[jaykay]

I'm trying to make some comparisons of Firewalls but running into problems finding companies that actually sell them!

I've been down to SIS in North Point for a demo of one type but they and the distributer are pushing this type of Firewall only and I want to make comparisons before spending money.......

For information this is a firewall that will be going into the China office and will be connected to 2 or 3 DSL lines with approx 130 users. I have quite a few requirements but will give you some idea of what I am looking at! Any recommendations for distributors, etc?

[KnowItAll]

I know the next person will ask this question .. hardware or software firewall?

If its software, free (open source) or commercial?

[jaykay]

Originally Posted by KnowItAll

I know the next person will ask this question .. hardware or software firewall?

If its software, free (open source) or commercial?

No problem! Actually a hardware firewall.

[hk.com]

Kia, no you don't. :-)

[jaykay]

So suppose no-one knows then......

[shri]

Jay -- will dump a few leads for you .. not till tommorrow. Been busy and still am with some stuff...

[jaykay]

No problem, thanks for the help!

[gdp]

Cisco & Juniper's Netscreen are some of the best hardware firewall available in the market.

[hk.com]

jaykay,

You actually have two requirements. You are looking for a outbound load balancer to share or aggregate dsl circuits. Normally these are presented to the world as firewalls as they rely on NAT, 3 IP's and selecting flows of traffic into different circuits based on smart policies or distribution.

I don't think you are going to get any bespoke firewall to be able to split spread your outbound traffic into the 3 circuits. They normally have 1 default gateway. Particularly Cisco. Junipers are more flexible and have got more routing capabilities but what you want is not exactly what it will do.

So my advice is to get two separate boxes. One that you go outbound with and uses the 3 DSL circuits, lots of these available in china from dodgy companies. Then get a firewall that protects your servers (if you have any, if you don't maybe don't get the firewall (???). Or get a firewall that operates in transparent proxy mode and which hopefully will sit there and look at the flows to the 3 DLS circuits.

[jaykay]

hk.com,

The one we had demo'd to us last week was a Watchguard Firebox x750e. This was able to split the 3 with full control over available bandwidth for different applications and control over the WAN modes, i.e. Spill over, round robin, Failover, ECMP, etc. There are a few other requirements that I had such as file extension blocking capabilities, URL / site blocking, full port control and blocking, P2P blocking to mention a few and the demo covered these no problem. I am looking at comparisons though as obvioulsy need to make a full justification for expense.

Some more information on the site there. 12 servers in all, mainly Win 2003, Exc 2003 used as mail with front and back end servers, servers used exclusively for engineering / design and the usual suspects in relation to purchasing, HR, AV and accounting systems. There are 3 DSL lines going in as bandwidth for larger lines not available in that area, and one lease line fallover. So pretty well set up and wanting to maintain it that way! We usually buy our equipment here, set it up and then take it up in back of car for site there. Certainly do not want to be placing in dodgy local equipment. We are currently using Watchguard firewalls in both HK and China, although increased requirements now mean we need to add this extra firewall there.