Are legacy firewalls still relevant?

MDKza said:
The vendors firewalls that I've used over the years all have tools to mitigate these things.
Trying to protect your edge with an SD-WAN device still doesn't seem advisable to me.
Layer 4 opening and closing of ports is not the right way to do things.
Not sure what product you are referring to in this specifically but most of the SD-WAN vendors I've seen are ACLs with a nice GUI.

I don't disagree with you - I just don't fully agree :)
Click to expand...
If I had an ice cream for every time I've seen a firewall administrator implement ANY/ANY rules I'd be an Eskimo Pie millionaire. The firewall should have a hand that pops out and dishes out a snotklap.

Most implementations of firewalls are in effect ACLs. Many people buy identity based ones then configure IPs in the rules till the cows come home.

And on the point of GUI's, never seen a firewall with a nice one. I heard the Sophos one looks good but I'd rather run kaalgat through Boksburg than take that firewall for a spin.:ROFL:
 
r00igev@@r said:
If I had an ice cream for every time I've seen a firewall administrator implement ANY/ANY rules I'd be an Eskimo Pie millionaire. The firewall should have a hand that pops out and dishes out a snotklap.

Most implementations of firewalls are in effect ACLs. Many people buy identity based ones then configure IPs in the rules till the cows come home.

And on the point of GUI's, never seen a firewall with a nice one. I heard the Sophos one looks good but I'd rather run kaalgat through Boksburg than take that firewall for a spin.:ROFL:
Click to expand...

so is the problem the firewall or the person configuring the firewall ?
 
r00igev@@r said:
Checkpoint would like to take you upon that!:laugh: https://www.checkpoint.com/comparison/check-point-vs-fortinet/
Clavister is also cost effective and has no backdoors.

But I think the biggest issue is the change itself to learn a new syntax. Probably the bigger consideration and barrier than price for many companies.

I have something better than fort analyzer that is priced better.:laugh:

Fort analyzer has that Siebel feel to it, like you just running a spreadsheet as the app.
Click to expand...

all the vendors try and claim there product have a better tco blah blah.Moved from sonicwall to forti , and on the sonicwall site it gives a "detailed" breakdown as to why Sonicwall is better :X3::ROFL:
 
Apologies, read the article quite quickly, so might have some errors / interpretation issues

I think SSE rather than SD-WAN is replacing the idea of on-prem firewalls. Although we still require some east-west segmentation and probably will for a while, this is decreasing and moving security to a services edge makes sense. From a SSL inspection perspective, from an identity defined perimeter perspective and in some cases from a costing perspective.

I never did buy into firewalls being the place to invest most of the security budget and have and still do try get customers to secure the damn endpoints properly, invest in proper privilege management and appsec technologies.

The argument that a firewall does not block malware getting into the network, I kind of agree with. But it can protect against cnc connections, do segmentation and participate in zero trust to contain malware. I wouldnt use a firewall to scan mail or do proper appsec, but it is kind of a swiss army knife that has had too much importance placed on it, but does have some use cases.

Cisco had Trustsec for a really long time, the concept was really good and anyone running around the last 2 years screaming zero trust is the greatest new thing, should have a look at how long ago this was introduced. The firewall participated in this, using SGT's for dynamic segmentation and policy changes. However, the real benefit of this was SGT's on the access layer, thereby segmenting hosts, even in the same VLAN, dynamically based on variables such as endpoint posture and network traffic.
If they had a decent pricing model Cisco would have cleaned up the security space, I am almost convinced of it. Sadly, ISE earlier versions were a disaster and TrustSec required new hardware at stupid prices and security engineers were still stuck using legacy protection, so it failed.

The part around threat intelligence and SD-WAN is odd. Threat intelligence feeds can be used by pretty much anything, and firewalls have been using this for ages. Threat intelligence feeds for me are the heart of each vendors protection. The security hardware is the enforcement mechanism, but the feed provides the information and control plane for blocking.

I agree on the remote access / SSL VPN''s. On almost all pen test reports, this is breached in some way. Again, this is now normally solved through things like private cloud access where there is no VPN or even connection point to attack from the outside, unless the attacker somehow breaches the vendors cloud service (not impossible, but certainly challenging)

I really dont agree that much with the orchestration or automation on firewalls vs SD-WAN. There are many items which are done via orchestration from basic policies to advanced security protection mechanisms. These can be achieved with vendor products or external automation tools.

