Re: Information on Raptor

[djl () MILLER CS UWM EDU (David J Laumann)]

> We own a Raptor Firewall for NT Integrated Entreprise Network.
> The version is 6.0.
>
> We've been told (by consultants) that this type of firewall has
> many flaws.

perhaps it is a language thing, but what is meant by "this type of firewall"?
statefull packet filtering? application proxy? nt or solaris based? or the
raptor in general?

i think you should question your consultants motives, perhaps they are
sincere but more than likely they want to sell you their brand x of
firewall -which of course has no flaws. ;-)

> We will need to buy a second firewall to reorganize our security
> this year, what is (in your opinion) the best machine?

you really need to start with your policies procedures and practives to find
a firewall. the firewall will only be at *worst* as strong as you've
configured it. i say that because all firewalls are not equal, you really
need to ask: what are you protecting? what's it worth? what sorts of traffic
will you allow ingress, egress, both? what services do you allow http, smtp?
do you expect high volume, if so will application proxy work for you? are you
monitoring log files, does your firewall even generate logs, do you have an
incident response policy/plan? etc... these are the questions your consultants
need to be answering if not generating for you. you can have joe's impenetrable
firewall(tm) and allow xyz traffic to your buggy application server which
just happens to reside on your trusted internal segment and the firewall
suddenly has stopped protecting you. now what?

having set up and played with a few firewalls like the raptor, interceptor,
sonic, cyberguard, pix, ipchains, etc i can say most firewalls (barring some
really bad ones) are only as good as they are configured and the audit trails
they generate. obviuosly, the firewall should not be your sole form of defense,
but just one more tool used in the implementation of your security policy.

since this may be straying off topic id be happy to continue the discussion
via email martin...