Go for Netscreen - Cisco is overrated and a pain - why do you think there are so many pix questions here?
Main Topics
Browse All Topics
Loading Advertisement...
Question
Which Firewall and VPN hardware device to use??
Hi,
I am a Windows system administrator for a medium scale company.
I need to suggest a powerful firewall and VPN device and configure it with VPN access for atleast a 100 users for a new requirement. The traffic will also be considerable.
Being more of a system administrator i have only a basic idea of network products specially Cisco and defnitely not an expert. So i need some advice. (The company prefers a Cisco product.)
The network consists of a Windows 2000 domain with 40 PCs, 2 domain controllers. Along with these machines, there are 5 SQL database servers and an exchange server that will be behind the new firewall and 2 web servers in the DMZ.
Clients will VPN into the network to connect to the database servers.
Which is the best PIX firewall model with VPN functionality i should choose?
What features should i be looking at for the requirement above?
What points do i have to keep in mind?
How difficult is it configure a PIX firewall?
How difficult is it to configure a VPN setup?
I am thinking of a Cisco PIX 515 E firewall. But i do not know abt the VPN capabilities.
There is one thing i did not understand about the 515 choices-
There are 3 options for 515E and i do not understand the differences between them clearly.
1)PIX 515E Firewall Chassis, Unrestricted software, with 2 10/100BASE-TX ports VAC ($5300)
2)PIX 515E bundle includes chassis restricted software and 2 FE ports ($2550)
3) PIX 515E Chassis, Restricted software, 3 FE Ports ($2700)
Wht exactly are the differences specially with respect to Unrestricted software and restricted software?
I DO NOT have any experience on Cisco PIX firewalls or VPN setup. But I am sure i should be able to configure them by reading documentation.
I am giving this question a 100 points but depending upon the answers and help i get ...... i wil double or even triple the points.
Thanks
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Subscribe now for full access to Experts Exchange and get
Instant Access to this Solution
- Plus...
- 30 Day FREE access, no risk, no obligation
- Collaborate with the world's top tech experts
- Unlimited access to our exclusive solution database
- Never be left without tech help again
Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.
- "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
- "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
- "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.
See what Experts Exchange can do for you.
Got a question?
We've got the answer.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
Need individual assistance?
Our experts are ready to help.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Want to learn from the best?
Read articles from industry experts.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Working on a long term project?
Store your work and research.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
What Makes Experts Exchange Unique?
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Trusted by the world's most respected brands.
Faithfully serving IT professionals since 1996.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Free Tech Articles
-
WARNING: 5 Reasons why you should NEVER fix a computer for free.
It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
-
SCCM OSD Basic troubleshooting
SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
-
Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
-
Create a Win7 Gadget
This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
-
Outlook continually prompting for username and password
There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
-
Backup Exchange 2010 Information Store using Windows Backup
There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...
Cloud Class Webinars
- Avoiding Bugs in Microsoft Access
Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
- Top 10 Best New Features in Visio 2010
Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
- IT Consultant Business Secrets Revealed
Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
- Disaster Recovery and Business Continuity
Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
- Organize Your Visio Diagrams with Containers and Lists
Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
- How to Us Objects, Properties, Events and Methods in Microsoft Access
Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...
Join the Community
Give a Little. Get a Lot.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Answers
What's your budget? How big an issue is the client security? Are you worried about the level of encryption?
Are you intending to use RADIUS or NT authentication for users?
How many concurrent VPN users do you need to support?
We use a Watchguard Firebox. Depending on the number of concurrent users, a Firebox III 2500 - 4500 (comes with VPN accelerator) would do the trick. The 4500 includes 20 Mobile User VPN licenses.
It uses a pretty standard VPN client - namely an OEM version of the Safenet client. It comes bundled with ZoneAlarm for the clients (if desired).
You can set up extended authentication groups with a fixed pool of addresses and RADIUS or NT authentication, etc... You can also restrict host/network access for VPN users so that they can only access your database server and only access specific ports
It's a great firewall - very versatile, a cinch to administer and comes with lots of nice management utils, so you can easily create usage reports, etc...
You might also want to look at the new Firebox X which has just been released
I have tryed many different firewalls and i still stick with the Cisco Pix - yeah, its a little harder to set up - but there is no comparison for the power of it
and in the end.... should you know what u r doing to set up a firewall ???
Anyone that needs a mouse user friendly interface to configure a firewall, probably shouldnt do that anyways.
He he he - like there isn't a major firewall on the market that doesn't have a GUI.
Simply look at the number of questions on Experts Exchange about PIX and you will see that it is complex to tune properly and also messes up quite a lot. This is because it runs on a multitude of different hardware platforms that Cisco have acquired over the years and it generally sucks. Soon we'll see Linksys boxes running PIX code.
Conduit what?
Global what?
There are some really good firewalls out there that are no pain to setup and manage. Netscreen is one, Fortigate is another - we offer these to the clients that have low budget and no interest in getting Cisco qualified.
That is at the bottom end. At the top end you don't see PIX except in carrier environments where they want their firewalls to be nothing more than an extension of their layer 2 & 3 architecture. Try Checkpoint, Nokia, Symantec and *wow* Netscreen.
So it seems Netscreen can do the top end and the bottom end. And PIX just seems to be the most asked about firewall on EE.
Sorry for a delay in my response. I was busy completing my unfinished tasks last week and now this week i am at my new project site.
After reading all the comments i am more confused ;) !!
Ok i have worked on WatchGaurd Firebox 500 firewall and its ok. It has a nice GUI and it is easy to configure. But they have very poor support and i do not want to go for WatchGaurd because of this.
I am interested in Netscreen after seeing the suggestions above. On the other hand Cisco PIX seems to be an industry standard right? I mean all major corporates seem to use it.
The questions i asked above were directly related to Cisco PIX because the management was more keen on Cisco PIX.
I will look into the various Netscreen models and see which one is more suited. And for VPN i would mostly implement NT authentication. Will get back tomorrow.
I think cisco is over priced. I belive alot of administrators recommend them because they want to control a cisco network. That means more money for them. I do not think the benifits of cisco are anywhere near worth the cost. If your an IT manager and you have to pick which brand your going to deploy, and know you will be worth more if you learn and setup a cisco solution, what are you going to do? I don't think this is usually in the companies best interest. (for small to med. sized) And to say you do not want a watchguard because of customer service yet are thinking cisco is humerous to me. You pay watchguard that much for a service contract and they will keep a representative in the corner of your office :o
Hi,
Sorry for a delayed response. We finally went in for the Netscreen 5 GT. Awesome firewall in terms of configuration and causing least amount of headache.
When i put up the question i was thinking that this session would end up being a PIX question- answer session but i am glad it did not go that way.
Well i do not know how do i give points here. Pascal did answer about the unrestricted and restricted ports question and ferg-o encouraged the use of Netscreen which i am glad i did.
I would like to give points to both of you but i am confused on how do i do that and whats cool with you guys. Any suggestions?
3 Ways to Join
Business Accounts
- Perfect for organizations
- Multiple users
- Save over 36%
- Create a Business Account
Answer for Membership
- Earn free access
- Showcase your knowledge
- No credit card required
- Sign Up to Answer
Loading Advertisement...
by: Pascal666Posted on 2004-02-13 at 20:20:57ID: 10358891
Restricted software is limited to 3 ethernet ports. Unrestricted supports upto 6. Unrestricted also supports a failover configuration. It sounds like what would matter to you though would be the VPN accelerator. It is only included with the Unrestricted and failover bundles.
-Pascal