Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Firewall Recommendations?

Posted by Cliff on Fri Mar 30, 2007 06:50 PM
from the only-the-best-for-your-network dept.
Security
anomalous cohort asks: "The company that I work for is looking at upgrading to a proper firewall (sadly, we use only the MS-ISA server now). Our I.T. guy is ready to recommend Fortigate [45]00a. Ours is a small company with about a dozen employees and about 400 customers. Does anybody have any experiences, good or bad, with these two products or with the Fortinet company? Are there any recommended firewalls (outside of Cisco's) that we should seriously look at?"
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Firewall Recommendations? 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Old computer+Linux (Score:4, Interesting)

    by Shawn is an Asshole (845769) on Friday March 30 2007, @06:53PM (#18551153)
    Then run Debian, Firehol, and Squid (transparent).

      • Re:Know what you need (Score:5, Informative)

        by HeelToe (615905) on Friday March 30 2007, @09:13PM (#18552261) Homepage
        How do multiple external ip addresses cause an issue? I've been able to successfully have plenty of external ip addresses, and more particularly, multiple internet connections each with its own WAN and or CIDR block.

        The trick to the former (multiple ips, one internet connection) is really managing via subinterfaces. Firewall rules to deal with the packets associated are pretty easy. This lets you DNAT things into the appropriate place via iptables. If you want to actually build a DMZ, you could use a proxy arp setup like this: http://www.sjdjweis.com/linux/proxyarp/ [sjdjweis.com]

        As for multiple internet connections, look into multiple routing tables via the ip command. Example:
        ip route add default via table 100

        Then use ip rule statements to choose when to use the particular route tables:
        ip rule add to table 100
        ip rule add from table 100

        You can also pretty simply setup multiple SNAT rules to SNAT traffic over each link for different purposes. This lets you do things like SNAT to a specific host (read: internet connection) based on protocol, internal source address or destination. Handy for lots of things.

        One nice thing to do with multiple internet connections is to have verbs in your firewall script that will allow you to manually failover your internet connection if one goes down. This obviously doesn't help external entities trying to reach hosts that sit in your DMZ on a failed connection, but it can let you continue to work with outgoing traffic while the problem is resolved.

        If you're slick, you have your DNS hosted externally and you can then use this to update DNS for the DMZ to an alternate zone which specifies those public facing hosts as existing on the internet connection you just did a failover to. Make sure your A record TTL values are low.

        This leads to a reconfiguration of the DMZ unless you have done full SNAT/DNAT mappings for each DMZ host in the firewall. Doing so can be a lot more work, but you can build a set of symmetric (or controlled in a script by a variable) configurations that swap out the DMZ nat rules so that they exist for one specific internet connection or the other.

      • Re: (Score:2, Informative)

        by Anonymous Coward
        The big wall we hit was multiple external IP addresses.

        Depending on what you mean by "multiple" (Linux should handle a fair-sized network just fine, though I'm sure someone will pipe up about how he has an entire /8 running through a single box running FooOS and how Linux would have crashed and taken their billion dollar account with it and driven their company into bankruptcy, etc. etc.) and what you intend to do with all those IPs once you have them (load balancing/redundant connections over multiple serv

  • OpenBSD PF (Score:5, Informative)

    by akpoff (683177) on Friday March 30 2007, @07:02PM (#18551239) Homepage
    OpenBSD makes for an awesome Firewall. Get whatever size machine you need, install OpenBSD, enable PF, follow the *very* well written configuration docs online [openbsd.org] and you'll have one or more firewalls up in no time.

    I just set one up and it was easy. And best of all the PF syntax is very straight forward.

    • Re:OpenBSD PF (Score:5, Informative)

      by snowgirl (978879) on Friday March 30 2007, @07:21PM (#18551447) Journal
      I have to lend my support towards OpenBSD's PF. It is by far the clearest yet most powerful firewalling configuration setup I've seen.

      I highly recommend it over IPTables at least.

