topic Re: Appliance or VSEC VE in Firewall and Security Management

Appliance or VSEC VE

Javad_Nicou — Tue, 06 Mar 2018 01:11:50 GMT

Hi ,

I have openserver firewall (R60) and would like to upgrade to R80.10 . the current firewall is internet facing firewall and I would like to enable NGTX blades and web filtering as well .

I unable to use #cpsizeme script because of old version of OS and open-server environment .I also have VSEC VE license which I can use it for this deployment but I would like to choose the right product ( Appliance or VSEC VE ) for this deployment .

400 users (end-point )

5 site to site VPN

15 NATS

15 connected network

Could you help me to choose right product .

Thanks in advance for your help .

Re: Appliance or VSEC VE

PhoneBoy — Tue, 06 Mar 2018 01:42:06 GMT

What's the throughout of your Internet connection?

That's probably going to be your limiting factor.

Your existing Open Server license can be traded in for whatever option you choose.

What SKU is your VE license? This may also need to be traded in depending on the vintage.

Re: Appliance or VSEC VE

Javad_Nicou — Tue, 06 Mar 2018 02:13:44 GMT

Hi Mate ,

Internet Connection : 300 Mbs

What do you recommend VE or appliance ? what model of appliance ?

We purchased the VE last week for different scope but I can use it for this priority project .

Cheers ,

Javad

Re: Appliance or VSEC VE

PhoneBoy — Tue, 06 Mar 2018 02:55:06 GMT

Assuming it's a perimeter gateway, I would go with an appliance to provide protection for your VM farm.

Based on the limited information you provided, the minimum appliance I would go with is a 5600, which does give you some room to grow.

If you have specific interface requirements, or there are significant internal traffic flows through this gateway, that might change the appliance recommendation.

If you're going to go with VE (what we now call CloudGuard IaaS, or more recently vSEC), I would opt for a 4 core VM, which also gives some room to grow.

Again, if there are significant internal traffic flows through this gateway, that might change this recommendation.

You may also want to consider acquiring both options.

Of course, you should run all of the above (with more detail about your environment) by your Check Point SE, who should be able to provide a more precise recommendation.

Re: Appliance or VSEC VE

G_W_Albrecht — Tue, 06 Mar 2018 13:51:26 GMT

I think the best thing to do is to use the CP Appliance Sizing Tool

Three further points to ponder:

- i would go for HA Clustering the GW appliances

- i would use appliances with two PSUs each

- i would use a virtualized (VM) SMS

Re: Appliance or VSEC VE

Hugo_vd_Kooij — Thu, 08 Mar 2018 10:35:53 GMT

Keep in mind. There is no sane upgrade path from R60 to R80.10.

It is faster to take the network drawing and build a new policy.

Re: Appliance or VSEC VE

Lloyd_Barnett — Wed, 14 Mar 2018 18:09:47 GMT

I love it -"sane"... IE: not in your right mind, nor in this physical or ethereal realm.

Re: Appliance or VSEC VE

PhoneBoy — Wed, 14 Mar 2018 19:49:35 GMT

Just to prove the point, here's what the Upgrade Wizard says:

This does not include the steps to get to R65, which I think you can do from R60, but that's merely a guess.