Web Filtering options

[TronXP]

Our Lightspeed renewal is coming up and I am wondering what other filtering systems people are using and would recommend.

[dpskinner]

Smoothwall has the biggest chunk of the market with Lightspeed coming in a close second. I have never used Lightspeed but I'm sure the differences cannot be that drastic. Best thing to do is head to BETT and gleen as much information as possible from the sales spiel. Don't forget, its not just the product but the support too. Smoothwall has a chequered past when it comes to support and it hasn't improved.

 

Best of luck

[Blue_Cookeh]

Sophos UTM has done wonders for us.

[ADMaster]

I use Iboss, I think they are in the UK market.

[MS2011]

Sophos UTM has done wonders for us.

 

Did you installed and configured Sophos UTM as virtual appliance or dedicated hardware box?

[MS2011]

Can anyone recommend if you are using SGFL/LGFL web filtering and on top implement smoothwall or Meraki or fortinet.

[Blue_Cookeh]

Did you installed and configured Sophos UTM as virtual appliance or dedicated hardware box?

 

When I was trialing it I used a Hyper-V VM which seemed to work just fine, but when I went live with it my intention was to get a firewall that would physically separate parts of our network so I went down the appliance route. At the end of the day the appliances Sophos provide are just supported Intel machines in a fancy box anyway.

[Achandler]

In my most recent review, I looked at Smoothwall (current provider), iBoss and Sophos. I had a mixture of success with each company.

 

Smoothwall started off at frankly shocking prices, so I invested a lot of time looking at the two chosen alternatives.

 

I can't comment much on Sophos because they were awful at getting back to me, took 2 weeks after the initial contact, then they went silent again despite me requesting a demo, didn't give pricing so frankly I gave up. This was enough for me to realise they weren't a good choice, if the sale people aren't much good at getting back to you, what chance did I have with support.

 

iBoss, I liked it, I have seen it before and the price was competitive and I went to see it in use at another school, it was only when I went to this other school that I had missed a fairly fundamental issue, that was it needed a seperate firewall, which for me meant more expense, which in turn made it cost more then Smoothwall (now bashed down pricing). That said it had a lot of very good features in there and I would recommend seeing it in use, if you already have a firewall in place then even more so!

[w00dy01]

We use a product called Iceni by a company called Opendium.

 

Definitely worth inspecting if you are thinking of swapping. They are cheaper than other companies out there and their support is fantastic.

 

We've had some custom fixes for us in the past which they made specially for us.

[sparkeh]

Recently went through this and ended up choosing Sophos UTM. (Smoothwall renewal was way too high).

 

If you want a demo perhaps go to a partner rather than through Sophos themselves. @Wave9_Lee arranged a demo with one of their knowledgeable chaps who answered all my (many) questions about what it can/can't do and how to do it.

Edited January 10, 2017 by sparkeh

[Areku]

we went with a simple protex local installation, (virtual appliance) able to do the SSL interception, AD based filtering, port based filtering, logging, yadda yadda.

only trouble is its still mostly list based updated by them, does some on the fly content filtering. but mostly its very cheap on comparison. (800 a year)

[Wave9_Lee]

+1 for Sophos. @Achandler, in my experience contact with vendors direct is almost always disappointing (no matter how good the product) They're too big, too busy or simply not geared up to deal with individual end-users. that's why resellers were invented

@TronXP, if you'd like some info and pricing for Sophos options, I'd be happy to help.

[Achandler]

I understand that and most vendors put you in contact to a reseller which is fine. My relationship with Smoothwall means I always get a reply from them within a day, that is all direct. iBoss were very quick to reply and answer questions before putting me in contact with a reseller who again was helpful. Sophos kept arranging calls that never happened hence I gave up, I appreciate they are busy but there is a limit to the amount of work I can put into something when someone seems disinterested.

[Net-Ctrl]

If you are down at BETT, iboss will have a big stand and can run through their solution with you in one of their meeting rooms. If you are heading down, we can book a meeting slot with them around your schedule. I just need a preferred time and day.

[TronXP]

I will not be at BETT, so not possible for any meetings there.

