New Web Filter and Firewall for School

[Edu-IT]

What about Bloxx, they any good these days?

I believe so from what I have heard from users, but, it's still quite expensive by comparison.

[mrbios]

I believe so from what I have heard from users, but, it's still quite expensive by comparison.

 

It's frustrating looking at the different options, lightspeed, smoothwall, bloxx, iboss, sophos UTM. Had a look into the latter two this evening and not one of those products really excites me as a technological leader that'll do everything i want (If i even knew what everything i wanted from a filter was ) I think I'm going to have to do some proper trials after christmas and test the lot...That'll keep me busy.

[RichCowell]

It's frustrating looking at the different options, lightspeed, smoothwall, bloxx, iboss, sophos UTM. Had a look into the latter two this evening and not one of those products really excites me as a technological leader that'll do everything i want (If i even knew what everything i wanted from a filter was ) I think I'm going to have to do some proper trials after christmas and test the lot...That'll keep me busy.

 

If you're looking after Christmas, Sophos should have released the new version of their firmware, completely rewritten following their latest acquisition (the name escapes me)... I'm really looking forward to that as it sounds like it's gonna be even better than it already is...

@mrbios / @Techdw I can put ANME membsrs in touch with someone at Sophos... If you fancy joining I'll send you his details :-P http://www.anme.co.uk/join

[Oaktech]

It's a pretty expensive option, but it covers all bases, and once you're in a support contract it is totally unlimited, and that's a Palo Alto. It's brilliant firewall and and a very handy filter with full packet cracking capability. I've not met anyone using it that would consider anything else. Given its price tag, it mainly makes sense in a larger deployment though.

 

I've installed a few of the Sophos UTM gateway software appliance in people's homes and it is very good - for the home one it's free which is excellent, the professional one is not cheap, but it is good value and easy to live with.

[mrbios]

It's a pretty expensive option, but it covers all bases, and once you're in a support contract it is totally unlimited, and that's a Palo Alto. It's brilliant firewall and and a very handy filter with full packet cracking capability. I've not met anyone using it that would consider anything else. Given its price tag, it mainly makes sense in a larger deployment though.

 

I've installed a few of the Sophos UTM gateway software appliance in people's homes and it is very good - for the home one it's free which is excellent, the professional one is not cheap, but it is good value and easy to live with.

 

I wanted a palo alto firewall last time i was looking, had i not ended up going for the schoolsbroadband package deal i'd have likely gone down that route, but i didn't see it as much of a filter? It seemed pretty basic on that front from what i'd seen of it 2 years ago. What can it do as a filter that some of the big players in the filter market can?

 

I'm feeling a little cautious about going down the route of a firewall and filter in one product, i see the two as quite specialist tasks with their own jobs to do, i feel that if i buy a filter i want to know that the company selling it is making it their sole goal to improve and expand on it rather than being distracted away by the firewall market. Does that make sense or am i overthinking it perhaps?

 

@RichCowell I've signed up Not too fussed about details just yet though (there's a good few months to go before i get into this )

[RichCowell]

I'm feeling a little cautious about going down the route of a firewall and filter in one product, i see the two as quite specialist tasks with their own jobs to do, i feel that if i buy a filter i want to know that the company selling it is making it their sole goal to improve and expand on it rather than being distracted away by the firewall market. Does that make sense or am i overthinking it perhaps?

 

@RichCowell I've signed up Not too fussed about details just yet though (there's a good few months to go before i get into this )

 

I was concerned about that initially, having always had them separate before I got the UTM, but it's not been a problem at all... We use Impero for filtering too, so you've always got that option as well as I've just seen you've got that too... Most members that have Impero too have put that down as either their primary or secondary filtering method, so it's a popular choice... I don't think having the firewall and filtering in one solution is an issue, certainly not with the UTM...

 

Thanks for joining :-) I'll send the info anyway, and a (rather long) email that was sent to members yesterday...

[Wave9_Andy]

I've used the Sophos UTM / Security Gateway for several years now, and can't recommend it highly enough, it's been fantastic and coped with everything I've thrown at it...

 

Happy to talk more about it if you want to PM me...

 

They do a free full software based version for home use, so you can download it and have a good look before deciding...

 

Here at Wave 9 we are a Sophos Partner specialising in Education. Our background was Cisco but we really rate the Sophos UTM product from a cost / function / feature / manageability perspective.

 

It's a key part of our overall Education ISP service but we are also seeing customers with existing LA / RBC internet connections, that are not yet able to cancel, move to a Sophos UTM as a first step in readiness to procuring a direct internet connection.

 

If anyone would like any info or example pricing then please do let me know.

 

Andy

Edited September 10, 2015 by Wave9_Andy

[Oaktech]

I wanted a palo alto firewall last time i was looking, had i not ended up going for the schoolsbroadband package deal i'd have likely gone down that route, but i didn't see it as much of a filter? It seemed pretty basic on that front from what i'd seen of it 2 years ago. What can it do as a filter that some of the big players in the filter market can?

 

As far as I can tell the only thing it doesn't do is have an automatic 'education' block list, it blocks by category and by application type and you can add in whatever else you want as custom lists - when we left SWGFL we exported our custom block list that we'd built up over 10 years (some 20,000 entries) and imported it straight in as a custom blacklist.

 

It did everything our 3000 user MAT needed!

[carvjo]

For anyone that is unhappy with Smoothwall or Lightspeed, it would be well worth looking at iboss.

 

I agree.. iBoss is very good..

We had Websense and scrapped it - we trialled Barracuda, it was OK but Support was difficult - iBoss worked better, was easier to use, had the features we wanted for BYOD and Support is excellent.. We bought an iBoss device..

