Why would YOU use a hardware firewall?

Almost everyone uses a hardware firewall these days with broadband routers.

I think you need to clarify further which products you are trying to refer to.
 
Do I use a hardware firewall? Yes, my BT HH has one built-in.
Is it just a basic hardware firewall? Yes
Do I need anything more complication? No
Do I need to be able to do anything the BT HH cannot? No
 
Yes I use one, it is built into my MikroTik, not technically a "hardware" box in the sense I think you are asking OP as I think you are asking does anyone use a "dedicated" firewall box.

I use mine for basic duties however will implement an additional software firewall on my soon to be MikroTik RB2011 set as a WAP so I can create a guest wireless network so it can only run port 80,443 and DNS (forgot number)
 
Steveocee said:
Yes I use one, it is built into my MikroTik, not technically a "hardware" box in the sense I think you are asking OP as I think you are asking does anyone use a "dedicated" firewall box.

I use mine for basic duties however will implement an additional software firewall on my soon to be MikroTik RB2011 set as a WAP so I can create a guest wireless network so it can only run port 80,443 and DNS (forgot number)
Click to expand...

Even the non-dedicated stuff still does most (all) of what any dedicated solution would do, the main limitation/feature set is in the Network OS itself.

E.g Vyatta, Cisco ASA etc etc

Dedicated units generally offer better performance, availability, scalability and all those other yummy enterprise headliners but they are largely for the enterprise world or large mixed environments.

The feature sets and performance of even cheap consumer grade gear these days is above and beyond the needs of most, even business grade connectivity. For example my £80 EdgeOS Ubuiquti unit will handle near wirespeed 1Gbit throughput with firewall and NAT.
 
Archeum said:
Cisco ASA, Sonicwall, Netscreen etc.
Click to expand...

Because they are generally appliances for that reason, better performance, dedicated to that role only, and not sat on top of another OS, they have OS dedicated to the job.

They are based on an OS, IE Cisco ASA is based on the Cisco IOS, SonicWall SonicOS, netscreen OS

Checkpoint is based on a linux OS.

But its dedicated, and its better than having a server sat there/racked up doing the work, better performance, lower power draw than a full powered server doing the job.

Some people virtualise firewalls and load balancers, although this is dependant on if the vendor has a selected virtual edition release. But in most cases in terms of firewalls, hardware is better.

I dont recall us using hardly any virtual edition firewalls, hardware usually, but we do have a mixture of hardware and virtualised load balancers (F5 for instance) for our customers
 
Last edited:
Checkpoints are also not "based on Linux". The CP software blades are largely written in C and can run on Linux, Solaris, Windows, IPSO etc.

- GP
 
Last edited:
paradigm said:
ASAs are NOT based on IOS, they are an evolution of PixOS.
Click to expand...


A lot of the same structure though only customise to the function of the box

Pixes are horrendous things, they stepped up with the asa's

What I was trying to point out, its better to have a dedicated hardware or virtualised appliance running what you need rather than software on top of base os

I have no doubt checkpoint sits on other platforms but its bare metal stuff sits on Linux based platforms, freeBSD, gentoo for a few examples
 
Last edited:
DJMK4 said:
A lot of the same structure though only customise to the function of the box

Pixes are horrendous things, they stepped up with the asa's
Click to expand...

The underlying engines are different. Completely infact than to IOS. Different in the same sort of way as NX-OS or IOS-XE to IOS. Hell, even the WLC or WAE CLI interfaces look similar, they are totally different beasts too. The wrapper may look similar, but they are totally different.

EDIT: PIX-OS was an evolution of FinesseOS, the ASA of Linux

DJMK4 said:
What I was trying to point out, its better to have a dedicated hardware or virtualised appliance running what you need rather than software on top of base os
Click to expand...

I understand what you're trying to say and thought process but that's not necessarily true. Checkpoint (as an example) actually inserts itself between the NIC and the OS upon installation. The fact that it has an underlying OS that allows functionality isn't compromised by the OS it's on (in theory). For examples like an ASA the situation here is literally no different, it's just all bundled up in to on "image" with the OS. The process is still the same.

EDIT: I think BRS (If he is even still around) could correct me if wrong, but JunOS as an example can be installed directly in to BSD too. Another example of separation between application and OS

DJMK4 said:
I have no doubt checkpoint sits on other platforms but its bare metal stuff sits on Linux based platforms, freeBSD, gentoo for a few examples
Click to expand...

GAiA and SPLAT are independent of Checkpoint software. It sits on them, but CheckPoint software itself is not Linux. IPSO on the Nokias was regularly deployed just as routers back in the day, and that (before SPLAT) was the previous main underlying OS. They are not the same - CheckPoint is no more 'Linux' than VLC is 'Windows' just because it's installed on it

Edit: Have you passed that exam yet from the other thread in the Servers Sub? If so how did it go?

- GP
 
Last edited:
In a similar vein, although maybe not for this thread but what the hell.

What do people prefer with their IPS if they are using them (talking more in a corp env than home), bundled in with your firewall or dedicated appliance, be it hardware or virtualised?
 
Cheers, working with IPS stuff I'm always interested to hear what people are using or looking at, and reasons why :)

Any particular reason why Juniper and HP? Don't have to answer, just curious!
 
Last edited:
You must log in or register to reply here.
Back
Top Bottom