Barracuda to replace Smoothwall

[FN-GM]

Hello,

 

I am considering moving to Barracuda to replace Smoothwall in our MAT. Has anyone gone down this path? If so, can you give some feedback please?

 

Thanks

[AlanD]

Because? What do you think is wrong with a smoothwall? (I have a list of things...just wondering if your list might match some of my niggles...)

[caffrey]

Interesting, never considered Barracuda - is it cheap ? I'm probably only in the market for filtering only now, off site solution seems a good idea too (MITM etc.) Is it worth considering opendium at all (seeing as it's more edu based) ?

[FN-GM]

Because? What do you think is wrong with a smoothwall? (I have a list of things...just wondering if your list might match some of my niggles...)

 

Support isn't good and account managers making promises they can't keep.

 

also....

 

Quite buggy

No IPv6 support

Poor Firewall - Can only provide basic firewall rules

Poor interface.

Can't send to secure SMTP - Not an option to send safeguarding reports in plain text!

Poor site to site VPN - have to setup a separate tunnel for each subnet.

The only dynamic routing support is RIP.

Documentation isn't complete

Requires to use their radius server for BYOD

 

Interesting, never considered Barracuda - is it cheap ? I'm probably only in the market for filtering only now, off site solution seems a good idea too (MITM etc.) Is it worth considering opendium at all (seeing as it's more edu based) ?

 

I haven't had any costings yet.

[Chipie]

CRAP, absolute rubbish, don’t do it, you will regret it. Promise you everything, deliver less than nothing. Cheap, there is a reason for that. 8 months of telling them there was something wrong with their kit, they promised they would escalate every time. When they finally changed it their Senior Technician couldn’t get it to work. In the end I managed to get it working, God knows how. Now if we need anything changing, I dread picking up the phone. I’ve told support off like a child for tutting at me down the phone. Over 40 hours of phone calls to them in the first 8 months alone. As compensation they offered us another year on top. WHY would we take another year of your awful service and rubbish hardware.

I’m happy for anyone from Barracuda to come back and fight their corner, but they won’t. They have ignored all correspondence about redressing this. Avoid like your job depended on it, because it will if you recommend them. Spread the work, share my post. You’ll have a headache that no tablets will cure.

 

Enough feedback? I can go on!!!

[FN-GM]

Thanks, although it sounds similar to my Smoothwall experience. I regret going down that route.

[Cache]

I looked at Barracuda a couple of years ago and the solution seemed good and it seemed to meet what we wanted.

 

Further digging however revealed that what we were being quoted for didn't include everything we needed such as SSL Inspection for example.

 

When we then pushed on this with a reseller they then moved on to offering an alternative solution such as Sophos as a better match to our needs. At the time we decided to stick with Smoothwall as the pricing at that point was still better for us.

[Wave9_Lee]

As expected +1 for Sophos UTM. If you need a demo or more info I'd be happy to help.

 

ref Barracuda, not much first hand experience. We used to see quite a lot in data centre load-balancing, but not much in the way of filtering/gateway. They've just been acquired by a private equity company, so expect some changes (good or bad - could be either)

[FN-GM]

As expected +1 for Sophos UTM. If you need a demo or more info I'd be happy to help.

 

ref Barracuda, not much first hand experience. We used to see quite a lot in data centre load-balancing, but not much in the way of filtering/gateway. They've just been acquired by a private equity company, so expect some changes (good or bad - could be either)

 

I posted on another forum about alternatives and you suggested Sophos even though it doesn't meet all our requirements...

 

http://www.edugeek.net/forums/internet-related-filtering-firewall/188989-smoothwall-alternative-suggestions-please.html

[Wave9_Lee]

This might be of interest - although has to be read in the context of an education environment. https://www.gartner.com/doc/reprints?id=1-43OJRBD&ct=170620&st=sb

[Wave9_Lee]

I posted on another forum about alternatives and you suggested Sophos even though it doesn't meet all our requirements...

