RE: [FW1] Linux/Checkpoint Statefull inspection comparison

[Peter Lukas <plukas@FW1-NOSPAMoss.uswest.net>]

I would suspect that the majority of CP users (specifically those in the
Managed FW Services) only utilize the packet-filtering capabilities of
their product.  That component is relatively trivial.

What makes CP cost money are the multitudes of added security features
which have next to nothing to do with filtering packets.

If all you are using CP fo is to filter traffic and do NAT,
freeware packet filtering solutions like netfilter, ipfw and ipfilter are
all more cost-effective.  

THe pretty CP GUI and useless logging may warrant the hefty price tag,
though.

Peter Lukas

On Thu, 8 Feb 2001, Palmer, Kevin wrote:

> Mark & FW-1 Newsgroup readers,
>  
> SecurityPortal.com had an article several weeks ago about stateful
> firewalling in the 2.4 kernel. See the following link.
> http://www.securityportal.com/cover/coverstory20010122.html
> <http://www.securityportal.com/cover/coverstory20010122.html> 
>  
> There are a number of companies with 500, 250, 100 users or less that are
> considering which firewall makes the most sense for their environment. These
> companies might identify stateful firewalling, IPSec client vpn, and IPSec
> LAN to LAN vpn as key features.
>  
> What is the big picture? How much competition will an improved collection of
> free Linux security tools be to Check Point in a price sensitive SMB market?
> 
>  
> CPVP-VIG-100-3DES-V41  List $8,495    vs.    Linux Solution  $0.00
>  
> How many IT managers might decide that the additional security is not worth
> the price?
>  
> I'm not advocating one solution over another. I would just like to hear what
> avid Check Point supporters think of some of other firewall/vpn products in
> general and the new features in the 2.4 kernel specifically.
>  
> Kevin Palmer
> kpalmer@gsite.com <mailto:kpalmer@gsite.com> 
> 
> -----Original Message-----
> From: Mark Squire [mailto:MSquire@desonline.com]
> Sent: Thursday, February 08, 2001 2:47 PM
> To: Firewall-1 Mailing List (E-mail)
> Subject: [FW1] Linux/Checkpoint Statefull inspection comparison
> 
> 
> 
> Hi all, 
> The Linux kernel now has stateful inspection from what I have read.  Have
> any of you compared it to Checkpoint's stateful inspection?  If so, how do
> you think it compares?  Is it just a cheap immitation, or is it worth the
> while?
> 
> C:\Mark 
> 
> 



================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================