From a hardware perspective, I think the statements there are very generic and broad. Firewalls offload to dedicated asics for many things and it really depends what you buy and the type etc. To say a SD-WAN device has better hardware and is better at networking is not really fair.


In general, I think I agree that perimeter firewalls are over rated, generally poorly configured, expensive, lack agility and are probably going to be phased out. I dont agree that the answer is SD-WAN, even a little. SASE / SSE maybe, but most SD-WAN players are either pure play or are bolting on UTM features which is coming from the other end of the stack that firewall vendors who are bolting on SD-WAN.

In my opinion, SD-WAN should purely be around traffic optimization and steering and security features should be offloaded to a secure services edge and/or exist on the endpoints
 
Legacy firewalls are cool, but I think we just need to adapt to a zero trust environment.
 
r00igev@@r said:
Zero Trust is a term thrown around often. However, I see guys who talk about it but haven't implemented decent segmentation. Thats the start.
There should be a clear partitioning between management traffic and user traffic. Services should have a leg in each and changes to infrastructure should only be possible from the management interface. My preference is to have a VPN concentrator in the management plane and use that to force 2FA authentication using a SSL based VPN.
Most hacks are because the user and management plane are common.
I would take it a step further and segment the database, web and app layers. You don't even need to involve the firewall administrator on that one as its just the implementation of plain old vlans. Additionally, I would create a separate segmentation for backup/restore with an airgap for at least one copy of the data.
So in my opinion you wasting time with zero trust when you lack segmentation.
Click to expand...
Microsegmentation is a core principle/requirement of a formal Zero Trust framework isn't it?

I agree with what you're saying above about segmentation in general networking terms and separating the management plane etc.
 
neoprema said:
I'm talking about CheckPoint on Dell hardware... :) I imagine Cisco's were probably more stable.
Click to expand...

Ah.....yes, that was unpleasant sometimes.
got caught out by magic mac a few times running multiple clusters on the same segment back in the day.

The load balancing was also challenging...as was the dynamic routing (although i am talking like R55 days here)
 
ubercal said:
so is the problem the firewall or the person configuring the firewall ?
Click to expand...
When you do something stupid it should pop up with a warning. It you running a rule for diagnostics it should have the ability to teardown after a specific time.

Yes, its easy to blame the person but then the vendors need to come to the party as well with process improvements within the administration workflow.
 
syntax said:
Apologies, read the article quite quickly, so might have some errors / interpretation issues
Click to expand...
Thanks for the read and the feedback.
syntax said:
I think SSE rather than SD-WAN is replacing the idea of on-prem firewalls. Although we still require some east-west segmentation and probably will for a while, this is decreasing and moving security to a services edge makes sense. From a SSL inspection perspective, from an identity defined perimeter perspective and in some cases from a costing perspective.
Click to expand...
My opinion was that the current on-prem enterprise environment would remain due to change reistance but that eventually the cloud implementation principals would move on-prem.
syntax said:
The part around threat intelligence and SD-WAN is odd. Threat intelligence feeds can be used by pretty much anything, and firewalls have been using this for ages. Threat intelligence feeds for me are the heart of each vendors protection. The security hardware is the enforcement mechanism, but the feed provides the information and control plane for blocking.
Click to expand...
I've been trying to get a major MSP to implement threat intelligence on a popular firewall from pre-pandemic. Zilch delivery. Told them to escalate to the vendor. Still Zilch. I'll believe it when I see it.
syntax said:
I really dont agree that much with the orchestration or automation on firewalls vs SD-WAN. There are many items which are done via orchestration from basic policies to advanced security protection mechanisms. These can be achieved with vendor products or external automation tools.
Click to expand...
Practical experience shows that vendors don't deliver on automation and require manual configuration by a trained expert even on the most simple of tasks.
syntax said:
From a hardware perspective, I think the statements there are very generic and broad. Firewalls offload to dedicated asics for many things and it really depends what you buy and the type etc. To say a SD-WAN device has better hardware and is better at networking is not really fair.
Click to expand...
Firewalls don't implement the latest networking encapsulations or advanced queuing. The latest linux kernel build as well the mac does have them. They lagging.
syntax said:
In my opinion, SD-WAN should purely be around traffic optimization and steering and security features should be offloaded to a secure services edge and/or exist on the endpoints
Click to expand...
What about when the firewall claims to do SD-WAN? In actual fact, market leader. Mostly because the feature is enabled by license but not used.:sneaky:
 
Last edited:
r00igev@@r said:
My opinion was that the current on-prem enterprise environment would remain due to change reistance but that eventually the cloud implementation principals would move on-prem.
Click to expand...

