Which Hardware Firewall should I get?

A big hello from a security newbie in the UK!

I have a question about which hardware firewall to buy - I would appreciate any expert opinions that might help me out.

The scenario:

I have a customer in the travel industry who is looking to implement on-line booking to their in-house tour reservations system.

They have installed a 2MB SDSL line (with Lucent Cellpipe 20H router) to carry traffic in and out.

Their web site will pass User requests (hotel availability, prices, etc) through to a dedicated Linux system on the internal network, which will then query the Reservations system and pass the results back to the user.

Now this is a full-time Internet connection that I want to secure from all those people who might try to break in to the on-site systems, so I want to screw access down as tight as possible - only letting recognised traffic through.

I've been advised that Watchguard's Firebox products are good value (did I mention we're on a very tight budget?)

I would appreciate any help from anyone who can advise.

Thanks, and have a nice day!

RoboScorpion

Considering that they are already running linux and must therefore have the administration capability to support it, I would recommend a linux based firewall. On a 2MB connection you shouldn't need more then 200~300MHZ boxes to handle peak loads. Signifigantly cheaper than prebuilt hardware firewalls, and one hell of a lot more configurable. Such a firewall is also far more scalable, should the client wish to add capabilities such as IDS or bandwidth monitoring (or whatever) later on.

The down side, of course, is that such a firewall would be a lot more prone to failures, and would take more time to set up and configure. As for the configuring, a firewall such as Smoothwall or IpCop will basically set the whole thing up for you. A few hacks are needed to get it to work with DSL, but it shouldn't be too much trouble with the Roaring Penguin PPPoE client (assuming you use PPPoE over there).

Unfortunately, I have no experience with the type of hardware firewalls you speak of, so I cannot offer recommendations. However, I would imagine they are no more or less secure than the alternative I have presented. The savings in hardware expenses may be offset by the increased cost of setup however.

Quote:

---

Originally posted here by Striek
Considering that they are already running linux and must therefore have the administration capability to support it, I would recommend a linux based firewall. On a 2MB connection you shouldn't need more then 200~300MHZ boxes to handle peak loads. Signifigantly cheaper than prebuilt hardware firewalls, and one hell of a lot more configurable. Such a firewall is also far more scalable, should the client wish to add capabilities such as IDS or bandwidth monitoring (or whatever) later on.

The down side, of course, is that such a firewall would be a lot more prone to failures, and would take more time to set up and configure. As for the configuring, a firewall such as Smoothwall or IpCop will basically set the whole thing up for you. A few hacks are needed to get it to work with DSL, but it shouldn't be too much trouble with the Roaring Penguin PPPoE client (assuming you use PPPoE over there).

Unfortunately, I have no experience with the type of hardware firewalls you speak of, so I cannot offer recommendations. However, I would imagine they are no more or less secure than the alternative I have presented. The savings in hardware expenses may be offset by the increased cost of setup however.

---

How would that be more prone to failures? I've had prebuilt stuff go bad on me WAY more than the stuff I built?

And as far as operating systems go I'd chose FreeBSD to go on that machine. It's FREE!! It's much easier to update/patch, much easier to configure, better IP stack, better security (check out 5.3) and you get pf which is a killer firewall which does everything and more than you'll need, and very easy to configure.

Sorry, gotta go. I'm setting up a P4 bridge right now to just what you're talking about to further increase security around here (and implement bandwidth management).

Watchguard Firewall X500. It has the bandwidth covered, the user base, and hell it's sexy too. Many online retailers carry the boxed version and you will have to add on the 3 slot expansion to get a DMZ to segment the puplic server from private servers. It also supports VPNs and it controlled via a sleek interface. In many cases you can just drop it in with little effort. Also it does a good job logging information to the PC that is used to control it and comes with nice monitoring feature without having to build anything. Good value when compared to alternative option. Plus when you out grow a feature, you just buy an upgrade and apply it through an update system of software packages. You can also add IDS, SPAM filter, Proxies, Antivirus, Pen Testing etc...

Average US retail price: $1500.00 give or take plus DO NOT forget the Network upgrade to add 3 ports, avg. $300.00US. Without that upgrade you only get 1 internal port, no DMZ. There are cheaper models but I would recomend that. Wait the X50 may work depending on your desires. Those cheaper models are not as flexible as far as options and upgrades though.

X500
X50

http://www.cisco.com/en/US/products/...030/index.html

Cisco offers PIX firewalls, i did a course on them last week but have not really had much time to play around .. we use them at work now tho so they cant be too bad

Sorry I just realized I didn't answer your original question. How about a pix? Depending on what you're looking for the 501 can do 2MB no problem and you can get them cheap on ebay under $500. Easy to admin and fairly bulletproof.

peace.

I use the Pix as well. In fact I eat Pix for breakfast. However the same scenario say 2 firewalls each with DMZ and failover is significantly different in price. Watchguard 4k. Cisco 11K. (these are new prices) The cheap Pix 506 does not isolate a DMZ.

Quote:

---

Originally posted here by RoadClosed
I use the Pix as well. In fact I eat Pix for breakfast. However the same scenario say 2 firewalls each with DMZ and failover is significantly different in price. Watchguard 4k. Cisco 11K. (these are new prices) The cheap Pix 506 does not isolate a DMZ.

---

The requirements are met. Where did it say failover, 2 firewalls each with their own DMZ? That in and of itself says you'll be spending mucho dinero.

Anyway, I'm having trouble with my FreeBSD box, seems that if you have too many queues defined pf doesn't work well. Not stable at all. C-ya.

What about products from people like ZyXEL, Fortinet, Sonicwall, NetScreen......?


(Thanks for all the opinions expressed so far.)

Although the guys here have given varied and some workable suggestions, here's my suggestion.

Since you are asking about *other* various names,
I'd call or email each firewall/router company I'm interested in after perusing their website.

Get the lowdown direct from the horse's mouth while they teach you a thing or two that you can use on the next call to their competitor.

Personally I still wouldn't discount the advice here, these guys know a thing or two themselves.

Hi again,

I'm certainly not discouting anyone's opinion here - they're all more knowledgeable than me!

i've recommended watchguard before ... but they do have a drawback ... they are slow"er" then this

http://www.cisco.com/en/US/products/hw/routers/ps380/

look for one in 800 series that has "features" that you are looking for. they are routers but you can use one as firewall. also ... cisco's are (at least the ones i used) can handle crazy enviromental conditions (boiler basement anyone)

Quote:

---

The requirements are met. Where did it say failover, 2 firewalls each with their own DMZ? That in and of itself says you'll be spending mucho dinero.

---

I was just comparing the very far difference in pricing versus features, not suggesting anything. I would assume that he requires a DMZ and for a DMZ you need at least a Pix515. You won't pick one of those up for 500 that is up to date, but you can get them around 1000 bucks. Why DMZ? He mentions he has a box that will service requests by querying another box on the internal network. In fact most of the stuff on ebay requires a smartnet contract if you have any issues or need the latest IOS image and that will run approx 1500. Make sure the one you bid on has an active contract. :)

Good luck with BSD, I am having issues with SuSE and the damn package manager.