4

What's a good small business (<50 users at a location) firewall and VPN device? Wireless would be a nice addition, and I'm thinking of something in the $1,000 range. This would be for businesses with 0-2 IT employees. Quality support and the usability of the device count. SSL VPN would be nice, and if it's client-based, a VPN client that works on 64-bit Windows is important.

0

11 Answers 11

4

At work I recently installed a Cisco ASA 5505, in a role of small office firewall, site2site VPN endpoint and roadwarrior VPN endpoint. It is solid and dependable. Ciscos web GUI is limited, knowing your way around the Cisco command line is practically required.

Cisco is splitting up their VPN client software, the old IPSec based client is slowly being faded out, and the new SSL based is gaining momentum. One example of this is that no 64 bit version is planned for the old IPSec client. Bad news for you, SSL is licensed separately, and much more expensive.

Should I set up 'roadwarrior' VPN again, I would insist on Active Directory integration. Our users are constantly forgetting the VPN passwords, since it's separate from AD which they use daily in the office. Changing the passwords is not much of a hassle, but a good deal of productivity is lost. Our users often try their VPN from home the night before a deadline...

uPnP would be surprisingly nice. Many of our users make use of Skype or something else that needs traffic passed through the firewall to work optimally. Yes, there is a strong security argument to be made against uPnP; the choice is yours to make.

And last - statistics. The Cisco ASA has a good stats section, and it can actually help you troubleshoot certain types of network issues. I would not want a firewall (or much IT gear in general) that cannot provide me with a view into what's happening, for those rare days when there is an elusive problem on the network.

Kerio Winroute Firewall has AD integration, uPnP if you want it, and a very solid looking statistics section. Kerio has a good track record in firewalls, their workstation firewall was a market leader for years until they sold it off. I have not worked with Kerio Winroute, but should I set up a small-biz firewall again, I would pick Kerio Winroute or Windows 2008 R2.

2008 R2 has a really solid looking VPN implementation, and it seamlessly integrates with Windows 7. The very noticable downside is that Windows 7 is required on the client PCs. We could accept this, I doubt many others can right now.

I know of pfSense and many other open-source firewall distros. They are very, very nice. For my small-office needs the additional performance of pfSense on PC class hardware doesn't matter, since we are on a 10/10 mbit line. And the price of a small ASA or Juniper SSG is not prohibitive. So a pfSense ends up mostly competing against ASA or Juniper SSG, and I just prefer the simplicity and short time to implementation of the ready-made version. But pfSense is very nice, for other needs it can be great.

So for me it would be either:

  • A two-firewall "DMZ" config, with a fairly simple firewall appliance out front, and a PC based software firewall (Kerio, Windows 2008 R2) behind it for roadwarrior VPNs with AD integration.
  • A one-firewall setup, with a PC based (Kerio, Win 2008 R2) firewall with 2 NICs (arguably slightly less secure, but I doubt it is much of a problem nowadays).

Right now, I would buy Kerio Winroute (again, only looking at their website, I have not personally worked with Kerio Winroute yet). A year from now I would go for Windows 2008 R2, if you're a Windows only shop.

13

May I recommend you take a look at pfSense. I find it to be capable on a 40 user network and easy to manage. The web interface makes management of OpenVPN an easy task.

You wont lose anything by trying it.

2
  • I second vote for any distribution of FreeBSD, but I do not now how then can be wireless integrated without baying another AP.
    – adopilot
    Jun 19, 2009 at 7:50
  • I vote for anything but Pfsense in the FreeBSD distributions. It is the only one actually simple to use ! Jun 19, 2009 at 8:09
4

I've had nice luck with the Cisco ASA-5505. It's a bit pricey, but it's nice gear to configure and has been reliable. You can terminate a variety of VPN protocols on it, including PPTP, IPSEC, and L2TP. There is SSL VPN functionality, but I believe it's licensed separately from the unit.

3
  • 1
    Same here (except that I still use our old PIX), it's rock stable. Just beware of lousy support/return policy as long as you don't have a TAC agreement.
    – pauska
    Jun 19, 2009 at 9:05
  • I would recommend the Cisco ASA-5510 with Security Plus licensing at this price point - you get far more functionality than with the base 5505. Jun 19, 2009 at 10:05
  • +1 on the comment @pauska. Cisco gear w/o SmartNET, expensive though it is, is a ticking time bomb. That shiny Cisco nameplate has both an initial expense, and a recurring expense. Jun 19, 2009 at 19:41
2

We've had great luck with the Fortigate appliances. For the money they have more features than the Cisco ASA's and are easier to configure.

