Alterative to Smoothwall

[Tech13]

Hello good people of Edugeek,

 

I am researching possible alternative's to Smoothwall Firewall and Filter for our Trust.

 

Hit me up with your suggestions!

 

Thanks

[RLR]

We moved away from smoothwall a long time ago and have been with fortigate (400F atm) ever since.

[lmrogers]

I highly recommend a Fortinet solution, it is really good if you also invest in their full system for switching and wireless as well. You get full single pane of glass management and does a really good job.

 

I would however always say it is worth using FastVue Reporter on top of the firewall for safeguarding reports and alerts.

 

Also give @Wave9_Lee a shout and he can advise and give you some decent offerings as well.

 

100% would always move away from Smoothwall though.

[RobFuller]

We are also currently reviewing our Smoothwall Firewall and Filtering also as our license renewal in due early next year.

 

My initial thoughts where to look at a more industry standard HA firewall setup and separate Education focused filtering solution. I would be interested to hear if people do the same or feel there Firewall / other solution covers everything they need from protection on/off-site and KCSIE standpoint?

[lmrogers]

We are also currently reviewing our Smoothwall Firewall and Filtering also as our license renewal in due early next year.

 

My initial thoughts where to look at a more industry standard HA firewall setup and separate Education focused filtering solution. I would be interested to hear if people do the same or feel there Firewall / other solution covers everything they need from protection on/off-site and KCSIE standpoint?

 

I've got an Industry standard HA setup with a pair of FortiGate 200Fs and they are working brilliantly. The filtering works and you can filter and secure as you normally would against categories and you can also re-categorise and create custom rules as you would expect. The only difference I found was the need for some better reporting and that is where FastVue came into play. It has integrations with various industry standard firewalls and is able to pull out all the safeguarding reporting that you would need.

[Tech13]

Thanks for all the comments so far.

 

We are of a similar thinking, the issue we keep coming back to is the requirements to ensure Safeguarding is effective and I feel that some of the Industry standard offerings are less focused on education so don't cover the key standard and I can only see Smoothwall that does this.

 

I've had a look at Lightspeed and they do a similar offering to SW but no Firewall (Budgets are tight!)

[RobFuller]

@Tech13 similar to you I feel just a firewall alone doesn't cover the filtering requirements I need.

The "cloud" offerings from Smoothwall and Lightspeed cover us for off-prem devices also which I feel is also beneficial plus means I can scale down the hardware requirements of the firewall as I don't need to do such intensive SSL inspection inline. This activity massively reduces throughput on Firewalls, I would prefer closer to line speed as we have multi gigabit connection. Also, we are slowing seeing an increase in websites monitoring for MITM activity and we end up needing whitelisting these.

[TechMonkey]

I've looked at Smoothwall alternatives a couple of times in my Education career and my biggest concern is always the lack of Education focus from alternatives. This is validated by the number of times something is posted on here that needs filtering and when I check it is either already in a filter list or is caught by content filtering. Education filtering is very different to corporate filtering. I'm not saying this is a reason not to go with other options, but our time is precious and a limited resource, so anything that saves me time is a winner in my view. I don't think the lists provided by Smoothwall can be overlooked as a massive feature and benefit.

[mrbios]

I moved from Smoothwall a year and a half ago to a pair of Sophos XGS3300 appliances in HA. Both appliances and 3 year contract, plus they threw in the secondary power supplies for both units for free, were cheaper than just the license renewal alone for Smoothwall.

 

I "DIY'd" it and set everything up myself, then had a sanity check by a Sophos engineer to ensure everything was setup right. However Wave9 do a managed and supported install, which i would recommend if you go down the Sophos route....as it was quite a big learning curve coming from Smoothwall. Fortunately for me localzuk and bkgarry were both big helps and put up with my many questions on discord as i got to grips with the STAS setup.

[RobFuller]

I moved from Smoothwall a year and a half ago to a pair of Sophos XGS3300 appliances in HA. Both appliances and 3 year contract, plus they threw in the secondary power supplies for both units for free, were cheaper than just the license renewal alone for Smoothwall.

 

I "DIY'd" it and set everything up myself, then had a sanity check by a Sophos engineer to ensure everything was setup right. However Wave9 do a managed and supported install, which i would recommend if you go down the Sophos route....as it was quite a big learning curve coming from Smoothwall. Fortunately for me localzuk and bkgarry were both big helps and put up with my many questions on discord as i got to grips with the STAS setup.

 

Are these setups active/passive, saving on the additional licencing compared with active/active? Do you mind if I ask if you went Xstream Protection or Standard, if so why?

[mrbios]

Are these setups active/passive, saving on the additional licencing compared with active/active? Do you mind if I ask if you went Xstream Protection or Standard, if so why?

 

Active/Passive.

 

Xstream protection, if im understanding right, is their name for their newer non-proxy style packet inspection right? If so, I'm still using the old web proxy method for the time being. I did see a guide about using both in tandem, fully intend to set it up at some point (but you know how these things can be....at some point turns into never very easily) we do have the zero day protection license though. That seems pretty good, it ticks over in the background scanning executables and zip files, seems to do some sort of sandbox testing of each one, then blocks or allows it based on what that sandbox experiences.

 

Biggest negative compared to smoothwall though, is the dynamic content modification. Smoothwall has a whole section for it with some cool stuff you can do, whereas Sophos doesn't really have anything similar.

[Wave9_Lee]

Active/Passive.

Xstream protection, if im understanding right, is their name for their newer non-proxy style packet inspection right? If so, I'm still using the old web proxy method for the time being. I did see a guide about using both in tandem, fully intend to set it up at some point (but you know how these things can be....at some point turns into never very easily) we do have the zero day protection license though. That seems pretty good, it ticks over in the background scanning executables and zip files, seems to do some sort of sandbox testing of each one, then blocks or allows it based on what that sandbox experiences.

Biggest negative compared to smoothwall though, is the dynamic content modification. Smoothwall has a whole section for it with some cool stuff you can do, whereas Sophos doesn't really have anything similar.

 

 

 

Standard protect is good for most users (base licence, network protection, web protection) Xstream licences adds Zero day protection (sandbox) and Central Orhcestration, which makes config and management of SDWAN easier. There are a couple of add-ons available, webserver protection, mail protection, but these are used less these days - comparison here; https://support.sophos.com/support/s/article/KB-000038005?language=en_US

 

 

I think many of the solutions discussed on here and in the 'education' market will do the job compliantly and effectively - Personally think that the level of expert advice/support and ongoing responsiveness is getting more important as systems become more complex, requirements change etc (as well as price obviously!)

 

cheers

[Aprice]

Recently had a demo with Impero for ContentKeeper, which seemed pretty solid especially from the KCISE perspective.

[MatthewL]

Watchguard.

[LS-ShaunPhilllips]

Please feel free to reach out if you would like to disucss Lightspeed Filter and Lightspeed Alert - Book Meeting Here

 

I'm also speaking at the Schools & Academies Show on 22nd November where I'll be Unpacking Filtering and Monitoring in KCSiE 2023.

 

Have a great weekend

 

Shaun.

[SchoolsBroadband]

Being a Fortinet partner and protecting about 2,500 schools and some of the largest MATs in the UK with it then we'd obviously recommend Fortinet, Fortinet and more Fortinet

 

We can offer our hosted service which you rent space on or physical boxes. All Fortinet onsite boxes also come with SD-WAN included as well as additional functionality such as Sandboxing, Internet of compromise etc.

 

More than happy for a Fortinet NSE certified tech to give you a call to discuss if you'd like?

 

Cheers

 

Dave