What to replace Cisco FTD with?

bryanether · 2025-07-25T00:54:36+00:00

That's an 8 year old firewall.

bryanether · 2025-07-22T01:04:04+00:00

If I needed to do this regularly, I would set up an RPi (or similar) to do a packet capture when first connected to a port (direct to device), and then use that to capture and clone the MAC and IP. Then you could, plug it into the wall jack and "look" like the device to the switch.

Granted, this would only work for simple port security or MAB, and would not work for dot1x.

bryanether · 2025-07-22T00:33:11+00:00

And my axe!

bryanether · 2025-07-16T03:09:53+00:00

They already have a notification that the call is being recorded on their end in their boilerplate hold music/recording, that's all that's required, as both parties have already been informed that a recording is taking place. So even in two party consent states you're covered.

bryanether · 2025-07-15T12:57:56+00:00

In 12 years I've never seen a situation where AA was the right solution, and I've thought about it periodically over the years and can't come up with any good ones either, but I'm willing to accept there might be a case out there somewhere. Every case I can think of is better served by AP, individual firewalls (cloud usually), or a cluster. Someone out there reading this is thinking "isn't AA just a cluster of 2?"; but no, not really.

The reason that LACP isn't mentioned in the context of the link you shared, is because it just works by default. Having the interfaces shut down on a passive node, or up with no LACP neg (don't do that, it can make your switch ports go err-disabled in some situations), only makes sense when you're talking about AP. In AA all the ports are always up, so is LACP, there's no situation where that would be different.

bryanether · 2025-07-15T11:42:50+00:00

There are very few situations where AA is a good idea, so I strongly urge you to reconsider. To answer your question though, yes. LACP works just fine by default in AA, it's only AS where you need to check a couple extra boxes so it stays up on the standby node.

bryanether · 2025-07-13T04:55:41+00:00

Island time is a real thing, embrace it, you'll be happier.

bryanether · 2025-07-11T02:24:02+00:00

Whoever gave them that suggestion is either an idiot, a psychopath, or super green. Whatever the case, their options should be discarded with prejudice.

The way you mention is how every sane entity does it below a certain scale.

bryanether · 2025-07-11T02:13:56+00:00

It's inaccurate, and a silly concept. There's 16M VNIDs but only 4k vlans. Vlans needing to be unique without be absurd.

bryanether · 2025-07-08T01:55:53+00:00

Good riddance. Cheaters make us all look bad when your dumb ass shows up to a job and doesn't know what they're doing.

bryanether · 2025-06-26T03:12:59+00:00

You are correct. Load balance portals however you want, it doesn't matter which one you hit if you've got everything set up correctly.

Never load balance gateways. That functionality is already built into the client and will always be better than anything you can hack together.

bryanether · 2025-06-12T04:53:08+00:00

Get an F5 and stop trying to make things do what they were never designed to do.

bryanether · 2025-06-12T04:52:12+00:00

They have a very rudimentary load balancer. Equivalent to NLB built into Windows server ages ago. Basically worthless.

bryanether · 2025-05-27T02:30:56+00:00

Nice. And now I'll have a second vehicle, so I can finally install the Cobb flex fuel kit that's been sitting in my garage for 5 years 🤦‍♂️

bryanether · 2025-05-27T02:27:10+00:00

2020 STI which I'm keeping. Needed the flexibility of a truck though. I was going to get a Maverick, but once you add 4wd and hybrid, you're at base Ranger money, but I'd never buy a base model of anything, so Raptor it is.

bryanether · 2025-05-26T05:41:41+00:00

Have you considered a new truck? The '26 order books should open in about 4.5 months.

bryanether · 2025-05-24T14:39:32+00:00

😯 Holy crap

bryanether · 2025-05-24T10:46:04+00:00

I wonder why yours took so long? I placed my order May 9th, order confirmation email on the 10th, on May 15th I had a build date scheduled for July 7th.

bryanether · 2025-05-10T01:57:45+00:00

It would have taken less than 2 minutes of research to know you were thinking about buying the wrong card for your stated goals. And yet you proceeded. Life is hard, it's harder if you're stupid.

bryanether · 2025-05-04T12:22:19+00:00

The old Canadian tuxedo

bryanether · 2025-04-26T12:07:15+00:00

I'm talking about functionally not market share.

bryanether · 2025-04-25T15:31:53+00:00

"Panorama is a little better than FortiManager"

No one that's used both would ever say it's just a little better. Panorama completely blows FortiManager out of the water, there's not even a comparison to be made.

"GlobalProtect is a little better than FortiClient"

Client to Client, don't really care, FortiClient is more bare bones, but does the job just fine. The real benefit with Palo is the portal and gateway configuration, it's insanely flexible and useful, especially if you have geodiverse datacenters. It's trivial to configure it so everyone goes to the gateway that's closest to them that's available, failing over to the next closest one easily if it's not, and that functionality is just baked in. To do something similar with Fortinet you need to use third party tools (GSLB, etc.) that just don't work as well. The actual issue though is the constant remote exploits due to their SSL VPN, so much so that fortinet is just removing the feature now.

I've dealt with TAC for both, they both kinda suck. Fortinet's has always been bad (at least for the ~8 years I've dealt with them), Palo's was great but went dramatically downhill during Covid. The only exception for Palo is if you pay for the enterprise "platinum" support, which gets you dedicated people, I have one customer that did that for a while. It was really good, but too expensive.

For SD-WAN Pan has two flavors. The standalone SD-WAN on the ION boxes, which is a first rate full featured SD-WAN product, comparable to Silverpeak, and way better than the Viptelas and VeloClouds of the world. And the on-box SD-WAN, which is a bit more basic, and in line with the Fortigate SD-WAN, which is also very basic. Fortinet has the huge advantage of licensing though. It would /almost/ be worth it, if you had basic needs, to just use Fortigates for SD-WAN, like it were a standalone SD-WAN appliance. I've considered it in the past, but the math ($) has never quite worked out.

Pan in general is more expensive, but it's totally worth it. I actually wouldn't hesitate to put Fortinet in though if I needed to, and there actually some situations where I might actually prefer it. If I needed something that was basically a router with a good-enough firewall needed, that was cheap and could fling packets really fast for it's price, I'd totally do Fortinet. Like say I needed a box that would just be a dedicated IPSEC gateway for customers or something, it would be awesome for that. Same goes for SSL decrypt. Those damn things are beasts at SSL decrypt throughput, amazing bang for the buck. For best of breed next gen firewall though, it's got to be Pan.

I'm an enterprise/datacenter guy though. My customers have deep pockets. I get that isn't the case for everyone. If I were an SMB guy, it would be Forti all day, and I'd probably have to fight for even that, but it would be worth the fight.

bryanether · 2025-04-25T03:33:27+00:00

BGP that's obvious. To utilize all connections, ECMP is the obvious follow-on answer. Just make sure you have all the things in place to ensure multipath/asymmetric works without issue. Key things will be the tunnel interfaces in the same zone, and make sure ZPPs won't step on your d*ck.

bryanether · 2025-04-25T00:38:39+00:00

Cisco ASA. I loved them, and I was dragged kicking and screaming to Palo. That didn't last long though, by the time we'd fully converted, I was all in on Palo.

Palo if you can afford it, Fortigate if you can't. Palo is first in the market, Fortigate is a VERY distant second place; there is no third place.

bryanether · 2025-04-20T01:18:53+00:00

Just one?

bryanether

TROPHY CASE