Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Which firewall would you advice to use to meet following 1Gb line and most anti hacking modules. Price range 10k-15k$.

3 years warranty on site, full support online.

About modules, i don't know what role antivirus has in firewalls because this firewall gonna be used for IIS applications but definitely against DDOs types of attacks... Not good enough to say more.


share|improve this question

closed as off-topic by Tom O'Connor Aug 25 '13 at 21:43

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – Tom O'Connor
If this question can be reworded to fit the rules in the help center, please edit the question.

Why the down vote? Seems like a perfectly reasonable question to ask. +1 to counter the unfair down vote. – Bryan Dec 10 '09 at 12:37
Thanks Bryan, got no idea why by myself. Edited my post with few more details – eugeneK Dec 10 '09 at 13:02
up vote 2 down vote accepted

This question still needs more details if you expect actual suggestions for specific solutions. But I think you should be able to answer this one on your own with some more research. Cisco, Juniper, FortiNet, SonicWall, etc will all have a solution that fit your needs. The speed and number of WAN links you're trying to protect is going to be the biggest factor in sizing the unit, aka what model you need. Beyond that it's going to boil down to price and features that you need for all your requirements.

I personally prefer FortiGate units from FortiNet over the Cisco ASA's but it's a personal preference. I've never used the Juniper solutions so I can't speak on those but I've heard good things about them.

This is a little OT, but don't get lazy on hardening the IIS server or application just b/c it's behind a firewall. Everyone loves to jump to the conclusion that the security check box is checked b/c they have a firewall but it just takes one misconfiguration to get past your security. Also IDS/IPS systems are not 100% affective and have to be configured properly for your environment or you'll get a lot of noise from them.

share|improve this answer
Thanks, mate. I'm currently for Fortigate 800 as a solution. I'm not lazy to get all info you need simply because things you ask me i have no idea about. i'm just a programmer and not sysadmin. My company always gets cheated by those who sell these advice or any kind of hardware this is why i need answers and info form decent lads in here. Thanks for the answer – eugeneK Dec 11 '09 at 9:49
The Fortigate 800 is an excellent box. It has 4 gigabit interfaces that you can use for WAN, Internal, DMZ, you can even setup two different DMZ's if you wish. Take a look at their listed specs though to make sure your ok with the throughput on it's IPS, VPN, and AV capabilities. It looks like the slowest figure is the AV portion which is 150Mbps, which is still a fast WAN link around 18MBps. You can just apply protection profiles that include AV to the firewall rules that need it. Good luck and if you have any specific questions post another question. – 3dinfluence Dec 11 '09 at 14:36

I wouldn't bother with a black box solution. I'd go for an x86 cheap box with SmoothWall or IPCop, and three network cards to cover your incoming, outgoing and DMZ requirements.

share|improve this answer
+1; out of curiosity - do you run it [whatever black box it is] near 1Gbit/s speed... with majority of short packets in the traffic? how well does it perform? it's been quite a while since i've done such benchmark last time. – pQd Dec 10 '09 at 11:14
In South Africa, we're lucky to get 4Mbps for Internet (ADSL), so this isn't a factor I've had to consider. 384Kbps - 1Mbps is the average DSL speed. I put the gigabit NIC on the internal segment to go directly into the gigabit switch, but usually the line usage is very low. – user3914 Dec 10 '09 at 12:50
Another thing: if you put good NICs on this cheap solution, it performs very well. You can get away with 256MB of RAM and an old Pentium or Celeron then. – user3914 Dec 10 '09 at 12:52
I prefer hardware firewall. Thanks – eugeneK Dec 10 '09 at 13:05
SmoothWall do offer a couple of hardware solutions - use the link in my answer. – user3914 Dec 10 '09 at 13:28

Nokia IP290

Our corporate network has Nokia IP290, which is really easy to mantain and it's bulletproof. Highly recommended. Cost was about 4.5k$ (tax incl.) with 1 year subscription.

Datasheet with specs is here.

share|improve this answer
What's the subscription for? Warranty? Support? Anti-malware (does it do it?) – Massimo Dec 10 '09 at 11:16
Nokia boxes run checkpoint. I seem to recal that they've been taken over / sold to checkpoint directly. The nokia boxes run a form of freebsd; the checkpoint "splat" boxes run linux and I'd expect the support for the ipso firewalls to be even crappier than before. Oh, and they're basically just server class hardware boxes with a crypto acccelerator card (that made our firewall crash at random). Oh, and our 1260 couldn't do full logging in our config with a probably garbage rule set and rare peaks of 300mb/s of traffic and more typically 100mb/s of traffic. I don't like the platform at all – chris Dec 10 '09 at 13:12
Massimo, when you purchase such unit you need to buy at least 1 year subscription for checkpoint software. After this period will expire, there is no need pay except if you need software updates. – Andrejs Cainikovs Dec 10 '09 at 14:28
Chris, that's weird. We are really happy with this unit. Behind it we have 2 Proliants, each splitted on 4 vm's, plus couple of Ded's. We have quite a complicated setup with balanced bandwidth and got no problems so far. Can't tell much about logging as we are using it only for problem solving, and are keeping the logs only for short period. – Andrejs Cainikovs Dec 10 '09 at 14:35

You probably need to specify more. Packets per second? How much VPN traffic? Juniper or Cisco can be alternatives. If you don't know exactly what you need, you should probably turn to a consultancy firm to get help evaluating it and candidate hw firewalls.

As mention earlier, a Linux or BSD based firewall could very well do this pretty cheap. (Actually run two plus CARP for high availability).

share|improve this answer
Plus, do you want support? Anti virus? What type of warranty? etc .. – 3molo Dec 10 '09 at 12:06
I would also like to add that if you're using IDS/IPS, anti-virus, anti-spam etc, the firewall will not be able to handle nearly as much as the specification states. Divide it by 5 or even 10 to be sure :-) – 3molo Dec 10 '09 at 12:09
I have edited my post... – eugeneK Dec 10 '09 at 13:04

1Gbit is not enough to give you an answer. You need to share with us if it will handle VPNs, if so how many. What type of data would you be pressing? Small packets, big packets etc. Depending which features you need, such as IPS/IDS and VPN performance you need a very big firewall to cope, think ASA5580 or cisco 6500 with FWSM.

But you need to supply a more detailed description of what your needs are.

share|improve this answer
What small packets and big packets mean? What are the things i need to look for in firewall besides info i've asked ? – eugeneK Dec 11 '09 at 9:50

I would think you would be able to find a CheckPoint dealer in your area. We used to run a hot failover setup on a pair of Nokia boxes. Very nice rig.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.