 

http://www.edugeek.net/forums/internet-related-filtering-firewall/188989-smoothwall-alternative-suggestions-please.html

 

Hi, not sure Barracuda will meet all the requirements either. Most choices on these things are a compromise between features and budget and your priorities. Sophos XG will filter chromebook, but SSO is not 100% slick yet, but future releases should resolve this. Smoothwall requires a client to be installed I believe.

 

As i say, don't think there's a perfect answer to everything, and no doubt, as soon as there is, the requirements will change!

[FN-GM]

Smoothwall does require a client on the Chromebook, I have no issue with that as there is no intervention form the user. The same is for Barracuda. The Sophos solution means people will have to enter credentials to get onto the internet. That is a deal breaker for us, a large amount of the estate are Chromebooks.

[Arthur]

Sophos XG will filter chromebook, but SSO is not 100% slick yet, but future releases should resolve this.

Filtering Chromebooks and BYOD devices is easily one of the weakest aspects of the XG.

 

Unlike Smoothwall, it doesn't integrate with G Suite and it's not possible to use the XGs FQDN for the captive portal which means you can't get a TLS certificate from a public CA.

 

The following post will be two years old next month and Sophos still hasn't implemented what should be a standard feature...

 

https://ideas.sophos.com/forums/330219-sophos-xg-firewall/suggestions/11580213-captive-portal-fqdn-support

[synaesthesia]

So is this not relevant? (From that very thread)

 

"You may already set a custom fqdn and certificate for the captive portal, under System > Authentication > Authentication Services , then find the related settings in the Captive Portal section."

[caffrey]

Hrrm, is there actually anything that's decent out there, that doesn't cost an arm and a leg ?

[Arthur]

So is this not relevant? (From that very thread)

Nope! See Alan's response posted a day later.

 

[synaesthesia]

Ah gotcha. Bit concerned as it's looking likely to be our next solution.

[altecsole]

We moved from Smoothwall to Barracuda, mainly due to frustrations with promises for Smoothwall that never materialised and the increased cost when it came to renewal. We got a good deal on a Barracuda NextGen Firewall and Web Filter so took the plunge. So far we're happy. Having a separate firewall has been a big advantage over the Smoothwall UTM. It's a fairly steep learning curve so probably worth paying for a days engineer time when it comes to install. I'm happy to answer any specific questions if you have any.

[Wave9_Lee]

Smoothwall does require a client on the Chromebook, I have no issue with that as there is no intervention form the user. The same is for Barracuda. The Sophos solution means people will have to enter credentials to get onto the internet. That is a deal breaker for us, a large amount of the estate are Chromebooks.

 

Hi FN-GM, how do the chromebooks authenticate to the Wifi currently?

[FN-GM]

Hi FN-GM, how do the chromebooks authenticate to the Wifi currently?

 

Connected to the SSID via PSK and the Smoothwall plugin authenticates them for filtering.

[AlanD]

Hrrm, is there actually anything that's decent out there, that doesn't cost an arm and a leg ?

 

I don't think there is anything really decent - even when it does cost an arm and leg.

 

Partly its because firewall and filtering (and SSO and reverse proxy) all need to be closely integrated these days - because things like "allow Spotify" would require that you make changes in both what would be a traditional firewall and a separate traditional web filter.

 

...And filters will need to smarten up considerably - and be capable of DNS filtering and reporting ...because mobile apps and https are increasingly difficult to filter and report on with certificate pining and the like.

 

I know some advocate all these things need to be separate and managed separately - but I think that belongs to a era that has passed by...but sadly even the most expensive firewall/filters seem to be struggling to provide what users need..(actually I'm not sure they have bothered finding out what users need...)

 

Still with mobile operators giving away 20GB or more of data every month students won't want to use WiFi - or a desktop PC - because they will get much better throughout on their own device...and probably unfiltered too.