[AlanD]

After doing a ridiculous number of webinars and on-site trials we eventually decided on replacing our TMG box with Smoothwall to (help) meet the prevent strategy. It comes ready with categories for bullying, radicalisation, self harm etc - wheras most (all?) of the American/global solutions seemed unaware of exactly what the prevent strategy is asking for - in terms of monitoring but not necessarily blocking sites. And we also wanted visibility of Layer 7 and what apps are being used. To be honest I don't think Smoothwall has this covered - but neither do most other firewalls. Certainly no firewall yet gives anything like the visibility Meraki does with its wireless access points. No - its not cheap. But we wanted a better product for "prevent" - and we required load balancing between multiple ISPs (Virgin and Openreach) we wanted reverse proxy for our internally hosted sites ...and its ability to run DHCP and radius means that BYOD is simply a breeze to deliver without captive portals and other hassles (although smoothwall can cover that too). Whether its good value will now depend on how good their support is.

[tjames]

we have a bloxx box coming to the end of its contract, looking at this whats it like to use

[Oaktech]

I'd like to stick my head above the parapet and recommend Palo-Alto.

[Achandler]

Palo-Alto si meant to be good but was to expensive when we looked. iBoss was good as well but was to much when considering we needed a new firewall.

 

If I had a firewall already, I'd go for iBoss personally, as I didn't I went with Smoothwall due to costs.

[Oaktech]

Palo-Alto si meant to be good but was to expensive when we looked. iBoss was good as well but was to much when considering we needed a new firewall.

 

If I had a firewall already, I'd go for iBoss personally, as I didn't I went with Smoothwall due to costs.

 

I'm not going to lie, it IS quite expensive, but it is seriously feature rich, both as a firewall and as a filtering appliance, and your options are quite limited if you don't want to hobble a very fast connection. The Palo 3000 series and above are one of the few solutions that will inspect at wirespeed at 500-1kmbps.

[Achandler]

A 3rd party reseller. To be fair the price for iBoss was cheaper then Smoothwal (just), but I needed a firewall application as well. Also changing vendors over minmum price differences wasn't worth it

[Roberto]

Just to re-hash a similar post I made to a recent, similar thread:

 

We've recently completed an exercise in renewing or replacing our firewall and filtering solution.

 

We've chosen to renew our Sonicwall solution for another three years; there were several options that "ticked the boxes" for us but renewing the Sonicwall appeared to be the most cost-effective solution for us this time round.

 

I will say that I thought Smoothwall were both very good in terms of the quality of the solution and also very competitive on price. I also found Watchguard and the Sophos UTM to be quite interesting options alongside the Sonic and Smooth walls, and I daresay I'd have been happy with any of those four from a technical perspective as well as price.

 

I do think the solutions can be quite costly overall but this is a cost of functioning as an educational institute in today's online world. I certainly thing the cost of even the most expensive solution we looked at (and I'm talking about ones I've not mentioned here that quickly moved out of the running due to price) are considerably less than the cost of being the victim of data theft or many of the other security or safeguarding pitfalls these things help protect against.

[Opendium_Steve]

Can I ask for opinions on how folks budget for multi-year filtering contracts? if you take out multi-year contract, do you pay a year at a time, or the pay whole thing up front? And why do you do it that way (e.g. because that's just the way the supplier expects you to pay, because you get a discount, a preference for budgeting one way or the other within the school, or something else)?

[sparkeh]

Can I ask for opinions on how folks budget for multi-year filtering contracts? if you take out multi-year contract, do you pay a year at a time, or the pay whole thing up front? And why do you do it that way (e.g. because that's just the way the supplier expects you to pay, because you get a discount, a preference for budgeting one way or the other within the school, or something else)?

When we had the budget we would pay upfront. Usually we would be offered a better deal for upfront payment.

 

These days we simply don't have the money to do this, even if it makes sense over the term of the contract, we simply can't fund a big payment like that.

[Achandler]

We pay upfront to get the discount. The year of the web-filter renewal is planned ahead and we plan a lot less of any other non-essiential spending.