>> don't send out RSTs to denied connections, and other such fun stuff.
for a firewall, not sending an RST for a denied connection, isn´t it the "Right Thing" to do? regards javier On 4/4/08, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of > > Jarrod Friedland > > Sent: Friday, April 04, 2008 03:18 > > To: [email protected] > > Subject: [c-nsp] OT: Check Point v Cisco PIX (ASA 5500 Series) > > > > Hi All > > > > I wonder if anyone can offer me some sound professional > > opinion in terms of > > using a Check Point FW device v Cisco PIX (ASA 5500 Series) Devices. > > > > Currently we are using Checkpoint Devices however, I have an > > opportunity to > > possible include a pix device in our mix, however all my > > reading thus far > > seems to be more based on personal opinion than operational > > pro's and con's. > > > > Im looking for info in relation to can do's and cannots - > > Administration > > comparisons etc. > > > > If you are able to offer some insight but would like to take > > this offline, > > please let me know and I can send you my direct contact details. > > > Since we're using both checkpoint & asas, here's what I think about > them. We only use them for ipsec (enduser & site to site) and packet > filtering. All kinds of protocol inspection run on seperate proxies, > where they belong. > > Checkpoint has a great log viewer, but that's just about all I can say > in their favor. They don't know how to apply rulesets to interfaces, > just globally. Setting up vpns is a pain because they like to send out > strange subnet configs. They're horribly expensive (we ran them on > Nokia's, whose network cards do not support autoneg btw). Their support > is pretty terrible as well. They also need arcane changes to their > backend firewall database whenever something doesn't go as expected. > > Cisco ASAs are pretty cheap and have reasonable performance, but has > lots of strange quirks. They don't decrement TTL by default (and I still > haven't found a way to decrement it over vpn connections), handling icmp > errors is a black art (still haven't gotten mtr working through asa's), > do strange things with your tcp MSS, don't send out RSTs to denied > connections, and other such fun stuff. Most of there can be configured > to work correctly, but they're far from the default. Cisco's central > management tool (Cisco Security Manager) is pretty horrible, I guess the > lag is about 1 year between when the ASA gets a new feature and when > Security Manager learns how to use it. On the other hand, the free gui > (asdm) is pretty decent, and unliky checkpoint it comes with a cli. > Software updates & fixes don't get released as often as checkpoint, > which I consider a downside for the ASAs. > > I still think ASAs are a step up from checkpoint gear, but neither are > great. I'm seriously considering netscreens for my next rollouts. > > If I ever manage to convince the upper echelons here, I'd go with pf on > either openbsd & freebsd. > > // nick > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
