Yo Dawg, I heard you like firewalls...

striker090871 · 2014-08-29T17:11:34.000Z

OK, so I’m working with a network vendor to replace our current ISP, and they offer a managed/monitored network service that includes a firewall - great. The point of going this route, is that I’m the only IT guy, and the company wants to be able to have one number to call, if there is a problem, and I’m not around. In theory, the ISP should be able to trace the problem all the way back to our network, and fix it - great. But I start asking questions about things like actually being able to see what the people on our network are doing, where they are going, and what I can, and can’t block. Turns out this is a very basic firewall, and it offers just very basic packet-in, packet-out services. No intrusion detection, in-line virus filtering, or content filtering, and it can’t do any client side VPN. So, in talking with their engineer, it seems that I’m pretty much going to need to install a firewall behind their firewall to do any of this. A firewall, that they won’t manage, so that kind of nullifies the whole managed end-to-end bit.

Happy Friday everyone…

elgin8949 · 2014-08-29T17:19:34.000Z

A firewall that doesnt protect, barely, sounds like a router.

legoman · 2014-08-29T17:23:24.000Z

That’s an ISP that I would automatically stop doing business with…

Seems like they are including “firewall” cause that’s a nice buzz-word some business owner/management type will be like “yeah, we want that” when clearly it doesn’t provide anything worth having at all.

ISPs should just be ISPs, I don’t want any other “features” or “services” with that - just unrestricted Internet. I’ll do the firewalling, thank you.

striker090871 · 2014-08-29T17:24:24.000Z

Elgin8949:

A firewall that doesnt protect, barely, sounds like a router.

Agreed. There is a router as well, so it would be Fiber → router → firewall → firewall → my network.

eddie4 · 2014-08-29T17:26:21.000Z

We have 4 firewalls on different networks that I manage, they have my number!

I can’t remember the last time I was called concerning any of our firewalls. Once you get a firewall configured, they’re fairly low maintenance, at least the Sonicwalls we use have been.

elgin8949 · 2014-08-29T17:26:51.000Z

Striker090871:

Elgin8949:

A firewall that doesnt protect, barely, sounds like a router.

Agreed. There is a router as well, so it would be Fiber → router → firewall → firewall → my network.

Maybe it’s just a proxy server running on a Raspberry Pi. They then remarket it as a ‘Firewall’, except Firewall is the name of it and not what it does.

elgin8949 · 2014-08-29T17:28:44.000Z

Yes, everyone needs to check out the new routers made by Firewall.

striker090871 · 2014-08-29T17:28:56.000Z

EddieMoore:

We have 4 firewalls on different networks that I manage, they have my number!

I can’t remember the last time I was called concerning any of our firewalls. Once you get a firewall configured, they’re fairly low maintenance, at least the Sonicwalls we use have been.

Oh, I agree, but it would come down to there being a problem, and then it would be a question of ISP problem vs. firewall problem, and usually you need to convince the ISPs that they have a problem. The whole point of this managed service was that they would know if there was a problem, and would be able to fix it quickly. I know, asking too much…

legoman · 2014-08-29T17:35:17.000Z

Striker090871:

Nope, way more likely you will discover a problem, then spend 95% of your time convincing them why it is their network / device / “firewall” that is causing it.

I would really steer clear of this thing which is really just “another point of failure”

striker090871 · 2014-08-29T17:37:33.000Z

LegoMan:

just “another point of failure”

Exactly what I told my manager.

andrewmorris3 · 2014-08-29T18:33:15.000Z

Firewall!!!

jreilly86 · 2014-08-29T19:51:05.000Z

I would fight them on this… and if they don’t listen… spend your free time practicing your “I told you so dance” for when the sh1t hits the fan.

scottalanmiller · 2014-09-01T00:59:37.000Z

Maybe you need a more robust vendor

andrewpopplewell · 2014-09-01T12:47:46.000Z

The ISP provides the ocean. You should be the floodgate. Or at least that’s how it should work…our ISP is terribad.

lenn · 2014-09-03T22:55:31.000Z

Striker090871:

Elgin8949:

A firewall that doesnt protect, barely, sounds like a router.

Agreed. There is a router as well, so it would be Fiber → router → firewall → firewall → my network.

Wow.

scottalanmiller · 2014-09-03T23:48:15.000Z

Lenn:

Striker090871:

Elgin8949:

A firewall that doesnt protect, barely, sounds like a router.

Agreed. There is a router as well, so it would be Fiber → router → firewall → firewall → my network.

Wow.

Who the heck let them do that?

striker090871 · 2014-09-04T00:12:54.000Z

I didn’t let them do that. That is what they are suggesting as a solution to my problem.