Which enterprise firewall to go for?

[InvisibleJim]

I meant modern world products like CloudFlare, Wandera, TailScale etc that actually fit into the real world.

I seem to recall even Slack use it for their mesh network.

Nebula was built internally by Slack to replace IPSec tunnels between different data centers which weren't scaling well for its use case. Video below is quite interesting.

They ran it internally for 2 or 3 years before open sourcing in 2019 and the original developers have spun out into a startup called Defined.net to further develop Nebula. It doesn't use Wireguard but does also use the Noise Protocol framework.

 

[SauRoNZA]

Nebula was built internally by Slack to replace IPSec tunnels between different data centers which weren't scaling well for its use case. Video below is quite interesting.

They ran it internally for 2 or 3 years before open sourcing in 2019 and the original developers have spun out into a startup called Defined.net to further develop Nebula. It doesn't use Wireguard but does also use the Noise Protocol framework.

Aaah yes I knew there was a connect between on some level.

 

[SauRoNZA]

I like WireGuard, but which enterprise products support WireGuard and are certified to implement it under ICSA certification?

Agreed that DIY is cool, but there are not too many of those diep seuns around, and the OP does not strike me as one of them.

See the post above yours.

If it’s good enough for the company that basically runs the internet then it’s good enough.

 

[RonSwanson]

See the post above yours.

If it’s good enough for the company that basically runs the internet then it’s good enough.

Yes, I recall seeing Nebula, again impressive, but not ICSA certified, and that's what enterprise deployments want.

 

[r00igev@@r]

I like WireGuard, but which enterprise products support WireGuard and are certified to implement it under ICSA certification?

Agreed that DIY is cool, but there are not too many of those diep seuns around, and the OP does not strike me as one of them.

Ja ja. What about all those enterprise products that ripped the ring and made millions out of the volunteers who created log4j? Only bitched and moaned and didn't even give them a banzela for fixing it.
I'm using it already in product for DC meshing over VXLAN. Table propogation handled by Babel. It works.

 

[r00igev@@r]

Most of the proprietary products are based on Linux in some way (Fortigate and Sophos, certainly) - pretty sure they also lean heavily on plenty of Open Source components for many of their other features as well. And so they probably should as it saves them from re-inventing the wheel and will tend to a somewhat less esoteric product.

Those guys use a fork of Linux two generations old. Its a smelly tin of fish in this day and age. Corporates buy into the comfort of presence and marketing, not technology.
Many of the vulnerabilities that have been widely exploited are due to the vendor use of 10 year old libraries that haven't been refreshed. The Fortinet VPN exploit has been the best fresh meat for hackers for the past two years. Yes, people need to patch but jislaaik the vendor should catch some flack for stuff lurking in their code that isn't addressed.
Side note: Sophos is worse than Fortinet. Its a vulnerability honeypot.

 

[r00igev@@r]

It's also difficult to monitor performance, uptime and to troubleshoot. A VPN using TLS 1.2+ and cert based mutual auth with strong ciphers is far more manageable, and can be chased through a WAF.

That is true. I think you being too kind. It has no inherent means to monitor performance, uptime and to troubleshoot.
Let us use a basic tool like ping. No, some wanker has disabled ICMP so that ends up nowhere as well.

 

[RonSwanson]

Ja ja. What about all those enterprise products that ripped the ring and made millions out of the volunteers who created log4j? Only bitched and moaned and didn't even give them a banzela for fixing it.
I'm using it already in product for DC meshing over VXLAN. Table propogation handled by Babel. It works.

I betcha no-one got fired for purchasing all those "enterprise products" though, and it was fixed quickly enough (yes, it took a few iterations) for them to maintain their ICSA certification, which is why its important, and raises the question: Would it have been fixed as quickly if it wasn't as pervasive in "enterprise products"?

 

[r00igev@@r]

I betcha no-one got fired for purchasing all those "enterprise products" though, and it was fixed quickly enough (yes, it took a few iterations) for them to maintain their ICSA certification, which is why its important, and raises the question: Would it have been fixed as quickly if it wasn't as pervasive in "enterprise products"?

I was being sarcastic. A certain large user of opensource paid for the fix and made some suggestions as well. But by far the significant number of those enterprise product vendors benefited from the ride.

 

[SauRoNZA]

Yes, I recall seeing Nebula, again impressive, but not ICSA certified, and that's what enterprise deployments want.

Never has anyone asked me about ICSA.

Not even once.

 

[clickingbuttons]

1) Buy two R600 mikrotik routers
2) Learn some firewall rules
3) ????
4) Profit?

 

[RonSwanson]

Never has anyone asked me about ICSA.

Not even once.

It's not a question that one would raise to a support techie, rather, it would be something than an enterprise architect would add to the specification sheet when considering new security kit, because it gives some degree of independent assurance that the product actually does what it says on the box, and that it has an adequate maintenance and support team behind the code / tin. It is also expensive, and ongoing, and in that way provides enterprise architects with some surety that the product wasn't just thrown together and put on Amazon by a fly-by-nighter with no-one to support it when they have a Log4J. Its absence does not mean that everything else is snake oil. There is nothing wrong an open-source strategy, as long as the organisation is geared up to support it, or has outsourced support to a competent and sustainable company.

I also rolled my own many years ago, and repeatedly for one particular startup. Same brief as the OP, the PHB said "Just get it done." It was a small struggling startup at the time, barely enough money to pay its staff, let alone money for new security kit. The risks were huge (and eventually realised once I had left).