      • Re: (Score:2, Insightful)

        by Anonymous Coward
        There have been two remote exploits in the default configuration of OpenBSD in the last *TEN* years, that should say a lot. I've been using OpenBSD for nearly 10 years, and while I may not like, or agree with all of Theo's actions, I must say it is an excellent OS. Besides it's been a few years since Theo has ripped out the firewall software in a fit of rage and they released the a version of OpenBSD for the DEC Alpha without any Firewall software included. Yes, I'm still bitter, and any other product I

      • I have to lend my support towards OpenBSD's PF. It is by far the clearest yet most powerful firewalling configuration setup I've seen.

        I highly recommend it over IPTables at least.

        Which brings up a question I've been wanting to get a solid answer to for a long time now: Why hasn't anyone developed a simple-to-use, runs-from-CD, pre-configured, dedicated firewall/router variant of OpenBSD for turning old computers into firewall/routers? After all it is arguably the most secure operating system available and e

        • Re: (Score:3, Informative)

          by pnutjam (523990)
          I recommend you look at Monowall [m0n0.ch] for a boots from CD OpenBSD firewall router, or I prefer pfsense because it allows you to install to a hardrive and has more features. [pfsense.com]
          • Actually, both of those firewall solutions are based off of FreeBSD (which ported pf from OpenBSD some time ago). FreeBSD is, in my opinion, an easier to manage and slightly more robust OS, though it isn't audited for security quite as much as OpenBSD is.

          • I recommend you look at Monowall for a boots from CD OpenBSD firewall router, or I prefer pfsense because it allows you to install to a hardrive and has more features.

            M0n0wall uses iptables and is based on FreeBSD. PfSense at least uses PF from OpenBSD but is also FreeBSD based. Unless there are other options out there I guess really nothing has changed. Everyone talks up OpenBSD as the most secure OS and the best possible choice for a firewall, but nobody wants to take the time to make a usable dedicated f

    • Add CARP and you'll never even lose a packet if one of the systems dies.
    • I agree 100%. PF is an excellent firewall. Running on commodity PC hardware, however, may not be the way to go (BUS issues).

      Force10 is working on a firewall solution which implements PF. They claim line-rate for Gig and 10-Gig, and they also include Snort on the device. It sounds absolutely wonderful..the best of both worlds, basically, since most commercial firewall solutions that I've seen are (in my opinion) fairly unwieldy.

      • Re: (Score:3, Informative)

        by Anonymous Coward
        And thirded! (?) OpenBSD is a superb firewall solution. CARP and pfsync give you a high availability firewall solution that you would otherwise pay thousands for with commercial vendors. The O/S is clean, stable and the pf syntax is intuitive. Rule tables can be updated on the fly, which means that blocking naughty IM clients becomes a snap with some signatures in IDS->pf updating.

        I've been using OpenBSD since early 2001 (at home and in corporate environments) - the quality is there, just make sure you r

      • Re: (Score:3, Informative)

        by Anonymous Coward
        I third this. I've been deploying OpenBSD firewalls for a few years now and I have zero complaints. I can't even recall the last software problem I had. Hardware has died, but as the parent poster pointed out, there's pfsync and carp for redundancy. Works flawlessly. Even at home I have a little Soekris 4801 running OpenBSD which has never let me down. Don't bother with the $$$ crap.
  • Been using it for quite sometime now. Works great, never had any problems. I'm running it in front of two dedicated game servers (CS:Source, viewable on the public server browser), two other servers, a front desk comp, and twenty gaming machines. It has a 600MHz Celeron and handles all that traffic perfectly.

  • 3 things to look at (Score:4, Informative)

    by georgewilliamherbert (211790) on Friday March 30 2007, @07:04PM (#18551255)
    Cisco ASA 5505 (it's less than a thousand dollars), and the Nokia Checkpoint appliances (i350, etc).

    Also the Juniper/Netscreen models (SSG 5, SSG 20, Netscreen 5 models)
    • I wouldn't go with anything from Checkpoint. Maybe it's just our IT Dept, but we have never-ending problems. I think our total number of days in the last 2 years without firewall/VPN problems has been zero.
      • The Nokia boxes are appliances (1/2U rackmount) running the Checkpoint firewall software on top of an embedded OS.

