Opinions on Firewalls

I'm generally not a huge fan of UTM all-in-one solutions.

The majority of vendors that offer these admit that to run at good performance levels you need to disable most of that functionality (check the spec sheet).

IPS will screw you over. Use IDS as a separate solution (either SPAN or passive tap). That way it has no performance impact on the network.

With almost everything using HTTPS these days most web filters are completely ineffective. They also use largely out-of-date malware and AV signatures. You can do SSL Inspection but it requires you to install a fake root CA on each client for a usable Internet experience and introduces a larger security risk than the one you're trying to protect against.

DNS-based filtering is the way to go for most cases. It will catch HTTP and HTTPS without slowing down your network for the things you want to block. If you need strict control then setup a traditional web proxy and configure clients to point to it (avoid transparent).

I like the Cisco ASA because when I want a firewall I just want a firewall.

Juniper SRX has a really great CLI experience if you have to manage a lot of complicated policy but I hear people complain about stability and hardware failure a lot. This would likely be my choice if Cisco is too expensive.

Fortigate has impressive performance at the high end in terms of raw throughput so you see it used for a lot of data center filters and VPN terminators but the CLI is unusable so you pretty much need to be OK with using the GUI to manage it.

Palo Alto is more of an SMB solution in my mind. That may be unfair as I haven't taken a close look in 2+ years.

Check Point is always mentioned but I feel like they haven't innovated or improved much in 20 years. After looking at them a bit more they wouldn't make my short list.

I really can't think of any others that I'd consider.

At the end of the day I really think you're best bet is Cisco or Juniper if you avoid UTM. Fortigate or Palo Alto would be OK for SMB without dedicated security engineers on hand.

I still say most of the UTM functionality doesn't have a significant impact on your security posture though. People often think UTM is some silver bullet and neglect the basics.

/r/networking Thread