This is a question in regards to creating a firewall for my business; we have roughly 350 computers with six servers. Budget is not an issue, security is.
I've been reading up on firewalls and am having difficulty seeing through to the facts of which is actually better, a firewall appliance, or a dedicated machine running firewall software. Each of the companies that make them say that their product is better, and I can't seem to find out which one actually is.
Have you got any advice as to which one might be more suitable?
It's a fact that firewalls are moving to appliances and the reason behind it is to make them as secure as possible. It's not the appliance itself, which makes a difference, but the OS (firmware), memory, processing power, architecture and the kernel, which drives it.
The major problem seen with the software-based firewalls is the performance basically with network traffic control, since it relies totally on the underlying hardware for its stability and performance. Moreover, any missed security patches on the underlying OS can have the firewall system compromised even while the Firewall is running. A firewall is not isolated in a design, but rather integrated with corporate VPNs and IDS as well.
When it comes to a firewall, downtime is a big NO. It requires a high processing and memory power to perform all these transactions. In fact Nokia last year announced that all of its enterprise range firewalls will be appliance based. Why have firewall software from one and install it on another vendor's hardware, when you can have a single vendor providing all the services in just one box. Appliance takes away the headache of maintaining security patches for each – the hardware, OS and the firewall software.
Dig Deeper on Network Security Monitoring and Analysis
Related Q&A from Puneet Mehta
Find out if there's a difference between a virtual private network (VPN) concentrator and a network access server (NAS) in this explanation from our ... Continue Reading
Our network security expert explains how to keep unauthorized users from accessing your router's IP address for Internet access in this advice ... Continue Reading
If you've used MAC address restriction to control your network access on your wireless router, can you extend this to your wired network? Our ... Continue Reading