[26327] in resnet
Re: Security appliance options
daemon@ATHENA.MIT.EDU (Jeff Kell)
Fri May 6 23:48:08 2011
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="------------080707020706020504080404"
Message-ID: <4DC4C0E0.2050809@utc.edu>
Date: Fri, 6 May 2011 23:47:44 -0400
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: Jeff Kell <jeff-kell@utc.edu>
To: RESNET-L@listserv.nd.edu
In-Reply-To: <C9EA3029.15944%wpwhite@utk.edu>
--------------080707020706020504080404
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 8bit
On 5/6/2011 11:11 PM, White, William P (Bill) wrote:
> Robert,
>
> TippingPoint IPS have been a real success at the University of Tennessee.
I'll second that, UT-Chattanooga has one as well. One "big plus" is
their Reputation filtering, which handles a sizeable blacklist of IPs
and DNS names. It scales much better than anything else we tried along
those lines.
For firewall, we use Cisco ASAs in an active/active configuration. It
limits your features that way (no VPN, no dynamic routing) but provides
good load balancing (we run campus on one and resnet on the other, but
they provide failover for each other). If you don't need active/active,
you can get the full feature set. We're doing VPN elsewhere.
The ASAs also have the IPS modules in them. The Cisco IPS has been
steadily diminishing in value (it sits in front of the TP and our
internal passive Snort IDS, and from the hits on the other two, doesn't
catch much).
We also do a little heavy-handed but low-overhead filtering at the edge,
e.g., null routing the Spamhaus DROP list, which helps.
Never checked into Fortinet here.
Jeff
>
> We are actually in the middle of a firewall eval. We just called
> Fortinet. What it is that you are not impressed about?
>
> Bill
>
> From: Robert Harris <r_harris@Culinary.Edu <mailto:r_harris@Culinary.Edu>>
> Reply-To: Resnet Forum <RESNET-L@LISTSERV.ND.EDU
> <mailto:RESNET-L@LISTSERV.ND.EDU>>
> Date: Fri, 6 May 2011 13:09:54 -0400
> To: <RESNET-L@LISTSERV.ND.EDU <mailto:RESNET-L@LISTSERV.ND.EDU>>
> Subject: Security appliance options
>
> Good morning,
>
> What is everyone using for security appliances?
>
> We've had fortinet products on campus for a few years and are not
> terribly impressed.
>
> We're really just looking for some basic AV/IPS protection, maybe some
> spam blocking.
>
> The fortigate was a great idea for multiple layers in addition to our
> main firewalls and mail system, but the product hasn't impressed and
> the sales support is also not very enthusiastic.
>
> What type of stand alone products are people using out there?
>
> Thanks!
>
> *Robert Harris
> */Manager of Network /
> /and Audio/Video
> /
> *Culinary Institute of America*
> 1946 Campus Drive
> Hyde Park, NY
> 845-451-1681
> www.ciachef.edu <http://www.ciachef.edu/>
>
> *Food is Life*
>
> *Create and Savor Yours.™*
>
> **
>
> **
>
> **Please consider the environment before printing this e-mail.**
>
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
--------------080707020706020504080404
Content-Type: text/html; charset="windows-1252"
Content-Transfer-Encoding: 8bit
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 5/6/2011 11:11 PM, White, William P (Bill) wrote:
<blockquote cite="mid:C9EA3029.15944%25wpwhite@utk.edu" type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<div>Robert,</div>
<div><br>
</div>
<div>TippingPoint IPS have been a real success at the University
of Tennessee.</div>
</blockquote>
<br>
I'll second that, UT-Chattanooga has one as well. One "big plus" is
their Reputation filtering, which handles a sizeable blacklist of
IPs and DNS names. It scales much better than anything else we
tried along those lines.<br>
<br>
For firewall, we use Cisco ASAs in an active/active configuration.