        Checkpoint is the single most popular longest lasting commercial Firewall product; you don't have to like it, but it's sort of silly to say that it's not a suitable product. It's outlasted many generations of competitors and done just fine for a huge client base.
        • I'm not complaining about the hardware.

          I don't care how popular it is. In my end-user experience the software is terrible. It may just be our IT Dept. It's been a long, long series of outages, failures, annoyances, usability issues, limitations, and general dread. It has never worked well.

          I've setup systems built out of stuff I knew was just complete junk, and it worked better than our Checkpoint system. But it may just be our IT Dept.
      • It's your IT department.

        Checkpoint is stable, secure and has an excellent track record. If you actually have to administer the firewall, the Checkpoint GUI is second to none. Simple, intuitive, everything you could want. SecuRemote isn't any more annoying than most other VPN clients. Of course, none of that comes cheap. Checkpoint (especially on Nokia hardware) is the most expensive choice by far.

        Juniper seems to make a pretty good device. I've been running a Netscreen 208 and a Netscreen 50 for a w

        • Re:Some people can screw up anything (Score:4, Informative)

          by Pedersen (46721) on Friday March 30 2007, @09:06PM (#18552217) Homepage

          It's your IT department.


          Checkpoint is stable, secure and has an excellent track record.



          We have problems with the Checkpoint/Nokia combo as well. I'll admit it: It's at least partially because my training with the system has amounted to "I wonder what this button does?". However, it is mostly stable, mostly functional. But, when there is a problem, I get to make the call I dread the most: I call Checkpoint customer support.


          Why do I dread this call? I have zero options. I'll get a call back. If I've got a severity 1 issue (my company is down, unable to access the internet, web site sales are shut down because of it, I need help fixing this now!), the best I can hope for is to get a call back within the hour. I've opened up lesser issues, and not even gotten a call back. Found the answer within a day of searching the net, and appended a note to my ticket that I appreciated their lack of response, but that the issue was now fixed, so they could close it. And the whole reply to that was a "heartfelt" apology.


          The software may well be great. The devices may well be solid. But the customer support? I've gotten more (and more useful!) answers from Microsoft's web site than I have from the Checkpoint people. Based on that alone, I would never recommend buying their software.


          Note: I have no problem with paying for software. I have no problem with paying for support. I have no problem with using software that is unsupported in any official manner (much FOSS stuff, for instance). I do have a problem with paying for software, then paying for support, and not being able to get it when I have to have it.

        • Re: (Score:3, Insightful)

          by Kohath (38547)
          Is there any way to get internal DNS to work for VPN users? Our IT Dept. can't do it.
          Is there any way to get it to authenticate VPN to Windows Active Directory in a company with multiple Active Directory domains? Our IT Dept. can't do it.
          Also, Secure Remote pops up and asks for a password about 20 times an hour unless Auto Login is enabled. Any ideas?
          Not to mention the "if you tell Secure Remote to connect to site A, then you can't access systems at site C" problem. That's too complicated.

          Is there any w
    • Watchguard's gear is decent for the price (and I think bsd or linux-based)...does arp proxy, vpn, nat, etc. It's been 5-6 years since I've used one, but it was a good fw for a small network to hide behind.

  • The perfect firewall (Score:5, Informative)

    by ernest.cunningham (972490) on Friday March 30 2007, @07:05PM (#18551265) Homepage
    Well fairly good anyway. check out Smoothwall Linux Firewall. http://www.smoothwall.org/get/ [smoothwall.org] SmoothWall Express is an open source firewall distribution based on the GNU/Linux operating system. SmoothWall includes a hardened subset of the GNU/Linux operating system, so there is no separate OS to install. Designed for ease of use, SmoothWall is configured via a web-based GUI, and requires absolutely no knowledge of Linux to install or use. We use this in our business. VERY good.

    • Re: (Score:3, Informative)

      by skogs (628589)
      I second this vote for smoothwall.

      The corporate friendly version with everything fully configured/implemented for you is a good decision. This requires some $$, and less time.

      Or, you can roll your own with the smoothwall express 2.0. I run it with DanGuardian content filter - gets rid of ads and other pr()n and stuff. Also have several mods on it. Really, visit the homebrew forum and you can do anything with it. This of course, requires no $$, and more time.

