1

We are moving a high traffic site (20Mb/s - 80Mb/s) to a co-location instead a dedicated server at a hosting company. As part of the infrastructure build-out we are deciding between buying a FortiGate 110C or a capable used 1U Server and installing pfSense on it.

There are obvious cost differences between the latter option but FortiGate seems to be safer solution. Is there anything that I should be taking into consideration when making this decision that might push me one direction or another.

UPDATE 2009/12/23:

I have decided to go with the FortiGate option. I like the idea of pfSense and may try that out later. FortiGate was the safer (and more expensive) choice. However, I have 2 weeks to get this up and going and that seemed to be the smart move considering.

Nathan Palmer
  • 205
  • 3
  • 7
  • Have you considered other vendors, such as BorderWare? It seems to me that the critical factors to consider would be interface speed, packets per second capability, and concurrent session limits. – joeqwerty Dec 22 '09 at 04:48

2 Answers2

1

Well I'll bite with an answer.

Assuming the 1U is a quality server and under support I think both solutions are viable. It boils down to how comfortable you are with setting each of these up properly. As the security these provide is directly related to how well they are configured.

I happen to like the Fortigates that I run. Despite being an appliance they are pretty flexible and configurable. The entire product family shares the same features and web and cli interfaces which makes them pretty easy to manage. I've been satisfied with their support the few times that I've needed it. Fortigate/Fortinet also operates a bunch of honeypots spread around the world which they monitor and based on what they are seeing they roll out IDS and Anti-X updates quickly to address any new threats.

3dinfluence
  • 12,449
  • 2
  • 28
  • 41
  • I'm certainly comfortable with either solution. But I may not know all the right tricks with pfSense. Where out of the box I assume FortiGate will be already in a secure mode. – Nathan Palmer Dec 22 '09 at 21:55
  • By default I would bet that both solutions offer a similar level of security of not allowing any network traffic in or out of any interface. It really does boil down to setting it up correctly. The IDS portion of both products will require that you know what you're protecting and enabling the applicable rules. Otherwise you'll get a lot of background noise via useless alerts on attack vectors that aren't valid for your system. pfSense is also based off FreeBSD which as a terrific record of being secure by default. – 3dinfluence Dec 22 '09 at 22:46
  • If you want/need IPS/IDS, anti-spam, anti-malware, and anti-virus protection I would go with Fortigate. Even though there are Anti-virus and snort packages for pfSense I would still feel better with the Fortigate solution. However if you just need a good firewall and VPN then I think either would work. – 3dinfluence Dec 22 '09 at 22:48
  • I need a great Firewall and good IDS. VPN would be nice but not necessary. I don't think that I need anything else. This will be in front of a website and it's in a data center where these servers are all there is. – Nathan Palmer Dec 23 '09 at 02:28
0

Any halfway recent server-grade system will handle a few hundred Mbps of traffic without any problem. I wouldn't touch the Fortigate with thick gloves and a mask.

womble
  • 96,255
  • 29
  • 175
  • 230
  • 2
    I love PFSense. If it were my wife I would... no lets not go there – Mark Henderson Dec 22 '09 at 03:34
  • What's wrong with Fortigate? The guy who started Fortinet also started NetScreen before he sold the company to Juniper. And everyone seems to hold the NetScreen products in high regard. They seem to have a great product to me. – 3dinfluence Dec 22 '09 at 03:43
  • Thanks for the response. I would like to add some weight to my choice. Is there something specific that is bad about Fortigate, or particularly good about pfSense/custom hardware? – Nathan Palmer Dec 22 '09 at 04:04
  • 3
    Appliances are just irritatingly inflexible; sure they've got the pretty GUI, but the moment you want to do something out of the ordinary you're boned. – womble Dec 22 '09 at 04:41