4

We currently run pfSense with no problems, however we are looking at TMG as it is included in our partner subscription to MS and allows Windows 7 DirectConnect features to our domain for off-site users.

I have had a google, but there don't seem to be any comparisons of TMG to pfSense.

Anyone have experience/knowledge of this?

Our infrastructure is Windows Server 2008 R2 behind pfSense at the moment.

4 Answers 4

9

There's no comparison because they're really two totally seperate products that are aimed at two different markets. Kind of how you'll probably never see a comparison of a Ferrari 599 against a Bugatti Veryon. Both crazy fast expensive cars, but aimed at two different markets.

I've used both. In fact our internal office uses TMG, and our remote site uses PFSense, and it really comes down to what you're after in a firewall appliance and your ability to maintain.

I find PFSense a breeze to maintain. Setting up failover links, IPSec tunnels, VPNs, etc very very simple. All of this is much more complicated in TMG, but that's because TMG is very tightly integrated into your Active Directory environment.

TMG can also do host-based HTTP routing, whereas PFSense can't, so you can use one IP address across multiple internal web servers without needing a specific reverse proxy.

One of the best things about TMG is that you can effectively turn off just one person's internet access by disabling their AD account in the firewall. No need to set up any Squid authentication with RADIUS against your AD and then setting up ACLs.

I'd say the TMG is more difficult to learn then PFSense if you're starting from a blank plate.

0
6

Exactly as Mark said, they're very much two entirely different products. If you're looking for a proxy server that's tightly integrated with Active Directory and provides a slew of nice functionality in that area, you want TMG. If you need advanced NAT, routing, multi-WAN, flexible cross-platform VPN options, etc. you're somewhere between some, minimal and non-existent functionality with TMG, but pfSense offers a lot in those areas and is widely deployed for those things.

Maybe the best option? Use both. TMG inside the network, pfSense at the edge, and you get the best of both worlds.

0
3

Just like both Mark and Chris said, the products differ too much to be compared with eachother, and now, I will make it more "unfair" because I will compare some differences between TMG SP1 + Software update 1 vs BETA version of pfSense 2.

pfSense is an incredible firewall with many nice and advanced features, and extremely low hardware requirements compared to TMG. It´s free and is updated rapidly. It is easy to use and responds very quickly to your settings.

pfSence seems to handle enormous blocking rules FASTER than TMG and you can notice that in traffic flow in both ends of the firewall (after the packets have been processed) and you will also notice the GUI-response to be pretty fast on pfSense compared to the very slow TMG. Have not tried load balancing for this test.

When it comes to stability and reliability, pfSense does not seem to have any chance at all. We made a stress test with a setup of 10-machines with 8-torrents each plus 2-ftp servers and a SharePoint farm with 2-nodes behind a firewall connected to the Internet via 1 Gbit fibre. Additionally, we had 6 other machines connected to Internet via separate 100 Mbit lines (different locations with 4-different ISPs) to disturb the traffic which was flowing through the firewall. Undisturbed, the traffic flow through the TMG firewall was pending somewhere between 60-120 MB/s (upstream and downstream) and with full attack from all 6 "disturbers", the throughput speed went down to 30-70 MB/s. The webpages on the SharePoint server were responding pretty fair during the attacks. The same test with pfSense as firewall was horrible :-( The throughput went down to 2-30 MB/s and most of the clickings (from an external network) on the SharePoint webpage timed out. We even changed the hardware to another manufacturer to be sure that it was no compatibility issues with pfSense and the server(s), but it was hard to tell if it got better or worse.

I do not agree that TMG has minimal functionality for use as advanced NAT, routing, multiple WANs etc; pfSense offers more, but absolutely not MUCH more.

For use with Windows clients on the inside, TMG offers a lot more functionality, especially if combined with the rest of the ForeFront family.

Reports and monitoring in TMG is much better than pfSense.

If you really want to compare TMG with another firewall, try Cisco. I like the combination of ASA and TMG.

If you intend to stay partner with MS for a long time, I suggest that you use your partner benefits to its limits! ;-)

2
  • Something wasn't right there, maybe not an adequately sized state table, or possibly some of the state options needed adjustment for your specific test scenario. I've done a lot of very large scale testing under far higher loads than that (on 2.0 especially) and it stands up exceptionally well, with a $1500 server having comparable performance to a $40K+ ASA or Checkpoint box (two of the more recent comparisons I've done). ASA isn't comparable to TMG either, ASA is much closer to pfSense, and again those are largely two diff products. Jan 5, 2011 at 5:05
  • 1
    And it's just nuts to suggest pfSense is somehow not stable or reliable, many networks rely on it where downtime costs huge amounts of money per minute. You simply weren't doing something right, it's a rock solid, widely-proven piece of software. Jan 5, 2011 at 5:11
-2

+1 for stability / management issues with PfSense. I think the team created an outstanding product when compared to other free/open source projects. With that said: things like disappearing Webconfigurator and inability to manage the system quickly reduces its usability in an enterprise environment. here is one link, but the Internet is littered with them: http://forum.pfsense.org/index.php?topic=38965.0

This is a typical case of inability to compare commercial product with open source, the quality is simply not there. I'm not going to go into a debate on this, so in defense of open source, so far I have seen exactly 1 product: x264 video encoder that beats any commercial version hands down. The rest looks more like a science project than something you'd want to use where stability matters.

6
  • Well, here comes the first -1 with no comment...FSF zealots are out
    – arthur
    Apr 6, 2012 at 21:41
  • You do know that the vast majority of internet infrastructure and services are running on F/OSS, correct? I'm not a zealot by any means, but your post is incredibly short-sighted, misguided, and frankly inaccurate.
    – EEAA
    Apr 7, 2012 at 1:36
  • "not a zealot by any means"... sure. Old post here, but I do stand by my assessment of f/oss versus commercial products. I design things for enterprises, and f/oss products can rarely compete with their commercial counterparts. Looking at your profile I can see you are familiar with small business needs that are, first and foremost cost oriented. Enterprise needs are different -- reliability, serviceability and manageability come first. And before you ask for an example: have you ever tried to deploy redhat's version of IPA
    – arthur
    Mar 2, 2015 at 20:01
  • I'm not going to argue with you here. Reliability, serviceability and manageability are not mutually exclusive with f/oss products. Period. Sure, there are some crap products out there, both "enterprise" (read:ridiculously overpriced) and f/oss. But there are excellent products as well. By shoe-horning yourself into commercial-only products, you're severely limiting yourself, and the options that you could be providing to your customers. Oh, and by the way, small business does not == cost avoidance.
    – EEAA
    Mar 2, 2015 at 20:09
  • I would not equate f/oss to cost avoidance. As you might be aware, acquisition costs are minor relative to operational.
    – arthur
    Mar 7, 2015 at 19:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .