Firewall Software

As for the outlook on checkpoint software, I am afraid I don't know. As for what firewall is the best, well personally speaking, I like Norton's firewall program. I have used Signal 9's program also, but I definatley like Norton's better. If you also have Norton AV program, you can access both by clicking the systray icon, and can update both at the same time using the update program built in to them. Norton Firewall will notify you if any suspicious activity occurs. It will log such things as IP address of the system, along with exactly what they attempted to do. For example, you would get the IP and port they tried to exploit, and the name of the exploit they tried to use, like SubSeven - Trojan Horse...etc.
I hope this is somewhta helpful to you. Happy Holidays!
Charlie

CheckPoints Firewall-1 or Cisco Pix are the best IMO.

WR - The "Best" Firewall is undeterminable. There are free Anti Virus/Firewarlls, ZoneAlarm and Innoculate for the thrifty. For those with some budget there is McAfee, Nortons, and ZonAlarm Pro.
I feel uncomfortable with free software as with free,you get free.
I have Norton Anti Virus 2001, Norton Internet Security 2001, and ZoneAlarm Pro. All seem to work well as I have yet to get a virus. And that is the only proof to any firewall. I like the ZoneAlarm Pro, as with my cable, and you can do it with DUN, I can click it to totally lock/unlock my Internet. Therefore, I can leave my computer on, for hours, and negate the risk of a virus coming in while I have the computer sit. My choice. ZoneAlarm Pro.

500 Users? OK. We did not read your question that way. But for you to fill your info
void try:

http://www.alw.nih.gov/security

http://www.gocsi.com

http://rsasecurity.com

And lastly, your own -

http://www.checkpoint.com

Good Luckwith your 500.

Best firewall "software" is still ambiguous- even with 500 users, it still depends on what you want the darned thing to do.

Will you need to do VPN to other locations, or to individual clients? Or are you looking for proxying, filtering, and logging features?

Checkpoint is fairly robust, high-end stuff, and not a bad choice IF you have someone who can properly configure and support the firewall.

I'd recommend checking into Cisco's PIX products (506 and 515R), along with Checkpoint. Purchase of a Cisco support contract, plus the abundance of Cisco support people and partners makes them a decent option.

Go to http://www.sonicwall.com and look around. I chose them because they do all the right things, setup is brain-dead simple, mamangment is quick and easy and I didn't have to spend a fortune on training to be able to operate it. I have the Pro VX which does VPN, the OS is already hardened and you can even get anti-virus for the desktop. They have a simulator that shows what the admin will see, and it is 100% accurate. You might search some of the magazine sites to get competing test results, but I already did and am supremely happy with my choice.

I use Checkpoint Firewall 1 and love it!!. It took me all of 2 weeks to set it up move all my servers behind it setup the rulebase for each server and all my users. I had never seen nore touched the software prior to this. I have used some of thefree or almost free firewalls in the past and they suck in comparison.
One of the best websites to visit to research fw-1 is www.phoneboy.com. This is were I got most of my "training". Don't get me wrong though it is very challenging to setup correctly if you've never touched it.
Hope that helps... There is a very limited space here to give a more robust answer...
email me if you would like specific details or questions.

Checkpoint is very good and is relatively easy to setup if you are experienced with Firewall setups. There are a couple of things though you should look out for.

Make sure you get the product you really want, expecially if you go with the Nokia box. Some of the configurations they sell are for Firewall only (w/o VPN) or with VPN but only client connections (no site to site). Keep in mind, Checkpoint has lots of great features, but they like to charge up and down for each individual feature (client VPN, site to site VPN, secure/personal firewall for VPN clients, management modules, etc..).
If you go with the software version, make sure you lock down the O/S tightly (especially on NT platforms).
And finally, look into the licensing, there are several ways to setup your licensing. This is very important as it can affect your feature set and future changes you may want to implement, so check with your vendor about the different options.

IMHO I believe Checkpoint is the best overall - answering your first question.
I have used the PIX product and so have associates of mine. Although it makes sense to go with Cisco if you are a Cisco shop, its not worth the poor UI and reporting tools.

I agree with some of the other answers in that you need to be careful selecting the right combinations of HW and SW - and that the Nokia IPSO platform is very cool, fast and fairly easy to manage.

www.phoneboy.com is still the best checkpoint unofficial site - but over time I have noticed that the FAQs are becoming more dated.

Checkpoint's outlook - good, they are delivering good software on time. Market
performance is better than a lot of other
tech stocks.

One more note, theyhave this OPSEC stuff you might like to look at - sounds cool but we have decided to use other stuff instead.

'My firewall-will-protect-all-always-if-only-i-buy-the-best-one'..... see below and link to http://grc.com/lt/leaktest.htm for the whole truth and the only answer WITH the proof to back it, ps..send Steve Gibson those techpoints he deserves them forthe advice he gives freely on his site.
Marketing and Exploitation of Loyalty and Trust
Just like people, no two firewalls are identical. Some are rather spartan where others have plenty of bells and whistles. Some are easy to use and some have been made too easy to use ? rendering them highly insecure. And, sadly, there are others which are pure snake oil sucker bait. This situation is further complicated by the fact that in this weird and immature market, you don't get what you pay for. Oneof the BEST firewalls is completely free, and one of the most WORTHLESS is the most expensive.

