firewall management

Started by icecream-guy, January 27, 2015, 10:55:23 AM

Previous topic - Next topic
Print
Go Down Pages1
User actions

icecream-guy

January 27, 2015, 10:55:23 AM
what's that tool some of you guys use to manage mixed firewall environments.  i remember it being mentioned on another site, but I can't find it...
:professorcat:

My Moral Fibers have been cut.

javentre

#1
January 27, 2015, 12:23:54 PM
Firemon.
[url="http://networking.ventrefamily.com"]http://networking.ventrefamily.com[/url]

deanwebb

#2
January 27, 2015, 04:10:28 PM
Tufin, and I love it.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

icecream-guy

#3
January 28, 2015, 07:33:36 AM
looks like they are competitors?
:professorcat:

My Moral Fibers have been cut.

deanwebb

#4
January 28, 2015, 08:07:14 AM
Yes, they are. I'm not going to be a Tufin fanboy, because there are places where that product can still improve, but I am still a big fan of the product because it provides some solid management tools.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

mmcgurty

#5
January 28, 2015, 09:09:49 AM
What types of firewalls are you using to Tufin to manage?  We have CheckPoints, Cisco ASA's, and most recently added a pair of Palo Alto PA-5050's.

We still use Cisco Security Manager for our FWSM's and the basic Cisco ASA ADSM for individual units (5520's).  CheckPoint is SmartDashboard/SmartView Tracker.  Palo Alto is another team, but I think it is just a web interface.

Seittit

#6
January 28, 2015, 09:39:27 AM
Quote from: mmcgurty on January 28, 2015, 09:09:49 AM
Palo Alto is another team, but I think it is just a web interface.

Palo Alto uses a central manager called Panorama, but you can get down and dirty on the CLI too.

deanwebb

#7
January 28, 2015, 10:55:43 AM
Quote from: mmcgurty on January 28, 2015, 09:09:49 AM
What types of firewalls are you using to Tufin to manage?  We have CheckPoints, Cisco ASA's, and most recently added a pair of Palo Alto PA-5050's.

We still use Cisco Security Manager for our FWSM's and the basic Cisco ASA ADSM for individual units (5520's).  CheckPoint is SmartDashboard/SmartView Tracker.  Palo Alto is another team, but I think it is just a web interface.
Tufin will manage all those vendors, also F5, Stonegate, and Fortigate. We are also looking at using it as our router and switch config manager, since we have it set up and it can perform in that capacity, as well.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

mmcgurty

#8
January 28, 2015, 01:38:11 PM
Quote from: deanwebb on January 28, 2015, 10:55:43 AM
Quote from: mmcgurty on January 28, 2015, 09:09:49 AM
What types of firewalls are you using to Tufin to manage?  We have CheckPoints, Cisco ASA's, and most recently added a pair of Palo Alto PA-5050's.

We still use Cisco Security Manager for our FWSM's and the basic Cisco ASA ADSM for individual units (5520's).  CheckPoint is SmartDashboard/SmartView Tracker.  Palo Alto is another team, but I think it is just a web interface.
Tufin will manage all those vendors, also F5, Stonegate, and Fortigate. We are also looking at using it as our router and switch config manager, since we have it set up and it can perform in that capacity, as well.

Oh wow!  We have lots of F5.  Do you have a rough idea of the costs for this?  Is it like $100K out of the gate or like $5K to $10K?

deanwebb

#9
January 28, 2015, 01:43:31 PM
I'm no pre-sales engineer, let alone a sales guy, so I don't have any price sheets handy. There's a one-off expense for initial hardware, then license costs for each device monitored. How many boxes do you have?
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

mmcgurty

#10
January 28, 2015, 02:49:22 PM
Quote from: deanwebb on January 28, 2015, 01:43:31 PM
I'm no pre-sales engineer, let alone a sales guy, so I don't have any price sheets handy. There's a one-off expense for initial hardware, then license costs for each device monitored. How many boxes do you have?

6 CheckPoints, 12 or more Cisco FWSM/ASA's, 22 F5's, 2 Palo Alto's.  Not extensive but enough that it drives cost upwards I'm sure.

deanwebb

#11
January 28, 2015, 05:28:41 PM
That's about the size of our pilot deployment. What's your budget for a monitoring system?
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

mmcgurty

#12
January 30, 2015, 08:08:05 AM
No budget in 2015 for monitoring.  We were considering a basic deployment of NetBrain for like $20K and even that got shot down.  However, if we had money free towards the end of the year we might be able to swing something like this.  Firewall management has been a real thorn in our side which is why we are doing everything on the individual systems.

deanwebb

#13
January 30, 2015, 12:12:12 PM
With 40-50 firewalls, you really do need a monitoring system. $150-200K might be the pricetag, by my guess.
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.
Print
Go Up Pages1
User actions