Firewall Recommendations Please

[interflex]

Does anyone have any recommendations on a firewall solution for a web server that receives about 1 million page views a month. I am leaning toward a firewall with a GUI Interface if possible. There are so many solutions I would like to get some opinions from people who have used several types and may have some good advice. Thanks

 

[Jpeanut]

That's a good question since I am looking at purchasing a couple new firewalls myself. To answer that question you have to be a little more specific in what you want your firewall to do.

...packet-level filter?
...application/proxy filtering?
...will you be using ftp as well as web serving?
...is this firewall your first-line firewall or an interior firewall?
...do you have a fixed budget to spend?

Then you need to do a lot of research on firewall architecture. Do you want a hardware firewall or software? Check-Point sits atop a Windows (if your are Win-based) platform. You should be concerned that Windows has recurring security updates. Also, CheckPoint has had several security vulnerabilities in the past. PIX has also, but not as many. Sidewinder, however, has no known vulnerabilities to date.

In general, use the web to collect some basic data on firewalls then call some vendors and get them to give you pricing and their sales pitch. From there just make out a list of pros and cons for your specific needs and make the best decision.

There is no single solution out there or everyone would be buying only that one.

 

[packdragon]

My company uses Sonicwall, a rack-mounted hardware firewall. It has a GUI interface, though I haven't used it yet (it was someone else's job). Support seems fairly good. When our firewall went bad for some reason, they sent a whole new one the next day.

 

[johnny99]

We have around 75 SonicWall's in different sizes (from TZ to Pro 330) and they work without any problem.
We use SGMS to manage them, but for a single site you don't need thins kind of software.
SonicWall's are stable and perform good, but they are "only" StateFull inspection firewalls.
If you need application level firewalls go for Nokia.
They also have great service and I would expect the biggest application level firewall installations use Nokia boxes.

We use Symantec Enterprise Firewalls (Raptor) for application level firewalls. Don't go for that. 5 years ago Raptor was great but that time is long gone.

/johnny