27

Instead of asking about the pros and cons of specific hardware, I thought I would ask a broader question: What are the differences between really expensive and inexpensive firewalls? What extra features/support will you typically get? And while firewalls (hardware) will need software to run, is it necessary to still use a standard OS' firewall?

It was suggested here (in scenario 3) that multiple firewalls are more beneficial to a larger company (500+ people). Is the reason just that the more firewalls you have, the more protected you will be?

This question was IT Security Question of the Week.
Read the Jan 6, 2012 blog entry for more details or submit your own Question of the Week.

Community
  • 1
mdegges
  • 373
  • 3
  • 6
  • +1. I suspect the difference boils down to faster operation and better "level seven" protocol inspection. (E.g. being able to detect that something is HTTP instead of just checking if it's port 80) I don't know though. – Billy ONeal Dec 02 '11 at 23:31
  • 5
    About $800+ ;). – StrangeWill Feb 22 '12 at 22:20

6 Answers6

22

One of the biggest and most important factors between firewall hardware is maximum throughput and typical latency. Low-cost firewall hardware usually has a maximum throughput of less than 100Mbit/sec even though the network adapters might theoretically support more than that. This means that the firewall becomes your network bottleneck in many scenarios. Determining the throughput of your firewall involves more than just looking at the port speed.

Processing data quickly requires fast CPUs, high-speed interconnects and plenty of fast RAM, and very high-quality network adapters. Just the hardware alone for a firewall capable of passing data at 1 Gbit/sec with minimal examination can put you up in the several hundred dollar range. Furthermore, the more examination you do on passing traffic, the more CPU power and memory you consume. Adding complex filtering logic will significantly increase the CPU and RAM utilization. And any resource exhaustion will result in delays or dropped packets.

Doing stateful packet inspection and particularly application-level protocol logic is possible even on a $60 home router, but the performance impact at high utilization would be severe.

The interface for your hardware is generally not a major expense, but since most people equate the quality of the interface with the quality of the hardware in general, companies with deep interest in the survival of their product generally will put some extra effort into making the interface easier to use. At least, that's the theory. Sometimes companies like Juniper and Cisco make me doubt that assumption.

Also bear in mind that some companies build an entire business around not only providing firewall hardware and software, but also in providing regular updates to the OS, the filtering rules, patterns for spam and malware, and so forth. If you want that kind of service, you have to help pay the salaries for the people who provide it.

tylerl
  • 83,435
  • 26
  • 152
  • 232
7

Cheap home/small business firewalls will tend to have very limited support for things like NAT, VPN, IPSec, DNS, etc and are designed for low throughput and a very low number of concurrent connections (often the real problem). Enterprise firewalls lately have moved towards a unified threat model where you buy a chassis and buy licenses for features you want. Most are capable of performing not only deep packet inspection but also Intrusion Prevention, Web Content Filtering, Anti-Spam, VPN, etc depending on the license. Faster is definitely more expensive but I wanted to illustrate some fundamental differences in the designs themselves.

Ali
  • 733
  • 1
  • 10
  • 18
Paul Ackerman
  • 476
  • 2
  • 5
  • 1
    for the record, if you want a cheap home/small business firewall with excellent support for the above, you would be well served to check out http://www.pfsense.org/index.php?option=com_content&task=view&id=52&Itemid=49. – devnul3 Dec 06 '11 at 22:13
3

Firewalls are available in different tiers depending on the features and capabilities needed by the user/organization.

1 - The most basic level is for home or very small business users which provides port address translation, basic NAT, a single WAN poort, limited network ports, and often wireless.

2 - Small business / small enterprise usually has simple to semi-powerful GUIs, 1-2 wan ports, VPN functionality (site to site and client to site), flexible NAT/PAT configurations, and many have add on features such as anti-spam, anti-virus, IPS, and web content filtering (usually for a monthly fee). Often wireless is an option and there may be high availability/load balancing features available for the higher end models.

3 - Larger Enterprise models will have ports that you can designate at will as internal/external, VPN functionality, powerful GUIs, high speed backplanes, more powerful processors and larger quantities of RAM, high availability/load balancing support, many of the add on features mentioned in the the previous tier.

If you look at firewalls from a larger enterprise perspective, you need high availability which means multiple firewalls in high availability or clustering mode supporting multiple ISP connections. Not only does the hardware add up but your annual maintenance is a pretty penny.

David Yu
  • 221
  • 1
  • 4
  • I was wondering about that, too: how many EXPENSIVE hardware firewalls are needed in large organizations with 500+ people? I've found it kind of hard to find this information online. You can learn the basics about firewalls, but the details are always left out. – mdegges Dec 12 '11 at 01:56
  • Most of my experience is with organisations with 50,000+ employees and the firewalls can number in the hundreds, generally configured as HA pairs or clusters. – Rory Alsop Jan 06 '12 at 12:42
1

In addition to the previous answers, which correctly focused on bandwidth and throughput, in addition to "add-on" modules such as NAT, VPN, content filtering, IPS, and etc.

I also want to point out that the higher-end products have a lot of deployment-ready features, such as integration with existing LDAP or RADIUS server, for user authentication; easier PKI configuration and integration; "bootstrap" mechanisms for adding machines.
Also some better management utilities, beyond just a pretty UI, such as better FW cluster management, change workflow, policy delegation, etc.
Lastly some of the more advanced firewalls provide extensibility hooks (though at the bottom end, open source FW would also allow you to do this - kind of).

AviD
  • 73,317
  • 24
  • 140
  • 221
0

I think bandwidth is a very bad way to measure a firewall's capability. It is better to check how many packets it can handle. As most companies are saying their firewall can process maybe 1 Gb/s, it's not said at which size.

As a network package can range between 7B to 64kB. A firewall will have 9 times more overhead when processing a stream with 7B packages than with 64kB packages.

So if you see two firewalls that can process at 1 Gb/s and you are wondering why one costs twice as much. Mind that it could be for this reason.

(also when buying a firewall, ask about packets rather than bandwidth to compare firewalls)

Lucas Kauffman
  • 54,437
  • 17
  • 116
  • 196
0

In the instance of setup 3 in the link, having multiple firewalls could be more secure. This is because you can segment the network and create special rules to only allow certain access and inspect the traffic to make sure that is what is happening.

When comparing with scenario 1, gaining access to one system will likely give you the keys to the whole farm. And that one system maybe a random desktop on the LAN rather than one of those 3 servers. In our network we use multiple firewalls to segment our network into sections for LAN, DMZ, and servers as well as a couple other sections for areas that need access to special data. Essentially you have 1 firewall to secure from the web, then other firewalls to secure from yourself. :)

Robert
  • 21
  • 1