[SchoolsBroadband]

Firmly agree, if I am paying for a product on a yearly contract then included in that agreement should be unlimited support. If I purchase a product on a one off payment then extended support should be chargeable.

 

Many different companies offer different support levels for the products they sell and charge accordingly. However its pretty bad if you're told the price is X but then you find its actually Y once you've signed an initial contract.

 

As a supplier to many of you on here I can cast iron guarantee we are not changing our model of support. its 100% included. Call as much as you like and we won't charge you any extra

 

Dave

[plexer]

Here at Wave 9 we are a Sophos Partner specialising in Education. Our background was Cisco but we really rate the Sophos UTM product from a cost / function / feature / manageability perspective.

 

It's a key part of our overall Education ISP service but we are also seeing customers with existing LA / RBC internet connections, that are not yet able to cancel, move to a Sophos UTM as a first step in readiness to procuring a direct internet connection.

 

Sophos certainly does well in the latest Gartner magic quadrant for UTM devices, top right

 

Ben

Edited September 10, 2015 by plexer

[SchoolsBroadband]

its gartner in case you googled it

 

you can find the result here. Fortinet is the most top right which is one of the reasons why we use it

 

Gartner UTM MQ 2015 | Fortinet

 

Dave

[plexer]

its gartner in case you googled it

 

you can find the result here. Fortinet is the most top right which is one of the reasons why we use it

 

Gartner UTM MQ 2015 | Fortinet

 

Dave

 

Didn't google just misspelled

 

Ben

[plexer]

@Dave, but your SWG of choice appears to be missing from the Gartner SWG Magic Quadrant

 

http://tinyurl.com/pjowv4a

 

I don't quite understand what you're saying as one is a magic quadrant for utm's which the Fortinet is classified under not web gateways as it's not a single application product.

 

Ben

[rpmoore]

I don't quite understand what you're saying as one is a magic quadrant for utm's which the Fortinet is classified under not web gateways as it's not a single application product.

 

Ben

 

Hi Plexer, I was tongue-in-cheek heckling Dave who provides filtering via Lightspeed, which is an SWG product.

 

[/url]

 

Richard

[SchoolsBroadband]

yes lets not get into a flame war or anything all good banter

 

Dave

[plexer]

Hi Plexer, I was tongue-in-cheek heckling Dave who provides filtering via Lightspeed, which is an SWG product.

 

[/url]

 

Richard

 

Ah I see no probs thought there was confusion over the fortinet

 

Ben

[jfairbairn]

We are a small secondary school (630 Students / 75 Staff) and we use Iceni from Opendium

 

It's a great system for a good price, we've been with Opendium for nearly 5 years now and it was one of our best decisions.

 

Most of our users have at least 2 internet connected devices (we allow BYOD), with our staff having at least 3, the iceni copes easily with those numbers.

 

The guys at Opendium are very knowledgable and approachable, everything is tailored to your system, network or in our case, strange technical nuances.

One thing that really sets Opendium apart from their larger contemporaries is that when you call their support number, you can speak to someone who really knows what they're talking about and 9 times out of 10 will resolve the issue during the call, truly awesome.

 

If you are thinking of changing you filter/firewall etc, definitely give these guys a call (and feedback to this thread and let people know your thoughts).

[gshaw]

We're trialling Smoothwall, currently on Bloxx, heard of iBoss but only recently spotted you @Net-Ctrl as a UK supplier of it. Does it have a) multiple NICs and ability to run two gateways b) bridge mode support c) social media filtering on outgoing posts and d) support for RADIUS auth?

 

So far only Smoothwall and Bloxx have matched that list but a third option would be useful...

 

For anyone considering a Palo Alto and has the budget for it, get one as they're awesome bits of kit. I'd say the web filtering is business grade rather than education focussed though so probably still need a separate filtering product alongside.

Edited September 11, 2015 by gshaw

[mrbios]

What's your thoughts on bloxx @gshaw? expensive i imagine but as a solution is it quite robust? If you happen to be testing both smoothwall and iboss i'd be interested in hearing your findings on the two solutions when your testing is done

[markwilfan]

We wanted to trial iboss but nobody could lend us an appliance. Sophos let us install our own vm. Smoothwall helped us install a vm and configged if for us remotely foc .

 

Went for smoothwall in the end. Good product and got 4 years for 3.

 

With regard to support can't fault them at the moment. And they provide you with training materials which are pretty good

[markwilfan]

I was very disappointed too. We'd had a demo by iboss and it looked awesome. Will ask the boss who he went through.

[mrbios]

I have a stack of boxes here that I am happy to lend out to anyone.

 

I've made a note of that for the future

[minimoo]

a) iboss uses a Layer 2 bridge rather than a proxy. This gives an enormous speed advantage, as well as allowing the product to scan all TCP and UDP ports (where malware and rogue apps such as TOR and Ultrasurf often hide). Our appliances support multiple NICs to cater for your dual gateways.

b) As a native bridge, iboss is the only product that is then able to automatically direct traffic onto an internal proxy for SSL decryption by category without needing Proxy.pac files installing on your client machines.

 

@rpmoore Maybe I'm confusing technology here, but I run a watchguard firewall on site, do SSL inspection for https - this does not require proxy.pac files or a proxy configured on the PC, as it does it transparently - or are you saying that the difference here is, the transparent proxy only works on known port numbers, whereas this would work on any?

 

In any case, in a school, i suspect that people after SSL decryption probably are normally after seeing traffic hitting HTTPS ports only as i'd assume they are likely to have locked down other ports in some way.

[kearton]

Sophos should have released the new version of their firmware, completely rewritten following their latest acquisition (the name escapes me)

Is this Cyberoam, @RichCowell ??