Do you use a hardware firewall in your organization?

Question

Computer networks

The question itself is: Do you use a hardware firewall in your organization? What vendor? How big is the organization? Identified pros and cons.
And most importantly: does it make sense to replace MS TMG with some kind of hardware solution?

Answer 1

Of course yes.
Cisco.
Decent size (a few thousand employees).
Yes, no cons. Works stably.
TMG is already end of life. This is already a reason to soon change it to something. Nothing can be said about other reasons, because you did not voice the requirements.

Answer 2

Juniper SRX
www.juniper.net/ru/ru/products-services/security/srx-series/ Can
VPN\IPS\UTM\antivirus

Answer 3

Interestingly, almost all organizations that are connected to the Internet through one or another hardware router automatically use the firewall built into it. In other matters, and most home users too.
Any vendor has models for almost any requirement. At one time I had a chance to operate the DFL-200 , it was difficult to start it out of habit, but then everything became fine, there were no complaints about stability. It all depends on the needs and size of the connected organization. If I understand correctly, then TMG will be quite difficult to replace if it is deeply integrated into AD. Let's say the same DFL is completely unable to communicate with AD, i.e. a single user control panel with his participation will not work.
Perhaps there are some models that can be more closely friends in Windows. But I believe that a hardware firewall should be used to control traffic no higher than the TCP / IP level. All other access rights and other application-level proxies need to be transferred to the software that runs on the server.

Answer 4

Our enterprise uses Cisco ASA.
Which is clearly controlled by people from the SBU

Answer 5

For such a task (FW + IPS + VPN + AV + WEB-Filter), any UTM solution will do. Checkpoint, Stonesoft, Fortinet, PaloAlto, WatchGuard, thousands of them.
Based on my work experience, I recommend Stonesoft, though for the price for such small implementations it will not be the best option. But as for the functionality and ease of management - out of competition, in my opinion.

Answer 6

I use the Cisco hardware firewall as a base and for the URL I use the TMG web proxy.
True, I don’t really like how it works with HTTPS traffic on it, but I found a partial solution so4net.com/index.php/ru/blog/89-firewall-forefront...