Testing alternative Firewall/Filtering products

[mdrabble]

I'm currently looking at alternative Firewall/Filtering products and some have VM versions available, so I can download and try.

 

My question is, how would you go about testing with another product in place?

 

In my office I have an edge switch, I am thinking of using a spare switch and server in the attach image config.

 

 

Then on smoothwall, set the IP address of the VMs user a transparent proxy and filtering exceptions - so Test VMs are then basically doing the filtering etc......

 

Does that make sense and should that work?

 

Cheers

[robyholmes]

How does your Smoothwall connect to your ISPs router? Could you install a switch between, or send it via your core switch on a VLAN which your Smoothwall and VM firewall/s can use. Edited November 15, 2023 by robyholmes

[mdrabble]

How does your Smoothwall connect to your ISPs router? Could you install a switch between, or send it via your core switch on a VLAN which your Smoothwall and VM firewall/s can use.

 

I do have a switch between smoothwall and router as the switch also connects the failover connection.

 

I did consider that, but then would have to create a new vlan with different gateway routing addresses - as all but BYOD vlans use core switch as gateway before going to smoothwall.

 

Plus, I would have to set and external IPs on the test VMs - as they would then be exposed directly to to the internet.

 

Unless I am overthinking things......

Edited November 15, 2023 by mdrabble

[Net-Ctrl]

Hi Mark - in case it helps some manufacturers run these report based exercise where you have one of their solutions in listen-only mode to record data and report on what they see that the existing firewall may have missed. I know Palo Alto does one called a Service Lifecyle Review (SLR) and Fortinet run the same sort of thing and call it a Cyber Threat Review (CTAP) - I am sure others do similar.

 

Could be an option to compare/contrast.

[Joeloman]

To be able to do real tests, you need to test directly against the Internet.

No problem if you have several IP addresses from your ISP, otherwise have a chat with them if they can lend you one temporarily..

 

Then you should consider that the external IP address Smoothwall uses today probably has much more hacking than a new address will have, so also look at that type of reports.

Don't forget to then temporarily turn off Geoblocking in Smoothwall (extremely good feature) for a while before creating the reports, as Geoblocking only drops all requests from the countries/regions you selected.

 

Then you use the same internal IP-range, etc. like on your Smoothwall and first test with just a few computers and then lift over the entire Vlan when you want to test sharply.

 

 

If you are not yet using Smoothwall Cloud Filter, we recommend that you use it even if you run another firewall.

Edited November 15, 2023 by Joeloman

[Joeloman]

When looking at different firewalls, you should make sure they have good features that will help keep your students safe.

Layer 7 Application Classifications and blocking

IDS/IPS

Geoblocking

Failover function in case of hardware failure

Possibility of having several ISPs and fail over so that teachers etc. can get on the Internet even if it's only 4G

Secure DNS which Google and others have

Good and simple VPN if you have local resources

Auth. of users via Google/Azure so that users only access what they should have access to

Time server -In case of hacking, it is extremely important that all logs show the correct time

 

Then it may not be a requirement, but it has speeded up surfing a lot.

Internal DNS server, extremely good function that takes care of caching the DNS requests and only sending the local requests to the local DNS server.

Then try using Cloudflare DNS which is free 1.1.1.1 and then compare with Google 8.8.8.8 and 8.8.4.4 and your ISP if they have Secure DNS.

 

With Smoothwall, it is quite common to skip the Core switch and let Smoothwall manage all routing and authorization, often requiring many good network cards and a fast server, but easier to just manage the network in one place.

I think it's hard to find a better firewall for school environments at that price.

Edited November 23, 2023 by Joeloman