Filtering and firewall

[Marshall_IT]

Hi all,

 

We are looking at moving from a system fully managed by our lea to don't it ourselves.

 

I'd prefer a separate Web filter and firewall, but will consider a joint box.

 

We are a school of approx 1500 dissidents (ha, autocorrect of students) looking at deploying BYOD.

 

Can people tell me what you use and your experience please.

 

I've read the lightspeed vs smoothwall thread.

 

Does anyone user bloxx?

 

I can get a good deal on smoothwall which should make it around the same price as lightspeed.

 

Thanks for your help. (i'm looking for responses from schools not sellers right now , thanks)

[SchoolsBroadband]

Hi all,

 

We are looking at moving from a system fully managed by our lea to don't it ourselves.

 

I'd prefer a separate Web filter and firewall, but will consider a joint box.

 

We are a school of approx 1500 dissidents (ha, autocorrect of students) looking at deploying BYOD.

 

Can people tell me what you use and your experience please.

 

I've read the lightspeed vs smoothwall thread.

 

Does anyone user bloxx?

 

I can get a good deal on smoothwall which should make it around the same price as lightspeed.

 

Thanks for your help. (i'm looking for responses from schools not sellers right now , thanks)

 

+1 for Fortinet with Lightspeed here

 

Dave

[john]

I have a Smoothwall UTM-1000 in and have implemented BYOD on my network and its working brilliantly, infact my LA are also using Smoothwall so nearly all the schools in North Yorkshire are using Smoothwall for filtering (there are odd exceptions but even some of them are moving over). It has been a great product for us and I wouldn't be without it at all and certainly should I change schools I will miss it (so will have to buy it again!) as it just does as I want without fuss and just works its very rare I have to do anything to / with it which is a blessing in such a busy place.

[timbo343]

I am infact one of those schools that is moving from websense after 9 years to a smoothie in North Yorkshire as @john has mentioned. I too was looking at bloxx untill i saw the price and then saw the smoothie. I am still managing my own internet lines due to the cost of the lines but maybe thats for future discussions.

 

Our smoothie is going in next week and replacing our cisco firewall and our websense boxes. Fingers crossed, i will be able to do everything i want to do plus a lot more and hopefully it will bring us into the real world of filtering.

 

I considered having 2 boxes with keeping the firewall as the cisco box and having the smoothie along side it but then thought about the costs and whats the point of that if the smoothie can offer it all in one box.

[twin--turbo]

We will be looking at moving away from Websense for September 2014.

 

Smoothwal is on the list.

 

Bloxx , The name just makes me think it's missing an "O" and no good.

 

It's a big step to move though.

 

Rob

[Quackers]

We use Fortinet here (got a 200B) and i love it.

[RTFM]

We have smoothwall, think we are probably replacing it with a lightspeed filter and a sonicwall firewall.....money permitting

[GrumbleDook]

What do people think about whether to have a single integrated device or two devices to look at firewall and filtering. There seem to be a range of views on the site (and in this thread) and it seems to be a personal thing ... I have my own opinion but wondering about what others feel and why.

[staningrimsby]

Well I will be watching this thread with great interest as I to am looking at replacing the websense filtering and smoothwall is an option, at the same time I was also wondering wether or not to replace the Cisco ASA 5505 firewall or just leave it in place as its working fine.

[Marshall_IT]

I've had a quote and info sent through for a watch guard XTM which looks very good.

 

I'll compile I list with details of the solutions I have considered for people to look over if they want.

 

I see a few people leaving a Web sense and looking at smoothwall, but people on smoothwall seem to consider lightspeed.

 

Tony, I'd like to hear your opinion on the 1 box or 2 debate.

Edited February 15, 2013 by Marshall_IT

[rpmoore]

I've had a quote and info sent through for a watch guard XTM which looks very good.

 

I'll compile I list with details of the solutions I have considered for people to look over if they want.

 

I see a few people leaving a Web sense and looking at smoothwall, but people on smoothwall seem to consider lightspeed.

