Affordable Hardware Firewalls

Hi, all. I haven't posted in a while, but I have a client with a question.

I recently set up a 40 client/2 server network for this client. Last week, he placed an order to have a T1 pulled to his location. He is, however, somewhat paranoid about external attacks. I installed MS ISA Server onto one of the servers, but he is adamant that he needs a hardware firewall for additional security. The problem is, he does not want to spend too much ($500 or less) and wants more than simply a router with NAT. Does anyone have any suggestions for a managed firewall in that price range? The infrastructure is Dell ProConnect switches (the whole network is running at 100 Mbps) and two Cisco Wireless Access Points for wireless connectivity. Any help you can offer is greatly appreciated.

AJ

Well, he's not being picky at all is he? Have you considered a multi-homed P.C. running Linux w/ IP Tables? Here is a link that has several different tools. Here is one for a web enabled log analyzer. You should be able to cobble something together pretty easily with a minimal amount of looking around

Have you looked at sonicwall. I believe they make some lower priced low end hardware firewalls. From what I'ev heard they are supposed to be pretty good and even have addons for content filtering and VPN support. Also, I know that severl months back Cisco released a low end PIX. I think is was a PIX 500 or something.

You're probably thinking of the 501 which retails for $600. A good vendor though could probably get it in for five hundred. I'm not sure what 505's are going for these days.

I aggree with thread_killer. I have installed a couple of 501's in small offices. If your client is looking for a hardware solution That is the one I would go with.

Belive it or not A Linksys DSL/Cable works wonderfully!!!
I have one installed in just a system.
Mine has 3 servers and a bunch of Desktop Stations

I also do the same thing in my shop.

NAT, DHCP, Port Forewarding, etc....
and it is the best $80 you will spend.
Believe it or not, Radio Shack now has them in stock.
I have to spend more money on a monster switch
than a Router. :D

AJ: I'd say look into openbsd with pf. Or a sonicwall. A pix would be nice, but any expansion on it will cost an arm and a leg..and afterall, how expandable are they..they run out of room long before a system like openbsd or linux as it were. I know plenty of places that employ linux/bsd as their firewall solutions, as I am sure you do. most HW firewalls are based on bsd anyways..

Well one of the best Hardware/Software firewalls I've worked with thought it took a bit of a learning were Watch Guard products from low end to pretty pricy stuff. GUI for network activity both ways was great color coded could tell at a glance what was what. Anyway http://www.watchguard.com/products/ SOHO may be the way to go and their annual advisor service is good as is customer/tech support. My .01 cents :)

In terms of good products, I'd agree with Palemoon on his choice of Watchguard. I'm not sure though whether the SOHO 6 will protect this size of network. I had trouble configuring it for my office, although the customer support was 1st class. It turned out that a crossover cable(!!) between the hub and the firewall was what was needed to get connectivity to the outside world!!!!!!!!!!!! The patch cables supplied with the product dodn't work. However, now it's up and running, I'm happy with it. If you can use a SOHO 6, then the budget will remain below $500 - a Firebox will cost a lot more.

www.devil-linux.org

That firewall is really good. Our company and a few of our clients run this firewall, and its really great.

Cheers.

Like Highlander said, the Lynksys DSL/Cable router works great. Wallwatcher.com has a free downloadable app (log files) that works with the Lynksys which is pretty cool.

I originally suggested to the client to go with a *nix box running IPTables, but he was reluctant to do it because of the support issues. While I could easily support it, I only have a short-term contract with this client because he wants to do the maintenance himself once it's up and running.

Based upon everyone's recommendations, I'm looking at the Cisco firewall, as well some of Soinicwall's products. I'm running Linksys products for my one of my home networks, but I'm reluctant to go with a SOHO solution such as Linksys for a larger network. If anyone has any further recommendations, though, I'd love to hear them.

AJ

What Cisco firewall are you looking at that cost less than $500? Please tell....

