Good firewall for small office?

[majortom1981]

make sure your wan is directly connected to your cablemodem or dsl modem. No router should be between it and the pfsense router/firewall.

[grunger106]

i think that is a bit overkill for what he is looking for, I think he is more in line for a 20 or 50 which I already suggested in his other thread.

Not only is the 50 cheaper it's actually more powerful than the 100...

The 50 is a dual core whereas the 100 is a single.

The only reason to chose a 100 over a 50 is if you need additional SSL or IPSEC VPN sessions.

[grunger106]

Any models number for Cisco?

Depeding on your WAN link 861 or an 867 if you are looking at the Ciscos, but if you don't know IOS then its a pretty steep learning curve.

The USGs are much more friendly look at a 50 - Dual WAN ports, nice object based OS, semi-decent UTM features if you want to pay for them, easy bandwidth management - you can do all of this on a 8XX series too, but they are more complex to configure

However if you have DNS issues, swapping a router isn't going to help, your clients are looking at your AD server for their DNS right? If so do you have forwarders?

[+BudMan MVC]

"your clients are looking at your AD server for their DNS right?"

No they are not, his dhcp server hands out both his AD DC and his router (old 2002 zyxel firewall). Few other things I would adjust in the sake of clean up - his dhcp lease time is 1 hour, which for how many people and his current /24 unwarranted. All of his boxes I assume are out of the box setup for ipv6, so I assume they are not imaged or managed in anyway. Could well have rampart viruses running around? Wireless is not secured, not isolated so all of his broadcast traffic from his wired devices is on his wireless network I have to assume, eating away at what is at best home wireless router for someone on a tight budget!! And just got something that was on sale ;)

His router/firewall needs to be replaced just because its from 2002 ;) He never stated how fast his internet pipe is, but its quite possible that such an old device can not route his full bandwidth. But he has some basic stuff he could do that might clear up some of his issues.

I am curious how all his devices are wired to his switches, one is smart - but not sure its acting as core switch, there could be switching loops? He could have bandwidth issues - they are all gig switches, but not sure how many devices on each switch how the switches are interconnected, where are his servers, were are his printers - might be better to downgrade some of his devices connections to 100mbit to not eat up the 1 gig interconnection of the switches. Maybe they should just use 1 switch? Maybe 2x48 porter with stack setup for redundancy? And some vlans to isolated different types of traffic, etc.

But still working on inventory and basic current configuration in the other thread before can take a look to what should be done.

The replacement of his current dated router/firewall is just 1 piece in the puzzle.

[pes2013]

So did you FIX your dns problem yet? Telling you that most likely will remove many issues you might be having, since your current router is not going to to help your boxes find your AD.. Did you up your dhcp lease from 1 hour?

I havent had time to do even inventory; Some other (non network related) issues have come up. They are pressuring me for a firewall; Told them about pfSense but since I told them it would take me a couple of days to set it up (Ive done it once on a standalone and another on the VMWare, both which I have not been able to connect to the web config)

Thats why I asked for a firewall :) They want to order one ASAP.

Personally, I didnt even know about Zyxel. A lot of you recommend them so it must be a good firewall.....Ill look into them.

"your clients are looking at your AD server for their DNS right?"

No they are not, his dhcp server hands out both his AD DC and his router (old 2002 zyxel firewall). Few other things I would adjust in the sake of clean up - his dhcp lease time is 1 hour, which for how many people and his current /24 unwarranted. All of his boxes I assume are out of the box setup for ipv6, so I assume they are not imaged or managed in anyway. Could well have rampart viruses running around? Wireless is not secured, not isolated so all of his broadcast traffic from his wired devices is on his wireless network I have to assume, eating away at what is at best home wireless router for someone on a tight budget!! And just got something that was on sale ;)

His router/firewall needs to be replaced just because its from 2002 ;) He never stated how fast his internet pipe is, but its quite possible that such an old device can not route his full bandwidth. But he has some basic stuff he could do that might clear up some of his issues.

