1. Home
  2. Networking Firewalls
  3. Hardware firewall with A/V and malware protection, recommendation request

Hardware firewall with A/V and malware protection, recommendation request

We use Sonicwall firewalls at work. The newest ones have available 'gateway antivirus' and 'intrusion/spyware prevention' using per packet inspection; both require an annual subscription from Sonicwall to get a continuously updated list of signatures and such, much like a subscription to get updated DAT files for a software antivirus package.

We're actually happy with these; they've been effective as an additional layer; while they can't stop everything they've reduced our incidence rate at the desktop level quite a bit (incidents being virus detected/access prevented/virus deleted or quarantined/malware prevented from loading/etc); we've been fortunate in not having an actual infection in a couple of years.

I'd love to get that kind of protection in place for parents, relatives, etc. Since I have a Sonicwall at home (older model, but then I don't run wintels so most of those new features don't matter to me anyway) I can have site-to-site tunnels set up to manage sonicwalls at any relative's location for them.

Unfortunately the cost of even the cheapest Sonicwall solution (TZ150) with the gateway antivirus and intrusion prevention is quite hefty. If it was just the hardware and annual support (for firmware upgrades; I've never had a hardware failure other than an easily replaceable power supply) it'd be fine, but the annual subscriptions, even with discounts from a reseller, add up to a point that home users with $600 Dell desktops throw a fit, and I certainly can't afford to buy it for the relatives _every year_ even if it ends up saving me many hours of "relative's peecee support".

So... are there any other firewalls or security boxes that can do "deep packet inspection" and weed out virii and malware/spyware/trojans, etc, on an external device that can be managed remotely, preferably via an IPSec VPN tunnel? For less than the cost of the Sonicwall solutions? Or are those premium features that only come at higher price points right now?

Thanks for any info.

Reply to
jordan
Loading thread data ...

My friends and family use a NAT router, use FireFox and use Symantec Corporate Edition AV software for their computers. With that combination they've not been infected ever.

Reply to
Leythos

Leythos, thanks for responding. Those family members we've been able to convince have switched to Firefox, and either Thunderbird or Eudora for mail. Several are using NAT routers, two are even using older model Sonicwalls that we got cheap/used. Unfortunately that wasn't enough; one of them got their machine trashed this weekend by using IE to get windows updates, visiting 'just one site' before starting the process, and got infected; they were about 1 month behind on critical updates.

I visited the site that nailed them using Mozilla on an OpenVMS workstation behind one of the new Sonicwalls with AV and IPS, and the firewall detected and blocked the vulnerabilities; kind of screwed up the web page display but if I'd been on a wintel peecee without the IPS/AV on the firewall it would have been up to whatever AV/malware software was on the peecee to stop it. That failed on the relative's system, perhaps because the exploit was too new for their AV software to detect (and that could happen with the firewall too since it relies on the vendor to update the detection info). More layers is better.

Reply to
jordan

It looks like you have the old family ball and chain rapped tightly to your ankle.

Duane :)

Reply to
Duane Arnold

What AV product, specifically, were they running. I found the Symantec Corp Ed 7.6 and above block almost every HTTP exploit since they started.

They don't need a definition if you enable (and they are by default) the real-time scanning and also the normal background checks.

There is also a clear document on using IE in secure mode that will eliminate the problems with most cracked sites, but it also breaks most good sites unless you add the site to your trusted zone - which I reset to medium when doing that method.

Reply to
Leythos

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.