Which Firewall ?

Depends on how much throughput you need to manage. MS ISA is a good product for a low-bandwidth network, say, 25 users or less. The plugins for managing things like access control can be expensive, but almost all firewall products are.

Checkpointis probably the best known product, and definitely one you should look into if you are dealing with a lot of bandwidth. A colleague of mine recommends it if you need high-bandwidth firewall abilities.

On the other end of the spectrum is ZoneLabs'ZoneAlarm Personal Firewall, which does a great job if you are just firewalling a single machine. Also good is the Linksys DSL Firewall Switch, for a very small network looking to share a DSL connection.

Regards,

C. S. Penn
Boston Automationwww.bosauto.com

I've been using Checkpoint FW-1 extensively for a while now. My opinion of it is that technically it is a great product; it had better be for the cost involved. it is easy to set up for a basic installation. However, if you need advanced configurations you will find that Checkpoint's documentation and technical support are pretty crummy. You will spend a lot of time reading the various FW-1 related mailing lists and newsgroups in order to find out how to set certain things up. The other thingabout Checkpoint is that you need a license to sneeze when you are in the same room as their products. This can get frustrating, but if you have a good vendor they'll help smooth out these problems.

I've used Raptor a bit, and it seemed like aneasy to use and stable system, if perhaps a bit slow. I didn't use it enough to really form a strong opinion.

I've also used Linux ipchains and have been reading about the new iptables feature which includes stateful inspection. It looks great, and its free. However, it probably isn't as easy to use or support as you would like.

As for ISA, all I can say is that as a network security administrator, I would NEVER consider putting the protection of my network into the care of a Microsoft product. Let's face it, MS makes good application software and decent OS offerings, but security has never been a concern of theirs. When they need to balance security and ease of use, they take ease of use every time. Why would you trust your network to the people who enabled the Melissa and ILOVEYOU worms?

To close this rant, if money isn't an issue and you have some patience, Checkpoint is a great product. I don't think that Gauntlet or Raptor are much cheaper and probably aren't as good technically. Don't even think about ISA!

check out Sidewinder from www.securecomputing.com
we have been using that for a couple of years now and are very pleased.

anytime one evaluates a product, you will find that many solutions will work and that all vendors claim they are the best.

Why not get the real thing and purchase a Cisco PIX firewall? You didn't mention if this were for a company or your personal use, but if your looking for solution for an organization, you would be putting them at risk if you used anything less then a PIX or other comparable "Hardware" solution. As far as I'm concerned, there's no such thing as a software based Firewall. Checkpoint is good, but much to complex then it needs to be, and isn't anywhere near as flexible as a PIX firewall. My 2 cents.

In response to Cisco_Guy's answer above, I think the distinction between "hardware" and "software" firewalls is largely artificial. I do use the Cisco PIX and think it does a great job in our application but it's not the only device in its class.
But it is no more a "hardware" firewall than any other device - it just happens to run a proprietary OS on a non-Intel CPU.

The more useful distinction is between firewalls that run on a standard OS like NT versus those that run on a special-purpose or "hardened" OS. The former would include products like MS/ISA or IPChains on Linux and the latter would include products like Checkpoint or Cisco's PIX. If you have the money to spend, I do think there is an advantage to a firewall appliance as opposed to application software running on a standard server OS.

Before you even start shopping, you need to know how many simultaneous connections you need to support and how much throughput would be useful. From that, you can separate out theproducts by capabilities and then look at the user interface. I like the Cisco IOS, but then I work in a Cisco shop and spend a lot of time looking at it; to others, it is not at all intuitive and the learning curve can be steep.

paul

Thank your for all the feedback

This question was closed by the author