I am curious how all his devices are wired to his switches, one is smart - but not sure its acting as core switch, there could be switching loops? He could have bandwidth issues - they are all gig switches, but not sure how many devices on each switch how the switches are interconnected, where are his servers, were are his printers - might be better to downgrade some of his devices connections to 100mbit to not eat up the 1 gig interconnection of the switches. Maybe they should just use 1 switch? Maybe 2x48 porter with stack setup for redundancy? And some vlans to isolated different types of traffic, etc.

But still working on inventory and basic current configuration in the other thread before can take a look to what should be done.

The replacement of his current dated router/firewall is just 1 piece in the puzzle.

Ill up the DHCP time today and with the DNS problem, Ill try to view the configuration and point it back so I can tell you exactly what is going on.

About the IPv6, Ill distribute it via GP (if it REALLY bothers you, BudMan; I personally dont see it ripping apart bandwidth)

Bandwidth: From a HTTP Ubuntu ISO download (not the best tool I know) 450-500KB/seg. Speedtest says 5.65Mbpbs/0.66Mbps. That upload seems horribly slow. Not uploading anything on my PC.

[+BudMan MVC]

"Speedtest says 5.65Mbpbs/0.66Mbps"

What speed are you paying for?

Yeah that upload seems bad! And 6 seems BAD to me for 20 some users.. What if you have some users watching youttube videos ;)

As to ipv6 ripping up bandwidth - that is not my point.. My point is its traffic on your segment that serves NO PURPOSE and be security issue. Be it 1kbps or 100kbps or 1mbps -- its traffic you don't have any use for. Its a clean up step, not a reduction of bandwidth step. But sure every broadcast packet going out on your wire - and therefore being broadcast over your wireless, is one less packet that is of use that could be on the wireless network.

Another clean up option would be to reduce the protocols your printers are running - many of them have ipx and appletalk enabled stil, etc.

Its about taking ownership of the environment keeping it clean and managed.. Do you trim your hedges in front of the house? Does it matter in big picture if they have some branches sticking out, or do you like them rounded or squared off?

If they are pushing you to buy a new firewall - then buy one.. You have a zyxel now, then just buy newer model - I would think a usg 20 or 50 is more than enough for you. If you have plans of adding say another ISP as a backup/failover internet connection then go with 50 that has 2 wan ports. If you have desire to allow for vpn inbound other than managment then 50 you can do concurrent with 5 with lic, 100 can do 25 with lic.

I doubt you have any use of ipsec tunnels, etc. difference in 20 and 50 models is about $100.. So your talking like 150 to 250. A 100 your looking at $350 approx, etc. Now 50 over 20 I believe you can add features like AV and IPS/IDS along with Qos features - that I don't believe are available on the 20. So 50 is prob the best choice and under $300 I would think for basic model. Other features would/could require more licensing cost, etc. But its prob a good choice for your budget and requirements.

But what you use as you gateway/firewall is just 1 piece of the puzzle in taking ownership of your network and getting it in the best possible shape you can get it in with your limits both in knowledge and budget constraints.

[#Michael]

"Speedtest says 5.65Mbpbs/0.66Mbps"

What speed are you paying for?

Yeah that upload seems bad! And 6 seems BAD to me for 20 some users.. What if you have some users watching youttube videos ;)

As to ipv6 ripping up bandwidth - that is not my point.. My point is its traffic on your segment that serves NO PURPOSE and be security issue. Be it 1kbps or 100kbps or 1mbps -- its traffic you don't have any use for. Its a clean up step, not a reduction of bandwidth step. But sure every broadcast packet going out on your wire - and therefore being broadcast over your wireless, is one less packet that is of use that could be on the wireless network.

Another clean up option would be to reduce the protocols your printers are running - many of them have ipx and appletalk enabled stil, etc.

Its about taking ownership of the environment keeping it clean and managed.. Do you trim your hedges in front of the house? Does it matter if big picture if they have some branches sticking out, or do you like them rounded or squared off?

If they are pushing you to buy a new firewall - then buy one.. You have a zyxel now, then just buy newer model - I would think a usg 20 or 50 is more than enough for you. If you have plans of adding say another ISP as a backup/failover internet connection then go with 50 that has 2 wan ports. If you have desire to allow for vpn inbound other than managment then 50 you can do concurrent with 5 with lic, 100 can do 25 with lic.

