Is Astaro considered a "Next Generation firewall" ? look at these attributes that are needed in the Next generation firewall Application Identification: The firewall must be able use deep packet inspection to look beyond the IP header 5- tuple into the payload of the packet to find application identifiers Extended Stateful Inspection: By tracking application sessions beyond the point where dynamic ports are selected, the firewall will have the ability to support the detection of application-level anomalies that signify intrusions or policy violations SSL Decryption/Re-encryption: The firewall will need the ability to decrypt SSL-encrypted payloads to look for application identifiers/signatures Control: Traditional firewalls work on a simple deny/allow model. In this model, everyone can access an application that is deemed to be good. Analogously, nobody can access an application that is deemed to be bad. This model had more validity at a time when applications were monolithic in design and before the Internet made a wide variety of applications available. Today’s reality is that an application that might be bad for one organization might well be good for another. On an even more granular level, an application that might be bad for one part of an organization might be good for other parts of the organization. Also, given today’s complex applications, a component of an application might be bad for one part of an organization but that same component might well be good for other parts of the organization. Multi-gigabit Throughput: In order to be deployed in-line as an internal firewall on the LAN or as an Internet firewall for high speed access lines, the next generation firewall will need to perform the above functions at multigigabit speeds. please check the attached file for more information

This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Next Generation Firewall !!

Is Astaro considered a "Next Generation firewall" ?
look at these attributes that are needed in the Next generation firewall

Extended Stateful Inspection: By tracking application sessions beyond the point where dynamic ports are selected, the firewall will have the ability to support the detection of application-level anomalies that signify intrusions or policy violations
SSL Decryption/Re-encryption: The firewall will need the ability to decrypt SSL-encrypted payloads to look for application identifiers/signatures
Control: Traditional firewalls work on a simple deny/allow model. In this model, everyone can access an application that is deemed to be good. Analogously, nobody can access an application that is deemed to be bad. This model had more validity at a time when applications were monolithic in design and before the Internet made a wide variety of applications available. Today’s reality is that an application that might be bad for one organization might well be good for another. On an even more granular level, an application that might be bad for one part of an organization might be good for other parts of the organization. Also, given today’s complex applications, a component of an application might be bad for one part of an organization but that same component might well be good for other parts of the organization.
Multi-gigabit Throughput: In order to be deployed in-line as an internal firewall on the LAN or as an Internet firewall for high speed access lines, the next generation firewall will need to perform the above functions at multigigabit speeds.

please check the attached file for more information

This thread was automatically locked due to age.

Parents

0 AngeloC over 15 years ago

Hiya Techuser,

With over 90 posts, I don't for a moment think you are here to promote anything [:)] However you raise a good point, often in this space companies can no longer differentiate themselves on a feature or what the other guy "can't" do. The market changes so fast, and most vendors are realistically within 5-10% of feature by feature comparisons. Unless it happens to be a single thing or so you really need and one company doesn't have it, then really that is a dead end way to buy a firewall.

By far, USABLE technology is the key; what good are hundreds of features if you have no real hope of configuring/using them, or dont have the knowledge and confidence in yourself to put you or your company on the line for a deployment, sale, installation etc, using it?

While PA does have a few neat things, they are far better at marketing: using the term Next-Generation and "its time to fix the firewall" is great, but they put a strong spin on using application ID or USER ID when really they do a sort of DNS; the product still makes decisions based on IP addresses, they just work very hard to hide it from the user so they can deal in terms they understand instead. It is a valid approach, as long as the customer understands its more of a shiny icing than a totally new cake recipe. As with many things in the security space, your experiences or demo/trial should dictate your purchase dollars, not promises, marketing datasheets, or fancy flash videos.

Just my 2 cents, hope it is of use.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 AngeloC over 15 years ago

Hiya Techuser,

With over 90 posts, I don't for a moment think you are here to promote anything [:)] However you raise a good point, often in this space companies can no longer differentiate themselves on a feature or what the other guy "can't" do. The market changes so fast, and most vendors are realistically within 5-10% of feature by feature comparisons. Unless it happens to be a single thing or so you really need and one company doesn't have it, then really that is a dead end way to buy a firewall.

By far, USABLE technology is the key; what good are hundreds of features if you have no real hope of configuring/using them, or dont have the knowledge and confidence in yourself to put you or your company on the line for a deployment, sale, installation etc, using it?

While PA does have a few neat things, they are far better at marketing: using the term Next-Generation and "its time to fix the firewall" is great, but they put a strong spin on using application ID or USER ID when really they do a sort of DNS; the product still makes decisions based on IP addresses, they just work very hard to hide it from the user so they can deal in terms they understand instead. It is a valid approach, as long as the customer understands its more of a shiny icing than a totally new cake recipe. As with many things in the security space, your experiences or demo/trial should dictate your purchase dollars, not promises, marketing datasheets, or fancy flash videos.

Just my 2 cents, hope it is of use.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data