It limits your features that way (no VPN, no dynamic routing) but
provides good load balancing (we run campus on one and resnet on the
other, but they provide failover for each other). If you don't need
active/active, you can get the full feature set. We're doing VPN
elsewhere.<br>
<br>
The ASAs also have the IPS modules in them. The Cisco IPS has been
steadily diminishing in value (it sits in front of the TP and our
internal passive Snort IDS, and from the hits on the other two,
doesn't catch much).<br>
<br>
We also do a little heavy-handed but low-overhead filtering at the
edge, e.g., null routing the Spamhaus DROP list, which helps.<br>
<br>
Never checked into Fortinet here.<br>
<br>
Jeff<br>
<br>
<blockquote cite="mid:C9EA3029.15944%25wpwhite@utk.edu" type="cite">
<div><br>
</div>
<div>We are actually in the middle of a firewall eval. We just
called Fortinet. What it is that you are not impressed about?</div>
<div><br>
</div>
<div>Bill</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family: Calibri; font-size: 11pt; text-align:
left; color: black; border-width: 1pt medium medium;
border-style: solid none none; border-color: rgb(181, 196,
223) -moz-use-text-color -moz-use-text-color; padding: 3pt 0in
0in;">
<span style="font-weight: bold;">From: </span>Robert Harris
<<a moz-do-not-send="true"
href="mailto:r_harris@Culinary.Edu">r_harris@Culinary.Edu</a>><br>
<span style="font-weight: bold;">Reply-To: </span>Resnet
Forum <<a moz-do-not-send="true"
href="mailto:RESNET-L@LISTSERV.ND.EDU">RESNET-L@LISTSERV.ND.EDU</a>><br>
<span style="font-weight: bold;">Date: </span>Fri, 6 May 2011
13:09:54 -0400<br>
<span style="font-weight: bold;">To: </span><<a
moz-do-not-send="true"
href="mailto:RESNET-L@LISTSERV.ND.EDU">RESNET-L@LISTSERV.ND.EDU</a>><br>
<span style="font-weight: bold;">Subject: </span>Security
appliance options<br>
</div>
<div><br>
</div>
<div>
<div style="margin: 4px 4px 1px; font: 10pt Segoe UI;">
<div>Good morning, </div>
<div> </div>
<div>What is everyone using for security appliances?</div>
<div> </div>
<div>We've had fortinet products on campus for a few years
and are not terribly impressed.
</div>
<div> </div>
<div>We're really just looking for some basic AV/IPS
protection, maybe some spam blocking.</div>
<div> </div>
<div>The fortigate was a great idea for multiple layers in
addition to our main firewalls and mail system, but the
product hasn't impressed and the sales support is also not
very enthusiastic.
</div>
<div> </div>
<div>What type of stand alone products are people using out
there?</div>
<div> </div>
<div>Thanks!</div>
<div> </div>
<div>
<div><font size="2" face="Arial"><strong>Robert Harris<br>
</strong><em>Manager of Network </em></font></div>
<div><font size="2" face="Arial"><em>and Audio/Video<br>
</em></font></div>
<div><font size="2" face="Arial"><strong>Culinary
Institute of America</strong></font></div>
<div><font size="2" face="Arial">1946 Campus Drive</font></div>
<div><font size="2" face="Arial">Hyde Park, NY<br>
845-451-1681</font></div>
<div><font size="2" face="Arial"><a moz-do-not-send="true"
href="http://www.ciachef.edu/">www.ciachef.edu</a>
<br>
</font></div>
<div><font size="2" face="Arial">
<p style="margin: 0in 0in 0pt;" class="MsoNormal"><b
style=""><span style="font-size: 10pt;
font-family: Arial,sans-serif;">Food is Life<o:p></o:p></span></b></p>
<p style="margin: 0in 0in 0pt;" class="MsoNormal"><b
style=""><span style="font-size: 10pt;
font-family: Arial,sans-serif;">Create and Savor
Yours.™</span></b></p>
<p style="margin: 0in 0in 0pt;" class="MsoNormal"><b
style=""><span style="font-size: 10pt;
font-family: Arial,sans-serif;"></span></b> </p>
<b style=""><span style="font-size: 10pt; font-family:
Arial,sans-serif;"></span></b>
<p style="margin: 0in 0in 0pt;" class="MsoNormal"><b
style=""><b style=""><span style="color: green;
font-size: 9pt; font-family:
Arial,sans-serif;">Please consider the
environment before printing this e-mail.</span></b></b><br>
</p>
</font></div>
</div>
</div>
</div>
</span></blockquote>
<br>
</body>
</html>
___________________________________________________
You are subscribed to the ResNet-L mailing list.
<p>
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
--------------080707020706020504080404--