 

Tony, I'd like to hear your opinion on the 1 box or 2 debate.

 

I dont think that is entirely true. We have been up against Lightspeed quite a bit recently and in most occasions have won in a shootout. Depends whether you want the most effective web filtering, or a cheap 'swiss army knife jack of all trades' product

 

I am of course biased!

[RTFM]

I dont think that is entirely true. We have been up against Lightspeed quite a bit recently and in most occasions have won in a shootout. Depends whether you want the most effective web filtering, or a cheap 'swiss army knife jack of all trades' product

 

I am of course biased!

 

It's a good thing theres a lot of work being put into your firewall solution, otherwise people might acuse you of being a cheap jack of all trades solution

 

As it happens the Lightspeed filter is good, as is MBC and its MDM solution from what i've seen. They havent ventured into firewalls so at least they've left one 'tool' off the knife.

 

I'm not sure bashing each other's product is particularly worth while, people have their opinions and are entitled to them

Edited February 22, 2013 by RTFM

[mrbios]

What do people think about whether to have a single integrated device or two devices to look at firewall and filtering. There seem to be a range of views on the site (and in this thread) and it seems to be a personal thing ... I have my own opinion but wondering about what others feel and why.

 

Personally I believe buying them separately is best, two products designed for specific tasks opposed to one product designed to do them all. For example I've spoken to a number of people about "Product A" as a solution to both, they turn around and says "It's a wonderful filter, but the firewall is terrible in comparison to the competition" then go look at "product B" and it's the other way around.

 

In my experience people miss things when they want something to do both, and end up settling for the lesser product on one end, rather than getting the best product available to them. The difficult bit is working out what is best for you for both aspects

 

On another note.... got smoothwall, lightspeed and bloxx all coming to do presentations and answer technical questions in March, looking forward to grilling all 3 of them to finally work out what i want to go with as a filter.

[brainchylde]

We've used Bloxx for 8 years. It'll be coming to an end shortly and we will absolutely not be using them again. My discussions with others throughout the sector shows we aren't alone in our frustrations either.

[timbo343]

We've used Bloxx for 8 years. It'll be coming to an end shortly and we will absolutely not be using them again. My discussions with others throughout the sector shows we aren't alone in our frustrations either.

 

Are you able to say why you are coming away from bloxx?

[brainchylde]

Are you able to say why you are coming away from bloxx?

 

Support used to be fantastic and it's gone downhill.

 

I can no longer get reports from my unit and the reporting has been sporadic since it was installed some years ago. The performance of the unit has faltered. Initially we were told "well, you need a new one because you've outgrown this one" (after 2.5years of it being in place - they specced it!), until I finally managed to persuade a support technician to look at the database - he did some work on it and performance returned to normal. The functionality to port data to an external RDBMS has never worked.

 

If you gave me some more time, I could probably carry on but I'm afraid BLOXX, where as they used to be quite forward thinking and helpful have gone backwards as a company. We looked at Smoothwall and we wished we had used that.

[pettit87]

Just to high-jack this thread...is anyone using open source?

[Marshall_IT]

Just an update after various visits, Web demos and research.

 

All thoughts are my personal opinions and are subjective to my needs.

 

I have had a good look at the following devices:

 

Smoothwall

SonicWall

Watchguard

Lightspeed

Fortigate

Bloxx

 

I have narrowed it down to either SonicWall or Smoothwall a these seem to offer the most complete devices.

 

The Bloxx offering, while good seemed to lack something of maybe just concentrate too much on anonymous proxies. (maybe that was just the sales guys).

 

Watchguard, while offering most of what I was looking for, misses out on some key things like YouTube controls. Also the policy creation tool, while a good idea was a little clunky and the ui overall I seemed a little dated.

 

Fortigate was very similar to Watchguard in respect of features and ui. But seemed a little less powerful.

 

Lightspeed I didn't like the idea of a client install.

 

So, on to Smoothwall and SonicWall...

 

One has a better filter, the other has a better firewall.

Both say they are improving the areas the are behind in.

