Which enterprise firewall to go for?

InvisibleJim said:
The real benefit of Fortigate or Sophos UTM devices to me is more around the application filtering,content filtering and that sort of thing or if you want to buy into their larger ecosystem. If you upgrade to paid Untangle, you're probably at Fortigate/Sophos money last time I looked.

If you need free or cheap site to site VPN you have options and you can run a separate VPN server behind your existing firewall.

Open Source VPN Server (VM, PI, PC, Whatever depending on your budget and performance requirements:
  • OpenVPN - the traditionalist
  • SoftEther - very good, multiprotocol including IPSec so nice if you need to connect to an IPSec Device on the other side
  • Wireguard - new kid on the block. Fast, Secure, does what it says on the tin
Devices:
  • Mikrotik - even a small one will probably handle 30 users or so site to site over IPSec or SSL VPN
  • OPNSense or PFSense
Mesh VPNs/global overlay networks:
  • Zerotier - cost effective for low number of nodes. OPNSense has a plugin I think to bridge to a LAN
  • Nebula - From Slack. Very nice. Not very developed in terms of management tools for the system.
  • Tailscale - Looks nice. Gets pricey for a large number of nodes
Click to expand...
Good list.
Cut the apron strings on Fortinet/Sophos. Bad and dated software that has been hacked to hell and gone. There is a very good Swedish solution as an alternative named Clavister. It is well priced and will run virtualized or bare metal.
There are also SD-WAN site to site private WAN solutions. I use and deploy one known as Fusion. It is an X86 ibm/redhat approved solution. I have also worked with a good home grown solution from these guys: https://www.mypowercloud.net/ Its a mikrotik based solution but has decent site to site ability via a hub and spoke topology. The hub is based on StrongSWAN. Better and more stable than direct tik to tik sites.
Globally you can plug into cloudflare.
 
r00igev@@r said:
Its slow and has MTU problems.
I do site to site tunnels using proprietary software or wireguard. Single site to site at about 2.5gbs. IPSec maxes out at 400mbs. You need to aggregate resources to go higher.
Click to expand...

I looked at performance benchmarking on the wireguard website. With what they show it is around 15% faster than IPsec.
I will read up on wireguard a bit more, on standard enterprise devices it does not feature much so I am ignorant of how it works and why it would be faster. I imagine it still has to use similar encryption methods so interested to see why it is faster

With regards to MTU, it has been a long while since I have actually had a MTU issue because of IPsec and that used to be on things like MPLS links or specific L2 links where there were additional headers at play
 
syntax said:
I looked at performance benchmarking on the wireguard website. With what they show it is around 15% faster than IPsec.
I will read up on wireguard a bit more, on standard enterprise devices it does not feature much so I am ignorant of how it works and why it would be faster. I imagine it still has to use similar encryption methods so interested to see why it is faster

With regards to MTU, it has been a long while since I have actually had a MTU issue because of IPsec and that used to be on things like MPLS links or specific L2 links where there were additional headers at play
Click to expand...
Enterprise devices have proprietary stacks that need to play catch up - could be a year or longer before they add it. Wiregaurd doesn't have any bloat and is compiled into the latest linux kernel.
I have problems with IPSEC and where ICMP is disabled breaking auto.
 
syntax said:
I looked at performance benchmarking on the wireguard website. With what they show it is around 15% faster than IPsec.
I will read up on wireguard a bit more, on standard enterprise devices it does not feature much so I am ignorant of how it works and why it would be faster. I imagine it still has to use similar encryption methods so interested to see why it is faster

With regards to MTU, it has been a long while since I have actually had a MTU issue because of IPsec and that used to be on things like MPLS links or specific L2 links where there were additional headers at play
Click to expand...
I think Wireguard uses the Noise Protocol for encryption which contributes to its security and performance and on Linux its low level components are in t6he kernal which also improves performance.
 
InvisibleJim said:
I think Wireguard uses the Noise Protocol for encryption which contributes to its security and performance and on Linux its low level components are in t6he kernal which also improves performance.
Click to expand...

did a quick read but will put some effort on the weekend.
Seems like noise is for key exchange, alot of the logic is similar or identical to IKE/IKEv2
A difference I can see is that it is connectionless which probably attributes to the speed
 
Considered going cloud firewall with something like CloudFlare?

I’m so over Fortigate and their needlessly expensive kak and perpetual licensing while offering almost no value.

Alternatively go Mikrotik or Ubiquiti.
 
Gtx Gaming said:
We have 30 users on site maybe less most of the time atm, about 10 vpn users and then we will adding 2xipsec tunnels.
Click to expand...

What is on site that they need to access?

Why do they need a tunnel between the two offices?
 
SauRoNZA said:
Considered going cloud firewall with something like CloudFlare?

I’m so over Fortigate and their needlessly expensive kak and perpetual licensing while offering almost no value.

Alternatively go Mikrotik or Ubiquiti.
Click to expand...

I'm not sure saying they offer no value is the right term and I don't even like their firewalls.
 
r00igev@@r said:
Its slow and has MTU problems.
I do site to site tunnels using proprietary software or wireguard. Single site to site at about 2.5gbs. IPSec maxes out at 400mbs. You need to aggregate resources to go higher.
Click to expand...
It's also difficult to monitor performance, uptime and to troubleshoot. A VPN using TLS 1.2+ and cert based mutual auth with strong ciphers is far more manageable, and can be chased through a WAF.
 
r00igev@@r said:
Enterprise devices have proprietary stacks that need to play catch up - could be a year or longer before they add it. Wiregaurd doesn't have any bloat and is compiled into the latest linux kernel.
I have problems with IPSEC and where ICMP is disabled breaking auto.
Click to expand...
I would hesitant to use Wireguard in an enterprise environment though, but it all depends on the risk.
 
RonSwanson said:
I would hesitant to use Wireguard in an enterprise environment though, but it all depends on the risk.
Click to expand...

Many enterprise products are backed by WireGuard already.

Doing it yourself from the open source could potentially be a little bit more questionable but not much really.
 
SauRoNZA said:
Many enterprise products are backed by WireGuard already.

Doing it yourself from the open source could potentially be a little bit more questionable but not much really.
Click to expand...
Most of the proprietary products are based on Linux in some way (Fortigate and Sophos, certainly) - pretty sure they also lean heavily on plenty of Open Source components for many of their other features as well. And so they probably should as it saves them from re-inventing the wheel and will tend to a somewhat less esoteric product.
 
Sonicwall has what you need and more. Can be pricey on renewals but in most cases they’ll throw in a new devices every few years
 
InvisibleJim said:
Most of the proprietary products are based on Linux in some way (Fortigate and Sophos, certainly) - pretty sure they also lean heavily on plenty of Open Source components for many of their other features as well. And so they probably should as it saves them from re-inventing the wheel and will tend to a somewhat less esoteric product.
Click to expand...

I meant modern world products like CloudFlare, Wandera, TailScale etc that actually fit into the real world.

I seem to recall even Slack use it for their mesh network.
 
SauRoNZA said:
Many enterprise products are backed by WireGuard already.

Doing it yourself from the open source could potentially be a little bit more questionable but not much really.
Click to expand...
I like WireGuard, but which enterprise products support WireGuard and are certified to implement it under ICSA certification?

Agreed that DIY is cool, but there are not too many of those diep seuns around, and the OP does not strike me as one of them.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X