If there are any Catalyst switches located withhin the catchment areas, or in his area, I would suggest putting the guy's sever on a VLAN. However, Cisco 2500 routers can be purchased on Ebay cheaply now. Range of 250-400. I would invest in a Cisco 2500 router, get the latest IOS, and install some extended ACLs. That should be all the security the guy needs, as long as the system is fairly secure. Either do this or invest in what super_phreak had to offer up above^, it seemed like a good bet also.

For a small appliance firewall its gotta be one of the following

NetScreen 5XT [URL=http//www.netscreen.com[/URL]

Sonicwall Soho appliance [URL=http://www.sonicwall.com[/URL]

Watchguard (er..the small boxes) [URL=http://www.watchguard.com[/URL]

Checkpoint Sofaware [URL=http://www.sofaware.com[/URL]

Intrusion [URL=http://www.intrusion.com[/URL]

Forget the little Nokia (IP110) there too expensive.

I dont think for $500 your gonna get a managed firewall but these things are so 'dumb' user friendly your client wont need to worry. I personally recommend either the Netscreen or the Checkpoint Sofaware unit.

Quote:

---

Originally posted here by brandon64_99
I would invest in a Cisco 2500 router, get the latest IOS, and install some extended ACLs. That should be all the security the guy needs, as long as the system is fairly secure.

---

Wrong!!!

Cisco ACL's will not provide you with Stateful Inspection firewalling. It will give you the ability to filter traffic, which is better than nothing, but I would not consider a Cisco router to be a replacement for a firewall.

I would agree with some of the previous posts that a PIX 501 is probably the way to go for the $$, but I think there is a much more user-friendly choice in a Checkpoint solution on an S-Box platform. (As the previous post states)

http://www.sofaware.com/

Quote:

---

Originally posted here by avdven
I originally suggested to the client to go with a *nix box running IPTables, but he was reluctant to do it because of the support issues. While I could easily support it, I only have a short-term contract with this client because he wants to do the maintenance himself once it's up and running.

AJ

---

It appears that your customer is out of luck no matter what you do, seeing that
A. He/She didn't know enough to install their own network, that's why you have a job
B. If they could not perform job A, then there is no CHEAP firewall solution that a non technical person is
going to be able to maintain.

If you go with a Cisco firewall, then the customer is going to have to know how to use the CLI or the GUI that cisco has built to help configure PIX commands. This job is not for the faint of heart, it's easy but it's very technical.

The answer appears that you will need to go with some sort of *nix firewall with a simple web frontend in order for the customer to be able to maintain it himself/herself.

Also if you find a Cisco firewall for ~$500 you need to let everyone know where you found it. You won't find one of those, legit, for around ~$500. Unless it's the older PIX Classic, which has been EOL (end of lifed) years ago. Not too mention Cisco support for the product, which is optional. Your looking at over $500 alone for Cisco Service Agreement for one year....

Just my 2 cents....

Quote:

---

Originally posted here by d0ppelg@nger


Also if you find a Cisco firewall for ~$500 you need to let everyone know where you found it. You won't find one of those, legit, for around ~$500. Unless it's the older PIX Classic, which has been EOL (end of lifed) years ago. Not too mention Cisco support for the product, which is optional. Your looking at over $500 alone for Cisco Service Agreement for one year....

---

The PIX 501 is a SOHO firewall that can be found in most places in the ~$500 range.

here ya go:
http://www.cdw.com/shop/products/default.asp?EDC=329744

What is a PIX classic?

The PIX Classic was the PIX before models 520 and 515. It was around about 4-5 years ago. Cisco EOL it a couple of years ago. The reason I know about it was because I had one. It cratered on me and since Cisco EOL it, they gave me a PIX-520 for a replacement. I guess I had never looked at the PIX 501. Looking at our pricing sheet I can get one for ~$400 for DES capable and ~$485 for 3DES capable 501's. I'm always looking at the 515 and higher models...

That would be the way to go for a small office. Here is the spec sheet on the 501

Cisco PIX 501 Data
Cisco 501 PDF Doc

Yeah...I know what you mean...

I actually have 4 PIX 535's that are going to be doorstops soon. What a waste...

