Perimeter Firewall/UTM Suggestions?

I'm looking for a device to put at the edge of our network.

I would want it to do the following:

Act as a basic source/dest/protocol/action firewall to allow packets in
and out to/from our servers.
Have a minimum of 2 DMZ ports.
Allow the internal and DMZ interfaces to work in either NAT or Route
mode (selectable per interface).
Have some sort of URL filtering via an external database i.e.
Surfcontrol CPA/ISS
Have the means to add/exclude entire domains from this filtering.
Some level of IDS.
A/V would be nice but not essential.
Hardware appliance.

The basic scenario is that outbound access for our LAN users would be
handled by a proxy server on the LAN, so for outbound traffic (i.e.
concurrent users) all this device would ever see would be the external
IP of the proxy, as well as any traffic coming from our DMZ's.

The internet connection will be 100mbps, though I anticipate average
usage to be low, and bursty i.e. low average but when someone wants to
download a large file it'll burst to as fast as we can get it.

Because of this, and the fact that it won't have to handle connections
from hundreds of of LAN machines I'm hoping to be able to look at a
fairly low end box.

So far I've been looking (on paper) at:

Juniper SSG 140
Sonicwall 2040 and 3060
Checkpoint VPN-1 Edge
ISS Proventia MX1004

But of course there are many manufacturers out there.

I'd appreciate comments and suggestions.

cheers,
Paul

Re: Perimeter Firewall/UTM Suggestions?

In article ,
paul@spamcop.net says...
> I'm looking for a device to put at the edge of our network.
>
> I would want it to do the following:
>
> Act as a basic source/dest/protocol/action firewall to allow packets in
> and out to/from our servers.
> Have a minimum of 2 DMZ ports.
> Allow the internal and DMZ interfaces to work in either NAT or Route
> mode (selectable per interface).
> Have some sort of URL filtering via an external database i.e.
> Surfcontrol CPA/ISS
> Have the means to add/exclude entire domains from this filtering.
> Some level of IDS.
> A/V would be nice but not essential.
> Hardware appliance.
>
> The basic scenario is that outbound access for our LAN users would be
> handled by a proxy server on the LAN, so for outbound traffic (i.e.
> concurrent users) all this device would ever see would be the external
> IP of the proxy, as well as any traffic coming from our DMZ's.
>
> The internet connection will be 100mbps, though I anticipate average
> usage to be low, and bursty i.e. low average but when someone wants to
> download a large file it'll burst to as fast as we can get it.
>
> Because of this, and the fact that it won't have to handle connections
> from hundreds of of LAN machines I'm hoping to be able to look at a
> fairly low end box.

WatchGuard Firebox X755e - has up WAN, LAN, DMZ and you can add optional
5 other ports (as LAN, DMZ networks).

Does all that you ask above, good support, simple to learn, and if you
want GB network connections you can use the x1250e series.

--

Leythos
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)

Re: Perimeter Firewall/UTM Suggestions?

Paul Hutchings wrote:

> I'm looking for a device to put at the edge of our network.
> [...]
> So far I've been looking (on paper) at:
>
> Juniper SSG 140
> Sonicwall 2040 and 3060
> Checkpoint VPN-1 Edge
> ISS Proventia MX1004
>
> But of course there are many manufacturers out there.
>
> I'd appreciate comments and suggestions.

Personally I like the boxes from Clavister

http://www.clavister.com

and Fortigate

http://www.fortinet.com/

Wolfgang

Re: Perimeter Firewall/UTM Suggestions?

In article ,
Wolfgang Kueter wrote:

> Personally I like the boxes from Clavister
>
> http://www.clavister.com

Thanks, just checking those out now.

So far the ISS Proventia looks good.

Also looking at Network Box and Secure Computing Sidewinder - be
interested in any views on those.

Re: Perimeter Firewall/UTM Suggestions?

I second the Fortigate suggestion - although i do have a vested
interest www.fortiweb.co.uk

Re: Perimeter Firewall/UTM Suggestions?

Hi,

I also second on Fortinet choice while ZyXEL UTM products worth a deep
look.

ZyXEL UTM appliances are really good ones, I have seen them closely and
I do recommend them.

Panda,


--
panda

Some people dream of success, while others wake up and start working on
it!
------------------------------------------------------------ ------------
panda's Profile: http://forums.networkingland.com/member.php?u=2
View this thread: http://forums.networkingland.com/showthread.php?t=21626


--
Posted via a free Usenet account from http://www.teranews.com

Re: Perimeter Firewall/UTM Suggestions?

In article ,
Paul Hutchings wrote:
>I'm looking for a device to put at the edge of our network.
>
>I would want it to do the following:
>
>Act as a basic source/dest/protocol/action firewall to allow packets in
>and out to/from our servers.
>Have a minimum of 2 DMZ ports.
>Allow the internal and DMZ interfaces to work in either NAT or Route
>mode (selectable per interface).
>Have some sort of URL filtering via an external database i.e.
>Surfcontrol CPA/ISS
>Have the means to add/exclude entire domains from this filtering.
>Some level of IDS.
>A/V would be nice but not essential.
>Hardware appliance.
[.]
>Juniper SSG 140
>Sonicwall 2040 and 3060
>Checkpoint VPN-1 Edge
>ISS Proventia MX1004

My vote would go with Juniper, meets all the above criteria.
I have over 28 firewalls in production from SSG5 to ISG1000.

Juniper docs...
http://www.juniper.net/techpubs/software/screenos/screenos5. 4.0/index.html

Might also check out the Juniper forums..
http://www.juniperforum.com/
https://communities.juniper.net/

-alan