Not just change resistance. Plenty companies still have on prem presence and hardware. They need firewalls to segment this, especially on an east-west scenario.


r00igev@@r said:
I've been trying to get a major MSP to implement threat intelligence on a popular firewall from pre-pandemic. Zilch delivery. Told them to escalate to the vendor. Still Zilch. I'll believe it when I see it.
Click to expand...
Thats an issue with people / MSP, not the devices or technologies

r00igev@@r said:
Practical experience shows that vendors don't deliver on automation and require manual configuration by a trained expert even on the most simple of tasks.
Click to expand...
Well this depends, I mean a SOAR system does automation at a pretty good level, but obviously needs to be told what to do or at least have some parameters.
Fortinet, who is miles behind has automation stitches built in that can do tons of stuff. I've seen plenty firewall environments managed using other automation tools like ansible.
Provisioning occurs with many vendors and works out the box with tons of scenarios.


r00igev@@r said:
Firewalls don't implement the latest networking encapsulations or advanced queuing. The latest linux kernel build as well the mac does have them. They lagging.
Click to expand...
I know firewalls that can do pretty advanced queuing, H-QOS, tagging, segment routing etc
They also have dedicated asics for certain functions, like inspection functions, routing convergence etc
Again, every side will have a win at some point and I agree, for traffic steering and manipulation, SD-WAN devices are more geared and suited for this. But they are not geared for proper security, at least not yet. And I think it would be silly to try push them that way when we are looking at a dissolved perimeter and would rather cloud our security.

r00igev@@r said:
What about when the firewall claims to do SD-WAN? In actual fact, market leader. Mostly because the feature is enabled by license but not used.:sneaky:
Click to expand...

Not sure what your point is here. SD-WAN in my opinion is not a replacement for a perimeter firewall which is what your article is kind of saying. What this is doing is going the other way round that firewall vendors are doing and just moving security services on top of a device trying to do SD-WAN. I dont think either is the way forward.
A secure services edge is where the security services should be migrated if possible and SD-WAN should be used for traffic steering, optimization, acceleration, peering etc.
 
r00igev@@r said:
Had the blade ones that went into the 7600 chassis that gave endless grief on failover.
Click to expand...

The only times I had grief with the blades was version issues, but stable versions failed over pretty consistently with me
 
syntax said:
Thats an issue with people / MSP, not the devices or technologies
Click to expand...
Thats the point. If the automation and provisioning was so good then you wouldn't need to deal with people as the issue. Regardless, highly paid and certified. I do the basic threat intelligence stuff on SD-WAN.
There is actually a whole secondary market based on packet capture, analysis and then connecting to the firewall using an agent to reject malicious traffic. Problem is that most businesses are reluctant to spend more money on something the firewall salesman has sold him on as standard functionality.
syntax said:
Again, every side will have a win at some point and I agree, for traffic steering and manipulation, SD-WAN devices are more geared and suited for this. But they are not geared for proper security, at least not yet. And I think it would be silly to try push them that way when we are looking at a dissolved perimeter and would rather cloud our security.
Click to expand...
My opinion is that the cloud security firewall products are not an OEM of Checkpoint, Cisco, Fortinet, Palo Alto, Sophos, Watchguard, Clavister or any other Silicon Valley firewall variant. They are built on linux using netfilter/nftables. So do Cloudflare, Azure, google, AWS provide proper security?
syntax said:
Not sure what your point is here. SD-WAN in my opinion is not a replacement for a perimeter firewall which is what your article is kind of saying. .
Click to expand...
Yes, Magic Firewall to replace the perimeter firewall: :ROFL:

Has your company been impacted by the supply chain disruptions that affected not only the price but the lead time for new Hardware Appliances? Break Free from your old on premise Network Security services and enjoy the speed and ease to deploy Cloud-native workload securely.
Whilst many applications have moved to the cloud, or are in the process of moving, most network security functions remain tied to on-premise hardware appliances.
Click to expand...


Edit: Only saw that webinar now and busy watching it.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X