@scottalanmiller said in Thoughts on how I could improve my network security?:
@dave247 said in Thoughts on how I could improve my network security?:
@scottalanmiller said in Thoughts on how I could improve my network security?:
If you DO decide to go UTM, avoid crap like ASA, SonicWall, Sophos etc. I heavily recommend Palo Alto or nothing. If you can't do it right, don't do it halfway with gear I'd not even be willing to deploy at home.
What's wrong with Sonicwall? We have that where I work..
High cost, low quality, bad vendor. Reverse the question... what's good about them?
- They are a UTM maker, something I think is generally fundamentally wrong as an approach.
- They claim to be for security but have hidden configuration that isn't documented, a big no no in security and IT.
- They intentationally set defaults to break things for no reason like SIP-ALG (SW is the #1 cause for VoIP issues.)
- They are expensive, many times the cost of equipment I consider to be much better.
- They essentially exist only, much like Meraki, to make sales people money. They are like Mary Kay or AmWay - no one buys them intentionally, they buy them from sales people to make them go away. They aren't good enough for people to go looking for them. But when the girl scouts come to your door, you feel bad and buy something small to make them leave, SonicWall is the cheapest thing you can buy from the vendors that sell them, it's a lot like unwanted Girl Scout cookies - you know they are expensive and unhealthy, but you feel you have to buy something.
- So that's really just your opinion then..
- Can you elaborate on the "hidden configuration"?
- I have our VoIP running through a zone on our NSA 3600 with no issues
- Seems like everything is "expensive" and what you consider better is a matter of opinion
- I understand getting ripped off by salespeople who push products that the buyer may not truly need, but we've made use of our SonicWall NSA 3600 quite a bit. Its been rock solid. And it's not like it's just a dinky system that's been cobbled together by the manufacturer just to sell as an extra piece of expensive crap. There's a lot of depth to it and it has a lot of good tools and features.
I have our three ISP connections coming into the SonicWall with load-balancing. I also have wifi zones for corp and guest on their own VLAN. I have LAN and VPN zones (an others) which are carefully set up and segregated through firewall rules. There's a page to manage NAT policies. We make use of SSLVPN, Gateway A/V and anti-spyware, content filtering, IDS & IPS, and the GMS Analyzer, etc.
I didn't choose this product as it was on site when I got my job here, but as I said, it's been completely solid.