I know this is answered, however the successful use of ANY firewall is the correct configuration of the "rules base" (as Checkpoint FW-1 uses). I have configured both FW-1 on a SUN Solaris box. Three years ago the primary thing to keep in mind with FW-1 was that the product was written on the UNIX platform and ported to the NT platform (so most of the GUI stuff was actually better to run in command line on the NT environment). The admin class I took for FW-1 was taught on the NT platform andreenforced the previous statement.

If you are looking for a great firewall "in-a-box" check out Watchguard at www.watchguard.com. I'm currently running the Firebox II in a production environment and as long as the rules are configured properly(and if you have an uneasy feeling with that topic, my suggestion would be to get together with an established consulting company that excels in firewall installations and support!) and the software is kept UP TO DATE the firewall does an exceptional jobs of keeping "prying eyes" out! Live Security is Watchguard's update software which can be configured not only to give you security updates in the industry, but update you firewall software to keep it current. Hope this "late" information is of some assistance. Have a great day and good luck with whatever your decision is (you get to live with it, so make it a good one !!).

My husband and I operate a computer business from our home. We have a 4 computer network that has a firewall software called ZoneAlarm on it (the url, if you are interested is http://www.zonelabs.com/). We've had it on our computer since about May/June of 2000, and along with closing the ports on our computers, has been working perfectly.

Checkpoint is top rated. As far as giving tips on configuring that would take a system audit and a list of your goals and needs. On a larger scale, people make a living doing this for you, so you will not get the detail that you need here. Basic setups would be disallowing all services that you are not running. Pointing outside public services to a demilitarized zone separate from the internal network, etc. Personally I use a Linux box with IP Chains. The cost is right, and a great book explaining the process is ? Building Linux and OpenBSD Firewalls? by Wes Sonnenreich and Tom Yates. Wiley publishing. If you want all of the answers as stated in a past post you will need to hire a security consultant to set up the firewall or do the actualleg work your self. This is not a snipe response but a view in to the complexity of your request. Security is a big complex issue and will require some reading/education on your part just to be able to choose a consultant, netalone do the work yourself.

You cant say one firewall is BEST it depends on ones usage and requirements.

But I feel ISS is one of the best in the field.

Par I of II

Hello,

There are 3 basic types of firewalls: Application Proxy, Stateful Inspection, and Packet Filtering (which is just a router with fancy filtering rules).

In the order of being the most secure, Application Proxy has alwayssat at the top of the heap with Packet Filtering at the bottom. There are system overhead and performance throughput issues that need to be dealt with when selecting one of the 3 types of firewalls. Application Proxy has enormous overhead - so to compensate, you?ll need to throw a higher-end system at it, in terms of hardware platform.

1.) Application Proxy ? A properly configured CyberGuard Firewall has NEVER been hacked and is used in abundance by the US military (and Citibank) as their preferred black box. App Proxies are the most expensive firewall because you need to procure adequate hardware to maintain adequate performance.

2.) Stateful Inspection ? Checkpoint Firewalls do maintain the largest market share to date in terms of a business installation base. Cisco PIX offers stateful connection oriented security as well and is gaining ground in terms of firewalling. The reason for Cisco?s increase in marketshare is that they are delivering Routers that can have the firewalling features enabled simply by inserting a key into the router. These are considered the firewall of choice today. They are very simple to use, install, configure, and maintain while not compromising organizational security.

(continued on Part II)?

Part II of II

(Continued from Par I)...

3.) Packet Filtering ? Ignore these. They aren?t considered ?Real? firewalls to security experts. Might as well put a Linux box in place. Never use an Open-Sourced O/S as a firewall O/S. Too many people have code to access and manipulate the kernels.

Checkpoint probably has the most varied of features of all the firewalls. They offer VPN connectivity (as do Cisco), High Availability options, ISP Redundancy for both Inbound and Outbound activity, and is manipulating towards the IP version 6 (as is Cisco?s IOS).

The support base for Checkpoint is abundant ? you can locate Technical support (CCSA?s or CCSE?s) in every major US city. The lack of support is not an issue with Checkpointnor Cisco PIX. The Application Proxy brands, you WILL have problems in terms of obtaining adequate Technical Support ? most times, you will be relying on the vendor (watch out, if that?s the case).

Checkpoint is higher in cost than Cisco but has many more features that enable it to operate in a web farm or high volume, internet interaction type of business organization. Cisco PIX is plenty adequate for a mid-sized business and is the most cost effective to implement.

I hope this helps.

Kevin.

Why go software based firewall? with the latest Internet Firewall appliance like NetScreen you'll get most of the functionalities of Check Point VPN-1 PLUS bandwidth management and High Availability. Check Point is a good firewall but what i see nowis that Check Point product is becoming very hard to maintain. You'll need a deep knowledge to implement FW-1/VPN-1.

My outlook on Check Point? they're killing their customers. How they license, the complicated products, the upgrades and arrogance.

This question was auto closed due to inactivity