Home Network Firewall Options
-
@NETS The summary of past discussions:
UTM is a waste of money
Use separate boxes for specific uses - Firewall, proxy
Use endpoint protections for AV
Don't log/block websites/categories unless it is to prevent malware (even then, use a service like Open DNS)I don't necessarily endorse all comments
Edit- I almost forgot - The performance is almost always better when you separate the roles.
-
@wrx7m said:
@NETS The summary of past discussions:
UTM is a waste of money
Use separate boxes for specific uses - Firewall, proxy
Use endpoint protections for AV
Don't log/block websites/categories unless it is to prevent malware (even then, use a service like Open DNS)I don't necessarily endorse all comments
A good "do it all in one box" solution saves an imperial buttload of time though, good grief.
+1 to Fortigate; you may be expensive but you work darn well for us.
-
@MattSpeller I do like my Sophos too. Although, I am starting to see the benefit to having fewer things running on the same box. Troubleshooting might actually be easier. "Is it a proxy issue or firewall rule? Could be either."
-
@wrx7m said:
@MattSpeller I do like my Sophos too. Although, I am starting to see the benefit to having fewer things running on the same box. Troubleshooting might actually be easier. "Is it a proxy issue or firewall rule? Could be either."
Just remember that sometimes the grass isn't really greener haha. I would love to do all these boxes myself and learn a bunch of new junk but that'd be a huge chunk of time I don't have.
-
@NETS the point is not to always separate or always to use an all in one. The point of every IT solution should be to find the correct solution to the problem.
Very rarely is an UTM actually ever required when you break all the pieces down and look at what they do and what the business needs.
I have never needed a full UTM at a single client.
The good place to find the need is in libraries and education. They have laws or ordinances mandating things and vendors have provided solid solutions for them.
-
Are you guys using actual server hardware to make the devices to fill those roles?
-
@wirestyle22 said:
Are you guys using actual server hardware to make the devices to fill those roles?
Why are you worrying about those holes in the first place?
-
@Dashrender said:
@wirestyle22 said:
Are you guys using actual server hardware to make the devices to fill those roles?
Why are you worrying about those holes in the first place?
I'm not. I'm just curious if actual server hardware would be required for my own knowledge
-
@wirestyle22 said:
@Dashrender said:
@wirestyle22 said:
Are you guys using actual server hardware to make the devices to fill those roles?
Why are you worrying about those holes in the first place?
I'm not. I'm just curious if actual server hardware would be required for my own knowledge
They're all virtual right? So what does it matter, hardware agnostic. That said, a solid server box is definitely preferred.
-
@travisdh1 said:
@wirestyle22 said:
@Dashrender said:
@wirestyle22 said:
Are you guys using actual server hardware to make the devices to fill those roles?
Why are you worrying about those holes in the first place?
I'm not. I'm just curious if actual server hardware would be required for my own knowledge
They're all virtual right? So what does it matter, hardware agnostic. That said, a solid server box is definitely preferred.
What if the company has a ton of remote sites like mine? Wouldn't that be a pretty big cost?
-
@wirestyle22 said:
@travisdh1 said:
@wirestyle22 said:
@Dashrender said:
@wirestyle22 said:
Are you guys using actual server hardware to make the devices to fill those roles?
Why are you worrying about those holes in the first place?
I'm not. I'm just curious if actual server hardware would be required for my own knowledge
They're all virtual right? So what does it matter, hardware agnostic. That said, a solid server box is definitely preferred.
What if the company has a ton of remote sites like mine? Wouldn't that be a pretty big cost?
Only if you have a reason to need one at every site. If you get to a LANless design then you don't really need the security appliances at every location, and if you're still running traditional LAN and VPN then you only need the one at the head office.
-
@travisdh1 said:
Only if you have a reason to need one at every site.
In other words - only if you need those UTM services at every site.
If you get to a LANless design then you don't really need the security appliances at every location,
I still really like the idea of a hardware firewall (though I suppose a firewall VM would be fine) between you and the internet whenever possible.
and if you're still running traditional LAN and VPN then you only need the one at the head office.
This assumes you have the bandwidth to bring all internet traffic back to the home office for filtering before going out to the internet. I don't know anyone who does that anymore.
-
I suppose if you really need UTM things at remote locations, then the UTM appliance is the most cost effective way to do this. But the real question is... do you REALLY need it?
-
@Dashrender said:
I suppose if you really need UTM things at remote locations, then the UTM appliance is the most cost effective way to do this. But the real question is... do you REALLY need it?
Not at every site. What I'm going to do is install a Squid proxy at one specific location because we have two client computer labs there. It's extremely vulnerable with the developmentally disabled clicking on anything and everything--not that I would expect anything but that in this situation. So I basically block everything except YouTube and a few educational websites that they use daily. I do this only for their computers and have standard content policies in place for the others.
I'm getting rid of my Sonicwalls in favor of Ubiquiti Security Gateways but I lose content filtering basically.
-
@wirestyle22 said:
@Dashrender said:
I suppose if you really need UTM things at remote locations, then the UTM appliance is the most cost effective way to do this. But the real question is... do you REALLY need it?