1

For around $1000 I would use a Draytek 2950 or 3300. Actually both of these should give you plenty of change. I've used many of these routers and they're very good, easy to configure and offer advanced features like load balancing. They both do LAN to LAN IPSEC VPNs and they support PPTP dialin VPNs for individual users. The PPTP dialin uses the VPN support built into Windows and needs no extra software. In your place I would select the 2950 as the 3300 probably offers stuff you won't need (like load balancing over up to 4 WAN ports!).

The Draytek 2910 is a lot less than $1,000 but doesn't have the horsepower to support more than two or three simultaneous VPN sessions.

JR

1

I have had good experience with IPCop on the software side and something from pcengines or soekris on the hardware side.

IPCop provides a nice webinterface that let's you simply download OpenVPN configuration and handles most of the basic routing stuff. There are also quite a number of plugins available like a caching proxy

1

we have been using a WatchGuard X500 for the last 5 years (maybe four years) to provide a VPN-solution for our company.

With the end of 2008 the productlifecycle of this watchguard end and we need to switch. So we bought the new model. But VPN was "pain in the a*s" It did not work on Vista or any other platform then Windows.

Finally I discoverd pfSense. This system is completly free and based on freeBSD. I have installed it on the old WatchGuard Hardware. It provides a SSL-based openVPN infrastructure. Since switching to pfSense we don't have any problems with VPN connection AND I don't need any windows client (physicly or virtual) at home because there are openVPN clients for windows, Mac OS and Linux.

If you wanna read mor --> klick me.

A I forgot: this little red box provides this service for about 80 users where 5 to 10 are logged in at the same time.

Hope this helps you a bit.

Best regards

arl from germany

1

I have a consultant friend who swears by the sonicwall appliances, they are largely "Set and Forget" as far as admin is concerned. Doesn't mean you shouldn't check your logs regularly!

1

I've had pretty good experiences with the Checkpoint Safe@Office devices.

  • Integrated Wireless, can segregate from internal network
  • Builtin VPN, including their own client (not sure if the proprietary client has x64 or not)
  • Logging (including syslog option I believe, but never used that)
  • Auto-updating patch maintenance
  • Alerts
  • Pretty easy to configure
  • Very stable

Good stuff.

1

Definitly the Cisco ASA5505 or the 5510 if you can afford it, I have a number of these devices (and before that I used the PIX 506e's and 515e's). As for the earlier comments about active directory authentication, I have installed Microsoft Authentication Services (Microsoft's RADIUS implemenration) on one of the Windows servers on my AD, and configured the ASA to authenticate the VPN to RADIUS.

THis allows the users to use their AD passwords, and really does simplify my life, as users always forget any other passwords you give them, and as Jesper Mortensen said, it usually happens when there is a crisis at hand - like they are on a deadline to submit some work, which ends up in yours truly, the sysadmin, getting an after hours call to reset a password.

The ASA also allows you to configure L2TP VPNs which will work with the native windows client in Win2K and XP (unfortunately not the one in VISTA and Windows 7 - because of a particular microsoft take on their latest implementation of IPSEC, although I am sure that market forces will result in either Cisco or Microsoft bending on their particular interpretations of the RFC).

The ASA is a fairly well structured and easy to configure device, once you understand the Cisco way approaching the appliance (ie., everything is NAT, and the security levels on the interfaces) what I like about the 5505's is that they have two POE ports on the back, to which you can hook an IP phone, or a wireless AP and save yourself extra wiring.

The only criticism I have of the ASA is:

  1. The limited SSL licencing
  2. The device has an external power-supply, that has a really flimsy connector on the back of the device.
  3. The power-supply for some reason makes this wierd high-pitched whistle type noise, that can be irritating to some people.

If you are looking for something all-in-one, also consider the Cisco 800 series routers. You can get some info here link text. They have a bunch of nice ones that have Wireless built in, and if you have an ADSL service, you can find them with integrated ADSL2+ modems, which makes for a single box branch office solution. They run IOS 12.x and you can get versions of the IOS that supports Cisco's CBAC (context based access lists) - basically a stateful firewall, and encryption together with Cisco Easy VPN. I am not sure that you have application proxies in CBAC, as I have not used it in a while.

1

Using the Linux distro called SmoothWall ( http://smoothwall.org/ ) is probably the cheapest and easiest.

You could buy a cheap-o $100 computer on EBay and an extra NIC card and your in business.

Not the answer you're looking for? Browse other questions tagged .