    • I've played around with Smoothwall a few times. It's got my vote.

      Now only if someone could create a "smooth file server" to share and set permissions with ease via HTML GUI. If anyone knows of such an animal, please do tell!

  • Astaro (Score:3, Informative)

    by Anonymous Coward on Friday March 30 2007, @07:05PM (#18551271)
    http://www.astaro.com./ [www.astaro.com] 'nuff said.

    • Re: (Score:2, Informative)

      by pookemon (909195)
      I'm curious as to why this was modded "Funny". One (maybe more) of our clients runs Astaro v6 and it seems to run fine. The only gripe I've had with it is that I couldn't do a port forward and translation at the same time (ie. If I want a client to connect on port 12345 and forward the traffic to machine x on port 1234 then it wouldn't do it) - mind you that was an older version and I haven't tried since. It's easy to configure and handles large amounts of traffic - but apparently it's funny...?

      DISCLAI

  • Windows Computers (Score:5, Funny)

    by Anonymous Coward on Friday March 30 2007, @07:09PM (#18551319)
    Computers with Microsoft Vista make the best firewalls. Let's say you have a large boiler room, and you really want to keep the heat contained. A good thick layer of 3-4 PCs with Vista Home Premium (or 2-3 PCs with Vista Ultimate) will keep just about anything contained. Please note that Vista Home Basic isn't really suitable for this job in any thickness, as it will tend to burn and contribute to the problem.

    Oh, and don't forget to apply a generous coat of anti-virus paint every morning!

  • We use one (Score:5, Informative)

    by realmolo (574068) on Friday March 30 2007, @07:09PM (#18551323)
    We have a Fortigate 400, and we love it. It's damn near perfect. I recommend them to EVERYONE who is in the market for a high-end firewall appliance.

    Truly, it the best thing on the market, right now. Much better than a PIX, or Netscreen, or anything else. And cheaper. And it does more.

    They really need better marketing, because few people even know they exist, which is too bad.

    So yeah, you should get one.

  • It might be carcinogenic (Score:3, Funny)

    by andy314159pi (787550) on Friday March 30 2007, @07:11PM (#18551343) Journal
    Even though it's carcinogenic, I recommend asbestos. It's one of the best thermal insulators known and if you don't rip your walls open you'll never breath it in.
  • pair of computers with extra nics and you can have redundant firewall
  • More than one, with the firewalls all as different from each other as possible. Hackers do find and exploit bugs in commercial firewalls, so when they breach the one facing the internet there's another level of protection. Widely differing firewalls in series greatly reduce the change of anyone breaking in. The number of series firewalls depends on your security needs. Note well: if you're depending on one commercial firewall to protect your business - you will be hacked. You probably have been already. E

  • IPCOP (Score:2, Informative)

    by brenddie (897982)
    IPCOP is a very secure and flexible firewall plus its open source. It runs on all kind of hardware like normal PCs , boards with CF cards , servers. A vanilla installation is full of features like VPN, QoS, IDS, web proxy and by using addons you can add stuff like detailed proxy reports, content filtering, traffic monitoring and a lot more.
    You can find it at http://ipcop.org/ [ipcop.org]
    Their mailing list is pretty active and full of helpful people.
    If you have a spare PC and some network cards give it a try.

  • OpenBSD + PF (Score:4, Informative)

    by grub (11606) <slashdot@grub.net> on Friday March 30 2007, @07:38PM (#18551607) Homepage Journal

    We run several PIXes (Cisco) at work and at branches across the country. They handle the VPNs well enough and are simple enough to work with but when you see shit like this (IPs removed):

    Mar 28 14:45:25 x.x.x.x Mar 28 2007 14:46:16: %PIX-4-407001: Deny traffic for local-host inside:y.y.y.y, license limit of 50 exceeded
    in your logs from units which cost thousands of dollars, you have to scratch your head. Yeah, they charge for how many machines you'll run through it. We have a few "unrestricted" ones but they're thousands of dollars. Thousands of dollars I can better spend on other stuff.

    We let our contracts lapse and are working hard at moving everything to OpenBSD, PF and the native IPSEC although OpenVPN is a serious contender as we use that for the road warriors already.

