Security

Ask something
Discussion Locked

Cisco Pix VS Others

0 helpful
1 reply

by mlepage

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

The company that I work for has just been divided in two. One division will sold, and the other will be moving to a new location. I will moving with it and I am involved in building the new network with other admins from the corporate headquarters.

I have just received the list of devices that they want to buy and for the firewall they want a Cisco Pix 515E. I want to know the pros and cons of the Pix compared to other firewall (specifically Application layer firewall) like the Secure Computing Sidewinder.

In the 515E data sheet Cisco writes that it has "application-aware security services that examine packet streams at Layers 4-7"

I don't think it is an application layer firewall but a sateful inspection firewall. I think Cisco wants us to believe it's an application layer firewall.

I know the Pix is much cheaper, but I also think that the Pix is much less secure since it is a network layer firewall.

And if I should get an application layer firewall, how should try to convince them. I think it will be difficult because they already use a Pix at their location

What do you think.

Thank you

1 reply

by dukebytes

I think that you will have a problem trying to get them to go to another firewall. People who work with a PIX - loves the PIX :)

And the PIX is a great box - but it really isn't an application (proxy) firewall like some of them are. They have the fixup protocol commands for the different ports - but it only blocks certain things - extneded commands in SMTP etc... that would be the extent of the layer 4-7 stuff. But, I don't think that it makes it any less secure. The PIX does its job and does it very well. And working with VPN's with the PIX is very solid also - that might be one reason why they want PIXs everywhere.

In reality you would want an IDS to look for the application stuff anyway. I know that its not really another layer like an app proxy would be - but I think that an IDS does a better job with the hackers than a proxy does.

I think that you would like the PIX if you worked with it for a while. I would try and convince them to implement an IDS in addition to the PIX. That would be a better solution and the word Cisco ALWAYS looks good on a resume :)

Good luck,
Duke

This discussion is closed to new replies.