NSS Solutions

I get asked all the time what they best products on the market currently are.  To me that is not a straight forward question.  There are a lot of considerations for someone to take into account to make the best recommendation.  The size of the environment, throughput needed, features required, features that someone would like to see in a firewall (antivirus, url filtering, active directory integration, IPS/IDS), experience with products, and the ability to take on new technologies.  All of these play a big part in what recommendations we would make to a customer.

In our eye’s hands down Palo Alto is the best firewall on the market per dollar spent.  The integration into active directory, application controls, and url filtering is way beyond any other product that is currently out in the market.  While we know all the other vendors are working hard to catch up it will be at least 6 months to a year before they do.  To add on top of that we currently did some testing between the Palo Alto and Check Point products.  We tested IDS/IPS’s ability to catch intrusions, and application control outbound.

So what was our test?  A basic bittorrent connection outbound through a Palo Alto firewall and through a Check Point R71 firewall.

The results Palo Alto caught the bittorrent traffic, but the traffic was allowed out through the Check Point firewall.

As basic a test as this is, it still shows you where things currently stand.  Check Point is playing catch up and their products are being released without going through the whole QA cycle.

While we expect this to change within the next couple of years, be prepared for a lot of releases from Check Point to say that they’re caught up, and then a lot of HFA’s to go back and fix all the problems that they missed in getting the product out so quick.