Security

Ask something
Discussion Locked

Finalizing a Firewall choice for SMO

0 helpful
18 replies

by stevenmtoth 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am trying to recommend a firewall solution for a small to medium business (SMO), where I recently replaced the IT consultant. The prganization currently uses Proxy Server 2.0 with Zone Alarm as its Internet firewall. It has a WAN with two additional locations, about 100 users, and four servers. Its Web presence is hosted elsewhere by an ISP. I feel that Proxy-Zone Alarm does not make for a sufficient enterprise firewall and seek an appropriate solution. I have considered:
CheckPoint (too expensive for this)
Cicso PIX 506
GNATBox (good, but not as robust or established as Cisco)
Microsoft ISA
Border Manager (we are mostly W2K AD)
I feel comfortable about the PIX and have implemented it before. It provides a good firewall, allows forVPN, and is a price-effective stand-alone. Some have recommended ISA, including a TechRepublic columnist, as a similarly priced alternative. However, while the products themselves are similarly priced, ISA requires the purchase of server hardware and a W2K Server license. I believe that I can implement user-level Internet access authentication with the PIX using IAS on another W2K server as RADIUS, although I am uncertain about the nature of this.
My questions are:
1. Am I right that the current Proxy-ZA "firewall" solution is a poor one? (The server is also a DC, DNS, DHCP, the lone Exchange server, file server, print server, and Master server for Inoculate virus updates.)
2. Is there any way that ISA provides more options for meeting my needs than the PIX 506 does, and does it justify the additional expense?
3. Any idea what I can do through RADIUS-W2K IAS? Can I allow Internet access based on Windows group membership?
4. Am I missing anything?

Thank you in advance to anyonewho has a chance to respond to this lengthy inquiry. I am jsut looking for some verification (or rejection) of my ideas.

18 replies

by Ryan Boudreaux140

You are on the right track. For the size of your network I would have a physical hardware firewall installed such as the Cicso PIX, it is a good choice for your situation.

We currently use the Cisco PIX 515 and have no issues with flow of Internet traffic. However, we are currently researching the installation of a web sniffer application to help monitor and control the Internet traffic.

This URL is from the Cisco site and is for configuration information: (no spaces between characters):
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v51/config/index.htm

Enjoy,

Elvis Tie

by stevenmtoth

I only rjected this answer because apparently I cannot respond to it without rejecting it. Thanks for the advice. I like using the PIX. Its administration is straightforward and effective and frankly it is a pretty good buy.

by stevenmtoth

Ionly rejected the response so that I could respond.
Thanks. It seems like a decent product that I had not heard of before. I am surprised at the price, though.

by nels

I recommend SmoothWall. The GPL version is a taster but extremely functional. It has Web Proxy, IDS, and VPN.
Paying for it allows you to add modules that increase the already great functionality. (i.e. Web Filtering, adding extra DMZ's, etc) This is a great product. Check it out! www.smoothwall.co.uk

by stevenmtoth

Wow, that IS a cheap product. But I guess I am looking for a more established or widely accepted product or maker. It was a little desheartening to see their Yestmonials page with only one item. And a quick search of some IT magazine sites turned upno information. Yeah, I think we seek a more established corporate product.

by guruleenyc

If you will allow me to re-visit the Cisco PIX 515R Firewall.

Features & Reasons to Choose this appliance:

1. Not Operating System dependant.
2. Cut Through Proxy technlogoy for un-parralled performance and integrity.
3. Failover option withlittle extra configuration.
4. IPSec VPN client to site or site to site with Cisco Secure software management.
5. Minimal Administration once installed and setup.
6. Throughput capabilities for all organizations.
7. Command Line Interface configuration w/o the need for Unix knowledge.
8. Optional GUI interface (PDM) over SSL.
9. Ingress and Egress filtering at it's strongest.

For more information:
http://www.cisco.com/univercd/cc/td/doc/pcat/fw.htm

by guruleenyc

In regards to RADIUS and Windows Group permissions, you can use Cisco Secure NT to Authenticate, Authorize, and Account all your incoming and outgoing traffic. Cisco Secure NT will allow you to also manage all user permissions and access via a web-based GUI interface. A Windows NT database can be used as a user database or you can build a custom proprietary Cisco Secure database.

by Former member

You can try some other vendors as well, even though I am partial to Cisco. Netscreen and Symantec make some good hardware firewalls as well..Mayb e even at a better price.

One thing to take into consideration is routing and whether you'll be getting into bridging through a firewall, such as with a NetScreen or routing with a PIX. What routing protocols will be used and will you need and have access to a small subnet when you add something to replace the Proxy (if an additional subnet is necessary). If you use some internal routing, will the firewall be able to pass the routes, such as by using OSPF.

by some guy in seattle

Some of the things you might want to consider are what kind of functionality you want to get out of it beyond just the firewall capabilities. For instance, are you interested in running scripts to process log file data, or adding OS-level processesfor location-specific activities? If so, then you will have to consider the software firewalls such as Checkpoint and Axent's Raptor (yeah, I know Checkpoint's expensive - they do have the best logging of all, by far). Software firewalls are greatfor troubleshooting on the command-line too.

What you trade in functionality, you make up in price. A Netscreen 25 or 50 (if you want High Availability) or a SonicWall 200 or 300 might be good for your environment. One benefit of Sonicwall is the antivirus and content filtering on board the firewall (for extra $$$ - but cheaper than an extra box and software). PIXes are great too - they currently have the fastest throughtput as measured by a number of benchmarks. Look at the 515 model for your environment.

To answer your questions, yes. It's poor. You don't really want one box to be in control of everything, especially since when it breaks, the whole network breaks. Not to mention integration problems with multiple 3rd party vendors running on one box. If you make your DC your firewall and stick it on the perimeter, that's asking for trouble (Attack me, please!).

This discussion is closed to new replies.