (which is based on OpenVPN) successfully. I don't know about the IPSec VPN, but would be confident giving it a shot based on my experience so far.

I deployed the ASG appliances, but they also sell it as a software bundle to use on your own hardware, and offer a trial. The hardware requirements are surprisingly modest - Intel Pentium III 900 MHz, 512MB RAM, 10 GB hard disk drive.

share|improve this answer

Of these I have only used the Cisco ASA 5505. It comes with licensing for 2 SSL VPN connections and a application layer Firewall. You would have to buy the Advanced Security license to bump the SSL VPN to 25 users. I can say it was a breeze to setup. My only complaint is that there is no connect before logon option for XP x64.

share|improve this answer

Not on your list but our Fortigate 60B has been rock solid for us and is very easy to configure.

share|improve this answer

Have you considered OpenVPN? i've got it running for the last four years on a dell poweredge 850 (just saw a few on CL for $300) and that's even overkill.

share|improve this answer

make a decision yet? I use both, an asa5520 or something like that, & a citrix access gateway for ssl vpn. The CAG, while not a true firewall, can do port filtering

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.