I doubt you have any use of ipsec tunnels, etc. difference in 20 and 50 models is about $100.. So your talking like 150 to 250. A 100 your looking at $350 approx, etc. Now 50 over 20 I believe you can add features like AV and IPS/IDS along with Qos features - that I don't believe are available on the 20. So 50 is prob the best choice and under $300 I would think for basic model. Other features would/could require more licensing cost, etc. But its prob a good choice for your budget and requirements.

Hey..don't knock the dl/ul speeds. I used to work as an mdm consultant at a company that had at one time 40 people and had a 6/5 connection. There were times during the day that you couldn't even load a simple website let alone even think of looking at a youtube video.

[pes2013]

"Speedtest says 5.65Mbpbs/0.66Mbps"

What speed are you paying for?

Asked and we have 3....So we are actually getting better :p

Yeah that upload seems bad! And 6 seems BAD to me for 20 some users.. What if you have some users watching youttube videos ;)

It does indeed seem bad.....We are paying for that plus a static IP for 60 bucks....To me it seems like a ripoff....

As to ipv6 ripping up bandwidth - that is not my point.. My point is its traffic on your segment that serves NO PURPOSE and be security issue. Be it 1kbps or 100kbps or 1mbps -- its traffic you don't have any use for. Its a clean up step, not a reduction of bandwidth step. But sure every broadcast packet going out on your wire - and therefore being broadcast over your wireless, is one less packet that is of use that could be on the wireless network.

Another clean up option would be to reduce the protocols your printers are running - many of them have ipx and appletalk enabled stil, etc.

Its about taking ownership of the environment keeping it clean and managed.. Do you trim your hedges in front of the house? Does it matter in big picture if they have some branches sticking out, or do you like them rounded or squared off?

I just trim it and dont mind if some branches stick out, as long as you dont pass by at get cut by it; Its the typical "if it aint broke, dont fix it". I mean yes disabling IPv6 makes sense as it use eats up bandwidth and resources but it is not that much for it to be looked at as the root of the problem; There are more important issues at hand (first being the DNS issue you mentioned)

If they are pushing you to buy a new firewall - then buy one.. You have a zyxel now, then just buy newer model - I would think a usg 20 or 50 is more than enough for you. If you have plans of adding say another ISP as a backup/failover internet connection then go with 50 that has 2 wan ports. If you have desire to allow for vpn inbound other than managment then 50 you can do concurrent with 5 with lic, 100 can do 25 with lic.

I doubt you have any use of ipsec tunnels, etc. difference in 20 and 50 models is about $100.. So your talking like 150 to 250. A 100 your looking at $350 approx, etc. Now 50 over 20 I believe you can add features like AV and IPS/IDS along with Qos features - that I don't believe are available on the 20. So 50 is prob the best choice and under $300 I would think for basic model. Other features would/could require more licensing cost, etc. But its prob a good choice for your budget and requirements.

But what you use as you gateway/firewall is just 1 piece of the puzzle in taking ownership of your network and getting it in the best possible shape you can get it in with your limits both in knowledge and budget constraints.

OK Ill look into it. Thanks

[pes2013]

We are getting the USG 50....

[grunger106]

We are getting the USG 50....

Good choice...

Easy to setup, I can probably help out if you post here - I've got 2x 300s, 10x50s, a 4 or 5 100s setup in various places running everything from load balanced leased lines to single DSL circuits

[pes2013]

Good choice...

Easy to setup, I can probably help out if you post here - I've got 2x 300s, 10x50s, a 4 or 5 100s setup in various places running everything from load balanced leased lines to single DSL circuits

Comes in two days; Ill try to set it up. Any issues, Ill post in the other thread about redoing my network.

This thread can be pretty much closed.

[Adny Banks]

I havent had time to do even inventory; Some other (non network related) issues have come up.

 

 

For inventory and network monitoring you can use some free software, for example, Total Network Monitor.