1. Home
  2. Networking Firewalls
  3. Watchguard firewalls?

Watchguard firewalls?

We are currently planning a rather substantial upgrade of our network, one aspect of which is a new firewall to manage our WAN connection. I'll briefly describe what the new network should end up looking like:

- Network core will consist of 72 Gigabit Ethernet ports of various media, across two switches linked at 8Gbps. Copper ports will provide server connections (either single or aggregated links, depending on throughput requirements of each server); fibre ports (again, single or aggregated) will provide downlinks to about 30 edge areas.

- About 30 network areas will contain a total of around 300 desktop workstations, connecting at 100 megabit/s (or in a handful of cases, 1 gigabit/s). Additionally, about 50 staff have laptop computers and will connect them to an 802.11b/g network of about 15 APs.

- There is a single WAN connection, which currently consists of a frame relay connection to our ISP of 5Mbps bandwidth, which comes out of the CPE as 100Base-T Ethernet (IIRC; it might be 10B-T). This will probably be changed in the future, but to something similar in nature. We have a /24, and may also consider peering with several providers, using BGP.

- All end-user machines have addresses in RFC1918 subnets, and access the WAN via proxies and NAT. Only network devices, servers, and NAT, will use addresses from the /24.

- Up to 30 staff may get (or already have) broadband at home, and wish to access the network via a VPN. These would preferably be terminated at, and completely handled by, the firewall. It would be nice to be able to specify differing levels of network access for each VPN user (based upon authentication name).

We are considering firewalls from the Watchguard Firebox line. My research would suggest that these have a pretty good reputation. I've looked at the specs of the X700 and the X1000, and either would seem from the marketing materials to suit our needs. However, I'm sure someone out there can provide a little more insight than the marketing material ;-)

Is there anyone who has experience administering these firewalls, or designing networks that include them? Is it possible, based on the network description above, to provide an opinion on which of the two seems most suitable?

I'd be interested in any general opinions on these products, and also information about any other firewall brands you like better.

Cheers James

-- James Tolchard System Administrator Christ's College Canterbury Phone: +64 3 364 6806

Reply to
James Tolchard
Loading thread data ...

Something I forgot to mention:

In case it wasn't obvious from my description, the two core switches will be layer 3 switches, so I guess you could say they are also the routers for the entire network. Rules and filters in the layer 3 switches will be used to implement the network's internal security.

Cheers James

-- James Tolchard System Administrator Christ's College Canterbury Phone: +64 3 364 6806

Reply to
James Tolchard

James, we use WatchGuard X1000 and higher in Hospitals and Government locations, rather than rely on anonymous posts here, call WG and get them involved. Everything you mentioned can be done with the WG unit, but, I would hate to see you purchase to small of a unit initially. The X series can be firmware upgraded to get additional performance, but in your case, like some of our bigger installs, I would have a second unit on hand as a warm spare.

Reply to
Leythos

James, we have experience deploying firewall devices in Universities and Corporations, and have been seeing great success with Fortigates in Gigabit type environments (usually clusters of 3600's configured for failover redundancy) as well as smaller bandwith deployments. I'm not sure from reading your post excactly where you want to put firewalls and what you want them to be doing, but really this is the sort of thing you should be working on with a competant partner if you're looking at doing things internally in your gigabit areas. Give Fortinet a call and they'll set you up with one of their internal engineers initially and then a partner -- if you were in Canada, my phone would probably end up ringing sooner or later over it if it turns out to be a complicated enough network. :-) I'd love to fly down to New Zealand to help you implement it though (heh heh). But if you just want to put a firewall on the 5Mbps outside WAN connection and do FW/AV/IPS/VPN/BGP, that's no big deal at all to set up with a pretty reasonably priced unit or pair of units in HA mode.

You could drop me a line by decoding my email address and we could chat some more if you like.

-Russ.

Reply to
Somebody.

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.