 

[SauRoNZA]

It's not a question that one would raise to a support techie, rather, it would be something than an enterprise architect would add to the specification sheet when considering new security kit, because it gives some degree of independent assurance that the product actually does what it says on the box, and that it has an adequate maintenance and support team behind the code / tin. It is also expensive, and ongoing, and in that way provides enterprise architects with some surety that the product wasn't just thrown together and put on Amazon by a fly-by-nighter with no-one to support it when they have a Log4J. Its absence does not mean that everything else is snake oil. There is nothing wrong an open-source strategy, as long as the organisation is geared up to support it, or has outsourced support to a competent and sustainable company.

I also rolled my own many years ago, and repeatedly for one particular startup. Same brief as the OP, the PHB said "Just get it done." It was a small struggling startup at the time, barely enough money to pay its staff, let alone money for new security kit. The risks were huge (and eventually realised once I had left).

What if I told you I am said architect for a near 1500-employee strong enterprise with multiple offices all across the world and more coming.

And hence why I’m moving all our VPN and Firewall needs to CloudFlare.

By no means did I suggest roll your own, my point was rather thar WireGuard as a protocol is rock solid and with the correct expertise you could do it happily or simple pay to have it done for you.

That being said our current VPN solution is a roll your own OpenVPN based setup done by the previous regime.

With WFH my offices are almost disposable and I’m much more concerned with securing every end point fully.

Even if I did want to roll by own it’s not an issue as the entire company is very open source focused to start with and we don’t have Windows trash and the like anywhere in sight.

 

[RonSwanson]

What if I told you I am said architect for a near 1500-employee strong enterprise with multiple offices all across the world and more coming.

And hence why I’m moving all our VPN and Firewall needs to CloudFlare.

By no means did I suggest roll your own, my point was rather thar WireGuard as a protocol is rock solid and with the correct expertise you could do it happily or simple pay to have it done for you.

That being said our current VPN solution is a roll your own OpenVPN based setup done by the previous regime.

With WFH my offices are almost disposable and I’m much more concerned with securing every end point fully.

Even if I did want to roll by own it’s not an issue as the entire company is very open source focused to start with and we don’t have Windows trash and the like anywhere in sight.

Then you appear to be have the risks mitigated, so good luck with that.

 

[SauRoNZA]

Then you appear to be have the risks mitigated, so good luck with that.

We’ve fortunately always treated our offices are disposable and have literally no local infrastructure other than a network stack.

Which is why with WFH the ongoing licensing for Fortinet products grates my tits so much, but will phase them out soon enough and not roll them out at new offices.

 

[r00igev@@r]

Which is why with WFH the ongoing licensing for Fortinet products grates my tits so much, but will phase them out soon enough and not roll them out at new offices.

The only product with more backdoors than Huawei is Fortinet!
Security products cannot be secure when they have inherent risks like backdoors. Someone like ICSA say they test for it but they only test against a knowledge base of known ones where the vendor has been caught with their pants down. In reality any closed source product has that as a liability. The vendor can have backdoors without your knowledge and you have no way of knowing or any way to mitigate that risk.

 

[RonSwanson]

We’ve fortunately always treated our offices are disposable and have literally no local infrastructure other than a network stack.

Which is why with WFH the ongoing licensing for Fortinet products grates my tits so much, but will phase them out soon enough and not roll them out at new offices.

Sounds good, not many are in your position with such a tech-savvy workforce. It's a twin-edged sword though, and I am pretty sure that you understand what I mean by that

As long as you have the resources at your disposal to ensure that security of the infrastructure is constantly monitored and maintained, and that you budget for your security department's own assurance (regular operational monitoring reports on vulnerability management and SLA monitoring), and round it off with regular posture assessment (and mandatory annual pentesting for any internet accessible APIs), it should work out for you.
You will also need to plan for failure: in addition to a multi-person security organisation to take care of everyday ops, you need a CERT / CSIRT team with diverse skills and capabilities that can work around the clock at the drop of a hat on any reported issues. But, as you have stated, you have a geographically diverse and highly skilled workforce that you can leverage on to provide "follow the sun" security incident detection and investigative capabilities.

 

[RonSwanson]

The only product with more backdoors than Huawei is Fortinet!
Security products cannot be secure when they have inherent risks like backdoors. Someone like ICSA say they test for it but they only test against a knowledge base of known ones where the vendor has been caught with their pants down. In reality any closed source product has that as a liability. The vendor can have backdoors without your knowledge and you have no way of knowing or any way to mitigate that risk.

Moving to open-source software does not mitigate the risk of backdoors in any way. Even if you employ a team of software developers to constantly monitor vulnerabilities in open-source software (and all third party libraries, and let's face it: Who does that ), you will have the same net effect.

 

[SauRoNZA]

Sounds good, not many are in your position with such a tech-savvy workforce. It's a twin-edged sword though, and I am pretty sure that you understand what I mean by that

As long as you have the resources at your disposal to ensure that security of the infrastructure is constantly monitored and maintained, and that you budget for your security department's own assurance (regular operational monitoring reports on vulnerability management and SLA monitoring), and round it off with regular posture assessment (and mandatory annual pentesting for any internet accessible APIs), it should work out for you.
You will also need to plan for failure: in addition to a multi-person security organisation to take care of everyday ops, you need a CERT / CSIRT team with diverse skills and capabilities that can work around the clock at the drop of a hat on any reported issues. But, as you have stated, you have a geographically diverse and highly skilled workforce that you can leverage on to provide "follow the sun" security incident detection and investigative capabilities.

Yeah that’s what InfoSec is for.

 

[r00igev@@r]

Moving to open-source software does not mitigate the risk of backdoors in any way. Even if you employ a team of software developers to constantly monitor vulnerabilities in open-source software (and all third party libraries, and let's face it: Who does that ), you will have the same net effect.

Ok. I'll bite. Is there any example of a backdoor in a mainstream open source project. Anyone who tries has been caught.