You can't really say they are doorsteps...The PIX firewalls do more than a good job at what they are built to do.
The 535 is not End of Sale yet, now my 2-520's were EOL in 2001 and I'm still using them fine. They are workhorses and I haven't had to reboot them in years. A PIX is basically a PII motheboard/CPU with a proprietary Cisco flash card.

The reason I said they are doorstops is not because of functionality, but the fact that they are not easily manageable in large number across an enterprise. My company quickly came to that conclusion with very little convincing.

We are replacing them with Checkpoint Firewalls

"Wrong!!!

Cisco ACL's will not provide you with Stateful Inspection firewalling. It will give you the ability to filter traffic, which is better than nothing, but I would not consider a Cisco router to be a replacement for a firewall.

I would agree with some of the previous posts that a PIX 501 is probably the way to go for the $$, but I think there is a much more user-friendly choice in a Checkpoint solution on an S-Box platform. (As the previous post states)

http://www.sofaware.com/"


If the guy sets up extended ACLs properly, than he would be able to properly filter, untrusted addresses, and specific protocols from getting to the server. That would be great protection at great cost, plus, with the investment in the router, it would provide for future growth of the network if future growth was implied later on. The guy could use some type of 3rd party software for stateful inspection firewalling ( unless running a linux box with kernel 2.4, comes built in with the standard Linux firewalling features).

Quote:

---

The PIX 501 is a SOHO firewall that can be found in most places in the ~$500 range.
here ya go:
http://www.cdw.com/shop/products/default.asp?EDC=329744

---

That's actually the exact link I found too (I got it from Cisco's web site). Right now, if he invests in a firewall, this is the one we're going with. I say if simply because the T-line provider he was going with decided to double the monthly rate and he is debating taking that path at all. If he decides to accept the new terms, he will purchase the PIX 501 (which I will install and teach him to maintain, since I have had quite a bit of experience with Cisco routers and firewalls). Otherwise, he will most likely hold off on getting an Internet connection until he can find a less expensive provider.

Edit: By the way, I thank everyone for their suggestions and input. I've looked into all of the solutions provided and feel that the Cisco firewall is the way to go with what I have to work with.

AJ

The guy might also want to go as far as to make sure that his authentication type is a good one also, CHAP over PAP anyday. :)

Quote:

---

Originally posted here by brandon64_99
The guy might also want to go as far as to make sure that his authentication type is a good one also, CHAP over PAP anyday. :)

---

What are you talking about!?!?

What does a firewall in this scenario have to do with authentication?

Quote:

---

Originally posted here by brandon64_99
If the guy sets up extended ACLs properly, than he would be able to properly filter, untrusted addresses, and specific protocols from getting to the server. That would be great protection at great cost, plus, with the investment in the router, it would provide for future growth of the network if future growth was implied later on. The guy could use some type of 3rd party software for stateful inspection firewalling (unless running a linux box with kernel 2.4, comes built in with the standard Linux firewalling features).

---

If you can get a PIX for around $400-$500, why would you waste your money on a used, outdated router (for the same price) that will require another purchase to upgrade the IOS to the firewall feature set.

Buying a 2500 is not a good investment at all. They are not modular and cannot be easily upgraded, so it would most likely be useless anyway unless you are planning to use it in a lab.

The guy that is insisting on this firewall seems alittle paranoid. Comforting him with authentication types or any other crap to settle the over worked guy down is implied in this situation. (lots of sarcasam)

And yes, but isn't every router thats currently implemented out of date? YES!!! Cisco creates new routers all the time. Upgrading a router is easy, and once the router is upgraded, it would at least be a a few months before another IOS is released.

"that will require another purchase to upgrade the IOS to the firewall feature set." - iNViCTuS

You would not have to purchase a IOS upgrade to gain the features like extended ACLs. For stateful inspection firewalling it would prob. require some extra money, but he could purchase cheap software to run on the system for that.


"with the investment in the router, it would provide for future growth of the network if future growth was implied later on." - brandon64_99

^This still stands as a factor also with the purchase of the router for security also.

Don't take this the wrong way, but I am convinced you really have no idea what you are talking about...

Well, I dont care. I just dont think that your understanding me.