Networks

Ask something
Discussion Locked

Need a Firewall

0 helpful
10 replies

by marvin.gilmore

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
What is a good network appliance solution for our configuration? We use an ISP on a part of a T1. Would a firewall installed before the router and after the DNS server be the way to go? We are a small company with about 40 computer users.

10 replies

by sgt_shultz

i would ask my isp this one.
or hang out at cisco or checkpoint or cert or microsoft security websites.
if you have couple grand, get CheckPoint firewall and if you wanna understand this stuff, make 'em explain it all to you before you agree to buy anything. otherwise buy installed and maintenance agreements yada yada and training and training
device would go 'first', representing you on the internet and inspecting everything that goes thru. let the salesperson be your guide. do not cheap out. be strong. perhaps you are referring to dmz. check out explanation of that at security.microsoft.com
if no bucks hide behide router and get norton internet security or zonealarm and anti-virus installed everywhere...(wait, that is bucks. oops)
maybe get off shelf firewall product from linksys retch no don't, get cheap cisco thing instead and harden all os's and follow best security practices as outlined at www.microsoft..com and www.cert.org. have good anti-virus. have good backups. see those sites for what to include.
what will break with new firewall until you get port forwarding or whatever figured out will be stuff like:
ftp
streaming video
windows updates
like that...
(remember to try turning firewall off is stuff doesn't work)
see www.microsoft.com and www.cert.org for more information in best security practices and hardening os's.
best if you understand things well enuf to get the big holes and doors closed without blindly relying on off the shelf thing especially if you can't budget in a good one.
ask boss for training get cisco cert

by cg it

Gateway/Access/Firewall appliances can be pretty expensive. Software solutions can to be for that matter.

I'll say this, a firewall/gateway/access solution be the first line of defense from inbound threats. It should be the last checkpoint for outbound traffic.

I like Microsoft's ISA server both the 2000 and 2004. I like Symantecs Gateway appliances.

by cg it

Sgt Shultz has some really good advice there [though why he doesn't like Linksys which is really Cisco I dunno I know Nuthing].

Cisco prolly has the priciest equipment and a large learning curve to boot. Symantec has some appliances that range from $500 USD for a SOHO appliance [which does about what a consumer level router will do] on up to over $20,000 USD for an full on security appliance that can cover 25,000 users+, just about any threat [and make ya coffee eggs and a bagel in the morning].

by brian

Yes. I think Sonic Wall makes great products in that size range. Easy to configure, good features , and reliable. You may also look at WatchGuard products.

by jcreaghan

I would opt for a cisco solution. The PIX 515E is a great box, but you may be able to away with the cheaper PIX 501. With the new PDM (Pix Device Manager software) the learning curve for cisco products is greatly reduced with this GUI. As for placement, I would talk to your ISP, but typically it should be the gateway between your equipment and theirs. I would also invest in anti-virus server software, and if you run a windows network, consider running the SUS (software update services) on one of your servers and pointing all of your clients to it. With the Symantec approach of combining all functions in one device, it does provide faster throughput, as the packet is only torn down once and inspected multiple time, but it does create a single point of failure...unless you can afford a few of them.

This discussion is closed to new replies.