What enterprise GigE Copper firewall?

JBod · 15 Sep 2009 at 15:17

Without spending say £4k (call it a max of £2k?) does anyone have any recommendations for a firewall?

Two requirements are gig line rate and VPN.

Thanks great people of OCUK!

RSR · 15 Sep 2009 at 15:33

Id personally say a Cisco ASA 5510/5520 or a Fortinet FortiGate box.

Ringiho · 15 Sep 2009 at 15:34

andyd said:
Cisco ASA5510.

Awesome kit

iaind · 15 Sep 2009 at 15:45

What sort of company has a GigE WAN but can only afford 2k for a firewall? :confused:

JBod · 15 Sep 2009 at 15:56

andyd said:
Id personally say a Cisco ASA 5510/5520 or a Fortinet FortiGate box.

You got gig line rate through one?

RSR · 15 Sep 2009 at 16:07

JBod said:
You got gig line rate through one?

I am some what confused here. What do you mean by "gig line rate" ?

From memory the Cisco ASA 5510 comes with 2 Gigabit Ethernet and the Cisco ASA 5520 comes with 4 Gigabit Ethernet ports.

Or do you mean VPN Throughput rate?

howler · 15 Sep 2009 at 16:26

Ringiho said:
Awesome kit

Funny, from what I have heard the ASA is not the best product out there

Personally I quite like Juniper kit

JBod · 15 Sep 2009 at 16:29

iaind said:
What sort of company has a GigE WAN but can only afford 2k for a firewall?

GigE port in a DC isn't that much

Just trying to see what I can get without spending too much wonga.

RSR · 15 Sep 2009 at 16:33

howler said:
Funny, from what I have heard the ASA is not the best product out there

Personally I quite like Juniper kit

Its all swings and round abouts TBH.

JBod · 15 Sep 2009 at 16:47

andyd said:
I am some what confused here. What do you mean by "gig line rate" ?

From memory the Cisco ASA 5510 comes with 2 Gigabit Ethernet and the Cisco ASA 5520 comes with 4 Gigabit Ethernet ports.

Or do you mean VPN Throughput rate?

Trust to Untrust (or lan to wan..) can you push 1Gbps? The reason I ask is that while they have gig ports you dont necessarily get gig throughput. Many actually quote things like 450Mbps IMIX.

RSR · 15 Sep 2009 at 16:52

JBod said:
Trust to Untrust (or lan to wan..) can you push 1Gbps? The reason I ask is that while they have gig ports you dont necessarily get gig throughput. Many actually quote things like 450Mbps IMIX.

If you want Firewall throughput at true Gb speed on a 2K budget i think your going to struggle.

Cisco ASA 5550, will do it. However, id hate to think of the cost.

Andy

RSR · 15 Sep 2009 at 16:55

I would also question do you need, all that throughput?

#Chri5# · 15 Sep 2009 at 17:14

SonicWall NSA 3500 - 6 x GigE ports, 1.5Gbps SPI, 50 x IPSEC VPN & 2 x SSL VPN licenses - RRP £2172 (base firewall) + VAT

SonicWall NSA 2400 - 6 x GigE ports, 775Mbps SPI, 10 x IPSEC VPN & 2 x SSL VPN - RRP £1596 (base firewall) + VAT

atomiser · 15 Sep 2009 at 18:53

if it were me i would go the juniper route, purely because im experienced with the kit, and i like it. would probably need to up the budget a tad though. what are you actually doing with this device that requires such performance?!

dhill · 15 Sep 2009 at 21:53

Another vote for the SonicWall NSA 2400, we are running two in HA mode

atomiser · 15 Sep 2009 at 22:37

im curious about the sonicwall range... how does the licensing work on a ha pair, do you purchase two fully licensed devices, or do you buy a fully licensed box for your active node and a partially licensed box for your passive node?

aln · 15 Sep 2009 at 23:37

Our networking guys will always recommend Juniper.

If you wanna be cheap run a *nix box with iptables, and run your own vpn server.

bigredshark · 16 Sep 2009 at 08:17

Yeah, always juniper, though the minimum for line rate GIG is going to be an SSG550 I think...not for 2k though...

You're best bet is likely a SSG320 which I think you'll be able to find in your budget.

In terms of other brands the Cisco ASA is trading on the Cisco name alone, it's not a fantastic bit of kit (not terrible either though). Sonicwall and Watchguard I wouldn't touch with a bargepole. Fortigate is interesting, well priced, very high performance but personally I despise the interface and I don't think it has the enterprise pedigree (with is also my main complaint about the Sonicwall and Watchguard).

You do not need that kind of performance though, my current employer host in the region of 15,000 web facing servers and on the average day outgoing bandwidth is ~6GB/s. I can name only a couple of dozen customers who regularly use more than 100Mbps (and we're talking massively well known websites with load balanced server farms for those)

#Chri5# · 16 Sep 2009 at 09:14

atomiser said:
im curious about the sonicwall range... how does the licensing work on a ha pair, do you purchase two fully licensed devices, or do you buy a fully licensed box for your active node and a partially licensed box for your passive node?

On an active/passive HA basis, you buy the primary unit + any security services at "normal" price. The second hardware appliance (+ SonicWall support if you want it) can then be bought with extra discount, at least 50% off list. If the primary unit fails, any security services (eg Gateway AV / IPS / AS) transfer over onto the 2nd unit.

SonicOS 5.5 (in beta) adds the start of active-active HA. Initially it's for UTM, so the primary appliance can offload the resource intenstive UTM scanning work to the secondary appliance. I'm not quite sure how that changes buying an HA pair yet.

J.B · 16 Sep 2009 at 09:33

#Chri5# said:
SonicWall NSA 2400 - 6 x GigE ports, 775Mbps SPI, 10 x IPSEC VPN & 2 x SSL VPN - RRP £1596 (base firewall) + VAT

We have one of these and I was very impressed with it.