Not at every site. What I'm going to do is install a Squid proxy at one specific location because we have two client computer labs there. It's extremely vulnerable with the developmentally disabled clicking on anything and everything--not that I would expect anything but that in this situation. So I basically block everything except YouTube and a few educational websites that they use daily. I do this only for their computers and have standard content policies in place for the others.
I'm getting rid of my Sonicwalls in favor of Ubiquiti Security Gateways but I lose content filtering basically.
yep - I was in the same boat 4 months ago. Though - just wondering, why the USGs vs the ERLs?
-
@NETS said:
@scottalanmiller said:
@NETS said:
So without a UTM device how are you monitoring the network and locking down the traffic?
- What is the actual need here? A firewall already monitors and locks down the traffic. Those are not UTM functions.
- With a UTM, how are you doing it?
I look at UTM's as a single device that can easily secure and monitor and a variety of network traffic with minimal effort. Running a regular ERX works but you lose the malware, mail filtering and IPS features of a UTM. Sure there are other methods of gaining those features back but not on a single box. For SMB that single box is a big sell.
If you use a Edge router how are you adding back in the other security features that a UTM or Nextgen firewall offers?
Why are you filtering mail at the firewall anyway?. Even with onsite mail cloud based email filter is way more powerful at detecting things.
-
@Jason said:
@NETS said:
@scottalanmiller said:
@NETS said:
So without a UTM device how are you monitoring the network and locking down the traffic?
- What is the actual need here? A firewall already monitors and locks down the traffic. Those are not UTM functions.
- With a UTM, how are you doing it?
I look at UTM's as a single device that can easily secure and monitor and a variety of network traffic with minimal effort. Running a regular ERX works but you lose the malware, mail filtering and IPS features of a UTM. Sure there are other methods of gaining those features back but not on a single box. For SMB that single box is a big sell.
If you use a Edge router how are you adding back in the other security features that a UTM or Nextgen firewall offers?
Why are you filtering mail at the firewall anyway?. Even with onsite mail cloud based email filter is way more powerful at detecting things.
I inherited all of this stuff. It predates me. I'm making the changes now in the hopes that I am ML compliant one day ^_^
-
@Jason said:
@NETS said:
@scottalanmiller said:
@NETS said:
So without a UTM device how are you monitoring the network and locking down the traffic?
- What is the actual need here? A firewall already monitors and locks down the traffic. Those are not UTM functions.
- With a UTM, how are you doing it?
I look at UTM's as a single device that can easily secure and monitor and a variety of network traffic with minimal effort. Running a regular ERX works but you lose the malware, mail filtering and IPS features of a UTM. Sure there are other methods of gaining those features back but not on a single box. For SMB that single box is a big sell.
If you use a Edge router how are you adding back in the other security features that a UTM or Nextgen firewall offers?
Why are you filtering mail at the firewall anyway?. Even with onsite mail cloud based email filter is way more powerful at detecting things.
98% of the time we do use some form of cloud based email filtering but if they have the license we also kick on mail filtering in the UTM. While it might be over kill it's caught a few things that we didn't want coming in.
I agree that UTM's are costly and single devices could potentially a better job but from a manageability perspective UTM's make it easier.
-
@Dashrender said:
@wirestyle22 said:
@Dashrender said:
I suppose if you really need UTM things at remote locations, then the UTM appliance is the most cost effective way to do this. But the real question is... do you REALLY need it?
Not at every site. What I'm going to do is install a Squid proxy at one specific location because we have two client computer labs there. It's extremely vulnerable with the developmentally disabled clicking on anything and everything--not that I would expect anything but that in this situation. So I basically block everything except YouTube and a few educational websites that they use daily. I do this only for their computers and have standard content policies in place for the others.
I'm getting rid of my Sonicwalls in favor of Ubiquiti Security Gateways but I lose content filtering basically.
yep - I was in the same boat 4 months ago. Though - just wondering, why the USGs vs the ERLs?
I'm open to recommendations of course. Do you think the ERL is a better choice?
-
@wirestyle22 said:
@Dashrender said:
@wirestyle22 said:
@Dashrender said:
I suppose if you really need UTM things at remote locations, then the UTM appliance is the most cost effective way to do this. But the real question is... do you REALLY need it?
Not at every site. What I'm going to do is install a Squid proxy at one specific location because we have two client computer labs there. It's extremely vulnerable with the developmentally disabled clicking on anything and everything--not that I would expect anything but that in this situation. So I basically block everything except YouTube and a few educational websites that they use daily. I do this only for their computers and have standard content policies in place for the others.
I'm getting rid of my Sonicwalls in favor of Ubiquiti Security Gateways but I lose content filtering basically.
yep - I was in the same boat 4 months ago. Though - just wondering, why the USGs vs the ERLs?
I'm open to recommendations of course. Do you think the ERL is a better choice?
I haven't actually played with a USG yet. They are 20-40 more than an ERL... as far as I can tell... the main difference is the ability to controll the USG with the Ubiquiti Controller software, you can't do that with the EdgeRouter stuff