    It pisses me off to no fucking end that to get a firewall capable of gigabit (we're a bunch of research labs on CANARIE [canarie.ca]) from Cisco will each a big bite from my budget, just to have the "Cisco" brand on it.
    nb: I do love their routers and switches. Their firewalls are overpriced and underwhelming.

      • You won't get those kinds of speeds on any PC platform without some sort of dedicated firewall on your NIC (so that you can avoid the PC's BUS.) In practice, you might get as much as 300Mbps.

        Basically, once you start getting into those speed ranges, you need an appliance.
  • Anyone have experience with the Sonicwall PRO series?
    • Love em, especially with the Advanced OS, without it I would take a PIX but the advanced OS gives me all the flexibility I need with a MUCH easier to manage interface. Managing a large number of them is easy with the Global Management System. For a small office the AV subscription service is nice because it enforces client updates without the need for an IT person to hound the users or checkup on them.
  • Firewall technically speaking was always simply a filter for lowend network traffic. Like open this port for this IP and DROP else etc. Right now I see the term "firewall" has evolved to meaning - everything that does border security (firewall, proxy filtering, NIDS, monitoring etc.). So I guess you should be asking about security appliance...

    According to their description here - http://www.fortinet.com/products/telesoho.html [fortinet.com] - it does lots more than a firewall:

    "These [...] systems deliver [...] security se
  • I would also recommend IPCop (http://www.ipcop.org/) It has been rock solid for me, with eleven locations, and it's actively supported. It runs on nearly anything (I believe you actually need a Pentium now, but 1.3 ran on 486s), and best of all, it's free. That means you can experiment with it on an old PC at no cost other than time (and maybe a cheap-ass network card or two). At the very least, it's a great way to evaluate the idea of a Linux based firewall, even if you end up going with something else.
  • seriously, i made my firewall out of that shit

    what kind of an asshole am i?

    you know, squid, openvpn, old emachine with an extra nic

    lool :) smiley face
  • We have at least two dozen of the lower end (50, 60) Fortigates deployed to a majority of our clients. We love them! Support from Fortinet is top notch (if you're paying for the 8x5 or 24x7). We've had to replace a few units, but some of our clients are in, shall we say, less-than-ideal environments. Though, in those cases we get very prompt service, usually overnight of a new unit to put back into place.

    The configuration can be done via web, or command prompt which is nice, and of course fully remote admin
  • Pretty much anything, as long as it's running on a Dell laptop......
    • Runs well off a CF card, as does m0n0wall, etc.

      You can also Ghost or dd an image of the CF card to load more systems or as backup.

      I partitioned my CF card so I could Ghost the OS partition easily.
      The CF card adapter is mounted in an old IDE swap rack. Pull rack, pull card, copy Ghost image using a card reader in another box.

    • Re: (Score:3, Insightful)

      by Wudbaer (48473)
      Especially with firewalls it makes sense doing an Ask Slashdot. Google will give you myriads of possible solutions of all kind, and every vendor or consultant has some kind of firewall solution they are trying to push, often because they make shitloads of money selling broken or oversized commercial solutions.

      Getting an impression of what works for whom is priceless, even/especially if you are already working with some kind of security consultant (I cannot count the ridiculously insecure, oversized/-priced

        • Re: (Score:3, Insightful)

          by Wudbaer (48473)
          Sure. The same as on Usenet, any kind of Web forum etc.pp. And you get all kind of astroturfers, trolls, self important idiots and fanbois, but also lots of people with real experience and know-how (ok, now who's who ?).

          Perhaps I formulated it wrong in that you do not necessarily find out what works but rather what not. If enough people say "xyz does not work because blablabla" and not another hundred people come in screaming "wrong ! wrong!" or the other way round you get at least some idea about the merit
    • Funny that you mention RouterOS. My company (actually, I am leaving them very soon) uses routerboard routers with RouterOS on them in place of Cisco stuff because it is cheaper and far more functional (easier to use too). The boxes are small, very cheap and work well. I think we had to reboot ours recently, after almost 350 days of uptime, only because we had to move it.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.