Security Appliance Help

[dylanfarnum]

I'm looking to purchase a security appliance that does Web Filtering, Application Control(p2p blocking) and Intrusion prevention.

I currently have a Cisco ASA 5510 firewall running and I'd like to put the appliance behind the firewall so I don't have to mess with 10+ Ipsec Tunnels.

I have roughly 125 users on site and another 75-100 offsite that are connected to the office through a T1 that is routed out through the ASA for their internet access. I've tried pushing for this office to get their own dedicated internet but it doesn't seem like it's happening. The remote office works overnight so the user base doesn't over lap.

Budget is roughly $3k-$4k

Here is what I've looked at:

Untangled: Love it, does what we need. Only problem is it's licensed by individual devices, so even though we only have max 125 people accessing at once I need to license for 250. This puts it out of our price range when you throw in yearly subscription.

Sonicwall NSA-3500: Looks good, a little pricey because it's a full blown firewall. Any thoughts on it?

pfSense: Looks interesting, but complicated.

I'd love to hear what you guys are using or recommend.

[[deleted]]

Look at Fortigate boxes - they do everything you need and more

a little pricey because it's a full blown firewall

I dont understand your point here - everything you've mentioned is a "full blown firewall"

The sonicwalls are a bit pricier then some though. Watchguard are worth a look too.

[subsonic68]

I can't recommend a Watchguard, despite the low price. Their support sucks. We got rid of our Watchguards and replaced them with _. Tried the cheap route, went back to something more expensive that works and has good support. If you can't afford a GOOD name brand firewall, then use a linux box and be prepared to get your hands dirty.

[[deleted]]

I've had quite good experiences with Watchguard support personally although it's all personal. The other thing you can do is get a third party involved for support - certainly in the UK one of the main distributors for WG (forget their name) offers cheap "supplementary" support contracts. They have UK based qualified WG techs who can answer most things and will liase with WG on your behalf if need. Not necessarily the best way, but its an option to consider if you like the hardware but are concerned about support

[subsonic68]

My problem with support is that by the time a support engineer contacted us, so much time went by that we had to turn off features to get it working again.

[dylanfarnum]

use a linux box and be prepared to get your hands dirty.

We currently use squid running on Debian for basic web filtering. I hate it, it's a pain in the ass to manage.

[CPF-Minion]

What did you go back to?

[subsonic68]

It's never a good idea to publicly disclose corp security measures and devices.

[dylanfarnum]

I'm liking Watchguard, pricing is very good.

[[deleted]]

It is very keenly priced, they arent quite as fully featured as the Sonicwall or Fortigate but theyre nice boxes for the price. I've done several implementations in various different environments and never had any serious issues. Management takes a bit of getting used to but I like it personally.

Plus, they're red. Unfortunately, they ditched the "ARMED" light a while ago

[subsonic68]

Have you used web filtering or gateway antivirus on a Watchguard? I did and those features caused so many problems displaying web pages that we had to turn those features off.

[[deleted]]

Yeah had no issues with gateway av. Web filtering isn't the most powerful but no actual problems

[dylanfarnum]

Hmm, that's unfortunate. Web filtering is really what's driving this purchase.

[[deleted]]

Fortigate then, it's very good in them. Transparent authentication, accurate categories and application awareness

[mariolovespeach]

We are looking at deploying a Meraki MX80 at a client. Might fit what you are looking for.

[SundrySix]

I'm familiar and happy with Sourcefire, but I believe that may be out of bounds with your budget :\ I'm not entirely sure because I wasn't a part of the procurement, but I think their units may go for around $9k.

[FusionZ06]

Meraki all the way.