In-Reply-To: <20050329160330.16983.qmail@mail.securityfocus.com>
Right... By now you may have have tested all suggested Open Source firewalls by
installing all flavours of OSses on old(er) systems and configuring them to act
as firewalls. I'm sure you also spent countless (?) hours on researching solid
state (ASIC-based) firewalls in your quest for ***the best*** under $700
firewall.
How's that working out? Anything to share?
All kidding aside, you allready have some experience with Sonicwall, and as
allready stated by Mike Etheridge, you should just stick with one of those.
They're good little solid state firewalls, with deep packet inspection (upto
layer 7 with the comprehensive IPS/Anti Spyware/Anti Virus option), rock solid,
and easy to configure/maintain.
Just remember to choose one that fits your requirements and configure it as
strict a possible. Also remember that a firewall, even one with IPS, is no
excuse for not patching systems, especially IIS (allthough with the IPS threats
can also be averted).
In the lower end Sonicwall models you get up to 5000 "in the wild" AV
signatures; for IPS that is about 2000 I believe. Pro models (outside your
pricerange) have upto 25000 AV signatures.
Remember, having gateway AV is no excuse for not having host and client based
AV solutions. And ISP still requires you to patch your hosts.
I you've allready chosen another firewall dont sweat it, if you kept the
receipt I'm sure you can exchange it for a ... nah, just kidding, you'll be
fine as long as you configure it as strict as possible, and do use egress rules
as well, but you allready know this from Chris Buechler's "rant".
Regards,
George.
Oh, and do monitor your webserver like a hawk, do check and analyse the logs
(event/iis/firewall).
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
