Network Edge Security Devices

VoidRoamer

Junior Member
Mar 21, 2010
23
0
66
Hello,

I was hoping to get a little insight on the all-in-one network edge security devices that are becoming more commonplace. I intend on recommending them to a few small businesses that I support to complement their existing protective measures. There appears to be an enormous price range for similarly specced devices aimed at similar markets, all offering as part of an annual subscription, regular updates to their internal firmware and malware signatures.

I get the impression that one of the most significant differences lies between those devices that do their processing locally and those that offload most of the processing to external services. The devices I've been looking at recently are the Netgear ProSecure UTM series which appear to fall into the latter category. I've encountered one device that appears to do its processing locally manufactured by a company called Netbox however both the device and annual subscription are literally ten times the cost of the Netgear alternative. $1200 to $1600 per year for a small business with just two or three employees is a very difficult sell given that a similarly specced device can be obtained for as little as one tenth of that.

I have four main concerns behind the idea of continuously communicating with off-site validation and filtering services:

1) Latency will be introduced to most network operations.
2) Monthly bandwidth consumption will be increased by a significant factor.
3) Private data will be transmitted offsite, potentially in violation of privacy legislation.
4) Loss of communication with the offsite services will reduce the effectiveness of the device.

My questions boil down to:

1) Why the price variation for the same target market? What are the distinguishing factors?
2) Are my concerns about offsite processing valid?
3) Is anyone aware of more reasonably priced options that also do their processing locally?

My apologies for being verbose and my thanks in advance.
 

drebo

Diamond Member
Feb 24, 2006
7,034
1
81
Top of the line is Palo Alto Networks, followed by Juniper SRX, followed by Juniper SSG, followed by Cisco ASA, followed by Checkpoint or Fortigate, followed by consumer-grade SOHO shit, followed by linux-based crap, followed by Watchguard, followed by Sonicwall.

PAN stuff is very expensive. Their entry-level unit is almost $3k.

The Juniper SRX is fantastic, and its entry-level unit is about $530.

The SSG is the old style of Juniper firewall, and you should use the SRX if at all possible.

The Cisco ASA is extremely neutered as far as featureset goes in comparison to the SRX, and there's absolutely no reason to buy one, as they're usually around $550 for the unlimited user version.

Anything else in my list, I would not recommend to my worst enemy.
 

spidey07

No Lifer
Aug 4, 2000
65,469
5
76
Seconded - excellent summary of what's out there. Gartner has palo alto and checkpoint in the magic quadrant.
 

drebo

Diamond Member
Feb 24, 2006
7,034
1
81
Checkpoint's management software is supposed to be extremely good when managing large numbers of VPN clients or tunnels, but I haven't had the opportunity to use it in that capacity as yet.

I just stick to SRXs and they work really well.
 

spidey07

No Lifer
Aug 4, 2000
65,469
5
76
Checkpoint's management software is supposed to be extremely good when managing large numbers of VPN clients or tunnels, but I haven't had the opportunity to use it in that capacity as yet.

I just stick to SRXs and they work really well.

I would put checkpoint's management at top tier best of breed. Nothing comes close.
 

VoidRoamer

Junior Member
Mar 21, 2010
23
0
66
Thanks very much for the responses. I wholly agree with the preference of purchasing from vendors with established reputations and experience, however in many cases I'm looking at very small businesses with only several employees who don't want to spend much, if anything, not immediately essential to their operations.

Two vendors that have a well established presence here in Australia are Netgear and D-Link. I tend to use Netgear for most needs; I was just wondering how people with more experience in the networking world consider these vendors compared to the higher-end companies such as Cisco?
 

VoidRoamer

Junior Member
Mar 21, 2010
23
0
66
The Cisco ASA is extremely neutered as far as featureset goes in comparison to the SRX, and there's absolutely no reason to buy one, as they're usually around $550 for the unlimited user version.

From what I've seen so far of the Cisco ASA5505 in terms of marketing material/specs, it seems a reasonable unit. What does it lack compared to other high-end offerings?
 

gsaldivar

Diamond Member
Apr 30, 2001
8,691
1
81
For small to medium organizations on a budget, Zentyal is a feature-rich, stable and well maintained open-source business server.

http://www.zentyal.com/
http://trac.zentyal.org/wiki/Features

YVib5.png
 
Last edited:

drebo

Diamond Member
Feb 24, 2006
7,034
1
81
From what I've seen so far of the Cisco ASA5505 in terms of marketing material/specs, it seems a reasonable unit. What does it lack compared to other high-end offerings?

It does not offer a full routing stack. Dynamic routing protocols are neutered, at best. Tunnel-mode VPNs are not possible. And any sort of content/web filtering is extremely expensive.

Being that the ASA5505 Unlimited User bundle is more expensive than the SRX100B, there is no reason at all to consider it. The SRX100B is a more fully featured and faster unit.
 

Gorthan

Member
Feb 11, 2010
45
0
0
VoidRoamer,

I've dealt with a few of these devices in the last few years, and haven't been impressed.

To try and answer your questions directly,

1) While not always 100% accurate, you are getting what you pay for. The more expensive the device, usually the more full featured and useful it is. Reliability is also a factor, the cheaper ones die quicker. A lot quicker....

2) I haven't really played with any devices that do offsite processing, at least not that I'm aware of. Most I've played with seem to do processing on board, but I could be wrong. I would think that devices that do this would be slower anyway, as processing power is cheap and most devices I've seen have been quite powerful. Primarily I would imagine it's a concern of the customer, some really don't care if their email is bounced around the world, others would scream blue murder if they so much as left the state.

3) No... If you find one let me know. Some of the vendors I've seen out there (I don't deploy these devices myself, I don't like them) are Sonicwall, Astaro, Firebox.

Now all the devices I have seen seem to be around the $700 AU range (I'm in Perth, WA) and appear to process A/V locally . And they do work, to a degree. If you don't try anything to complex it's probably ok. I would look at what you are trying to provide, as it's possible you can look at doing that some other ways.

I've been using a combination of on-site and 'cloud' services to basically achieve what these devices do, cost wise though I think you and I are in different areas, most of my base is 20+ users. For the really small guys I tend to go for a complete SaaS solution as the cost of entry is low, there's no hardware to fail/replace/upgrade which causes purchase price headaches and they are easily scalable. Once again though, you do have to look for providers that either are Australian based, or have data centres located here in Australia.