1

Hi all.

We currently have an ISP supplied firewall that includes an OpenVPN client for remote access. While the OpenVPN client works decent enough, we are going to be switching ISPs very shortly, which means this OpenVPN client is no longer going to be available to us.

I was interested in the Barracuda SSL VPN, but it looks like they aren’t selling it anymore.

That leads me to my question: What make/model firewall/VPN do you guys use? We have about 150 users, of which only about 40-50 will need access to the corporate network from home, etc.

We are looking for something that is going to be fairly easy to setup, easy to use, up-to-date (read: not going to be EoL in 2-years), and most of all - SECURE.

I was looking at the Cisco ASA 5508-X with FirePOWER, but I’m not sure if it’s overkill for our environment or what. It seems like the price varies quite a bit amongst the different websites I’ve been viewing, which has me a bit concerned that the cheaper priced options are missing something that is of key-importance, such as a Cisco warranty and/or support options.

And while the new ISP will likely supply us with a firewall and all of the necessary routing between our 3 branch locations, I have a feeling that’s where their part in this would end.

Even if the new ISP includes some type of VPN client, I’m now hesitant on using it. I don’t want to be at the ISPs mercy if we move to a different ISP down the line, then have to switch everyone over to a new VPN client and show them how to use it, etc.

Any help/insight would be appreciated.

11 Spice ups
2

In my most humble opinion if you aren’t already sure which Firewall to use then you re open to suggestions. I will simply say SOPHOS SG/XG or UTM. They all check off the boxes and are extremely user friendly so you spend much less time trying to configure. Definitely worth a look. We have used them about 7 years now and have no desire to go back to CISCO.

3

I’d second that, plus one of the VPN options is a customized OpenVPN client so there is some familiarity there

4

Cisco isn’t the leader in the security world anymore, and hasn’t been for a few years AFAIK. Industry leader now is Palo Alto but their firewalls are not any cheaper. If like most SMBs you’re looking for simplicity, low-cost and upgradability (read: non-proprietary hardware) I would highly recommend Untangle NG Firewall (it’s really a UTM). That or pfSense which is just as full featured and perhaps lower costs, but not as user friendly or simple. They also have support available via NetGate.

5

Untangle UTM fully supports OpenVPN by the way - you might even be able to export/import your config, then just update the IPs.

6

My Barracuda firewalls have their own native VPN Client in them. The one I am talking about is an inherent part of the firmware on the NG firewall product line. It works quite well for me and my colleagues and the dozen or so users we have given to clients. I am sure this is not separately licensed. The VPN client software is branded with the word “NAC”.

Works wonderfully for me to do my job – reach work or the data center network. What I can’t do with it is connect on my iphone or tablet through an app. Don’t need to do that. I don’t use PPTP or L2P since both of those are deprecated and not best practices any more.

I am not sure on the particulars of the Barracuda SSL VPN that you mention since what I know of as the Barracuda SSL VPN client is a separately licensed thing which I don’t have licensed. The firmware let me connect with one user for demo purposes, but further users is a new license. At one time their branding included the word “cuda”.

7

Point of advice: if you switch ISPs, your public IP will change - if your VPN is configured with a static IP, you’re going to have to touch each client anyway. (You can probably use DNS/subdomain to get around this)

8

DNS won’t help, because all the certs will have to be replaced as well.
So there will be no way around ‘touching all clients’.

The rest of the initial question - any firewall is better than no firewall. The problem is if you want more than ‘better than nothing’.

The responses already started to get expressions of what one individually likes or dislikes. Just in the few answers, there were some products listed as ‘recommendation’ or even ‘best’. More replies there would be, more products wold start competing for the position of ‘the best’ and 'most recommended product or solution.

So when you once understand, that everyone has his own favorite and best solution, you need to start figuring out, what you would expect from a solution to be YOUR best. Than start discovering, what solution comes closest to that.

Regarding VPN connectivity. Be aware, that some vendors charge separately for VPN client licenses, while others include a reasonable number of clients in their base package. Sometimes the cost for VPN client licenses is not trivial!

9

Thank you all for your insight. I appreciate it!

I will look into this further now that I’ve received some input from REAL people; not SALESPEOPLE :slight_smile:

2 Spice ups
10

We’re talking about UTM’s, not firewalls. Yes, yes… all UTM’s include a stateful firewall, but it’s the other features we’re interested in.

Which one is “best” can not be determined without the OP comparing all contenders against his/her requirements list. That list should be developed from the mitigation plan that is part of a thorough risk assessment.

You need to know that treasure you have, what the threats to it might be, what vulnerabilities exist that might be exploited by those threats, and from that “how bad would it be” if an attack succeeded. With that perspective, you develop your mitigation plan, where the plan references UTM functionality, add that to the shopping list.

I submit that what you’re likely to find is that traditional perimeter defenses are less important than other measures. Sure, you need a stateful firewall, and good content filtering is nice to have, but user endpoints are the new perimeter. Every one of the three incidents we’ve had so far this year were promptly mitigated through a combination of user awareness and robust tools for monitoring/controlling the activity on those endpoints. Our UTM never made a peep, nor, I suspect, would any other brand.

All of this is a roundabout way of explaining that “best” is far from a straightforward definition. For us, SOAR support is a critical feature, precisely because we look harder at things happening “inside the wire”, and want to be able to automate a response which, typically, is taken on the UTM. Our current UTM’s API capabilities are virtually non-existent. If we were shopping it today, that model would not make the list.

So back up, do the work, and come back with something like “What UTM has the best , and ?” The value you get out of any subsequent purchase will be significantly higher.

1 Spice up
11

Never, ever, EVER trust sales “engineers” - they are looking out for their best interests, NOT yours! Always DYOR! #DYOR

2 Spice ups
12

A couple years ago, I was in a similar position.

We owned multiple Cisco ASAs but needed something “more”.

I wasn’t even exactly sure what that “more” was & trying to wade through the different Firewall/UTM device manufacuter’s hype gets really old, really fast.

1.5 years ago, I moved to a new position with a different employer. They already had a bunch of FortiGates in place.

It’s unbelievable the ease of use & configuration of these.

The VPN client includes AV. That’s pretty cool.

Now, I’ve not used the Barracuda or Sophos or any other UTM, but I imagine they are all very similar in feature offerings and ease of use.

No matter which you decide, try to get some demos from the vendors & talk to SpiceHeads about pitfalls/drawbacks for the devices you’re thinking about.

1 Spice up
13

You mentioned you do have a firewall that was provided by your ISP. If you are satisfied with it why not try to get the same firewall since you are already familiar with it.

14

Hi Sean,

Its easy to try an ASA for free and see what it is like. You will get a Security scan report also free.

Just use the form below if this fits for you.

Take care,

Craig

@seangitter8950

15

If you are looking for VPN for your users and to be secure, then you should take a look at Sophos RED devices https://www.sophos.com/en-us/products/next-gen-firewall/add-ons.aspx . It is HW client for small homeoffice, config done on firewall, all users needs to do is to plug device. Maybe it is overkill for you but you can take a look at it. Nothing to do with ISP, nothing to configure on PC. You can move around the way you want, they always will “come” to you :-).

We do recommend these for secure home offices where people are connecting to these devices over cable. They also come with Wifi variants where you also control this Wifi from your firewall.