 

Smoothwall have said we should see an update to their reporting and Firewall sections in the next few months.

SonicWall said they are looking closely at improving the more school centric bits that were missing from their filtering.

 

Although SonicWall are used, so I'm told, extensively throughout education in the UK, this seems to be more colleges and universities. These institutions have very different requirements when it comes to filtering.

 

There is one last factor in my situation, which could be a game changer in the case of which I choose. That I might be supporting a number of primaries with their line and filtering.

 

If their connection is routed through our high school, we'd only need one UTM, if they connect directly to the Internet but we created branch VPNs, they would need smaller boxes which I could manage remotely.

 

More to come I think.

[mrbios]

Thank you for rounding up those opinions Marshall, while i will make my own opinions of 3 of those it's nice to have in depth opinions with reasoning on more products than I'm looking at

 

Out of interest are you able to expand on the problem areas of the smoothwalls firewall? Having met with a smoothwall representative I've been given their information regarding improving it but i have no experience of how bad and what is bad about it currently (I've heard it's very overly complicated and long winded to change settings currently?) Also have you ever used an ISA firewall to make comparisons between what you've tested?

[timbo343]

@Marshall_IT did you not consider websense? I have moved to smoothwall from websense but since you are evaluating most of the big players im surprised you didnt look at websense.

 

I must admit, come from websense to smoothwall was a big change for us on how we offer our filtering, a completely different way of thinking due to how their policies work, but anyway, after 2 weeks im starting to get to grips with it . Plus you can offer feature requests to smoothwall which is a nice customer service part imo.

[Marshall_IT]

Thank you for rounding up those opinions Marshall, while i will make my own opinions of 3 of those it's nice to have in depth opinions with reasoning on more products than I'm looking at

 

Out of interest are you able to expand on the problem areas of the smoothwalls firewall? Having met with a smoothwall representative I've been given their information regarding improving it but i have no experience of how bad and what is bad about it currently (I've heard it's very overly complicated and long winded to change settings currently?) Also have you ever used an ISA firewall to make comparisons between what you've tested?

@mrbios I haven't used an ISA firewall unfortunately.

I wouldn't exactly say the Smoothwall firewall was bad, just not good. It doesn't do layer 7 packet inspection get which is a major bonus to the SonicWall. As a basic firewall or heard Smoothwall good.

[Marshall_IT]

@Marshall_IT did you not consider websense? I have moved to smoothwall from websense but since you are evaluating most of the big players im surprised you didnt look at websense.

 

I must admit, come from websense to smoothwall was a big change for us on how we offer our filtering, a completely different way of thinking due to how their policies work, but anyway, after 2 weeks im starting to get to grips with it . Plus you can offer feature requests to smoothwall which is a nice customer service part imo.

@timbo343 I will look at websense, but have heard a few people coming from it.

 

Another major concern / requirement for me she ability to control bandwidth to websites and applications for certain groups and ip ranges. This is one of the areas that SonicWall out performed smoothwall.

[timbo343]

Websense was a good product but its worth a look even if you are ruling them out to see what they are offering. I know that for thw wsg, i needed their box , a server and an sql database and they couldnt work out their licensing.

 

That seems a good feature from sonicwall, maybe smoothwall might be able to do something similar

[mrbios]

@mrbios I haven't used an ISA firewall unfortunately.

I wouldn't exactly say the Smoothwall firewall was bad, just not good. It doesn't do layer 7 packet inspection get which is a major bonus to the SonicWall. As a basic firewall or heard Smoothwall good.

 

How about complexity? Was it easy to configure in comparison to the competition or a bit of a ballache?

 

Also i was told layer 7 features were a big part of what's being added in updates this year (I was told April but was also told that may not be 100% accurate) though i assume you've heard the same.

[john]

 

Another major concern / requirement for me she ability to control bandwidth to websites and applications for certain groups and ip ranges. This is one of the areas that SonicWall out performed smoothwall.

 

I'm sure @tom_newton said this was coming during the year.

 

The firewall is simple but effective but as has been said it isn't layer 7 at present