WIXLIB

SonicWall Next-GenerationFirewall Buyer’s GuideHow to choose the right next-generationfirewall to secure your network

Table of ContentsExecutive Summary3Evolution of the Firewall4Essential NGFW Capabilities5Selecting Advanced NGFW Features7Networking Requirements8Management8Technology Integration9NGFW Deployments9Price-Performance Ratio and Support10NGFW Feature Comparison of Top Five Vendors11Conclusion and Next Steps12About SonicWall132 SonicWall NGFW Buyer’s Guide

Executive SummaryRansomware is up. IoT attacks are up. Encrypted threats areup. In a rapidly changing IT landscape — one characterized bycompanies rushing headlong into the cloud, network trafficpercent increases in the double digits, and BYOD and remotework policies — cybercriminals are enjoying unprecedentedopportunities. And protecting against these attacks isbecoming increasingly challenging, as businesses need toprotect multiple attack surfaces and implement the latestsecurity controls just to keep up.The enterprise perimeter now extends to anywhere workgets done. And regardless of whether your entry points areon-premises, in the cloud, in the data center or at the branchoffice, each one needs to be protected. The good news3 SonicWall NGFW Buyer’s Guideis that security defenses have evolved, too — particularlyfirewalls, the most important security defense to protectany enterprise perimeter, including those of distributed anddiffuse enterprises.The firewalls of today are more agile, more capable and morepowerful than when the technology debuted 20 years ago. Asenterprises consider these next-generation firewalls (NGFW),there are several criteria that should be considered, includingfeatures, platform capabilities, performance and management.

Evolution of the FirewallCybercrime looks nothing like it did two decades ago.Fortunately, neither do firewalls: Today’s next-generation firewallsfeature a host of new security controls, significantly higherperformance and a great variety of form factors. How do thesefirewalls compare to their early ancestors? Let’s take a look:Zone-Based Firewall (ZBF)Zone-based firewall is like stateful firewall, except it isconfigured using more advanced networking concepts.Instead of assigning rules based on connection and interfaces,an administrator would create zones and assign multipleinterfaces to those zones. Some of the common zones usedare LAN (private or trusted), WAN (public or untrusted) andDMZ (demilitarized zone). Multiple zones can have rules to fullyinspect, allow or deny connections.Access Control Lists (ACLs) orStateless FirewallNetwork ACLs have existed for a long time. They are usedto filter network traffic. With ACLs, traffic can be allowed ordenied in both inbound and outbound directions. NetworkACLs are typically configured in routers, switches or serversusing layer 2 to layer 4 rules based on IP address, MAC addressand ports.Unified Threat Management (UTM)UTM firewalls were originally designed to consolidatemultiple stand-alone security controls into a single appliance.Security controls (such as firewall, intrusion prevention, URLfiltering and antivirus) are combined into a single operatingsystem and management console. This solution is idealfor small and medium-sized businesses that do not have abig security budget, or do not have high performance andscalability requirements.A typical ACL rule in a network device looks as follows: Rule Number ACL Name Source IP / Port Destination IP / Port Allow / Deny ACLs inspect individual packets but do not inspect flows ormaintain state of the flow.Next-Generation Firewall (NGFW)Stateful FirewallThe concept of NGFW was first defined by Gartner, publisherof the Magic Quadrant for Network Firewalls. NGFWs havethe option to add all the security controls that are availablein UTMs, as well as advanced controls such as VPN, usercontrol, application control and sandboxing. Apart fromadvanced security controls, NGFWs are designed tosupport the high performance and scalability needs of largeenterprises. The rest of this document will focus on NGFWsand different factors that enterprises should consider in theirbuying decision.Stateful firewall is different from ACLs or stateless firewall,mainly because they can inspect network connections allthe way from layer 2 to layer 7. Stateful firewalls maintainthe context of a given connection. This means packets arematched to connections they belong to, offering additionalsecurity to prevent hacking techniques like spoofing. Somestateful firewalls can also perform deep packet inspection andcan be installed on dedicated hardware.OSILayers14INTRUSIONDETECTION ANDPREVENTION SYSTEMSTATEFULFIREWALLSACLS1990’s4 SonicWall NGFW Buyer’s GuideZONE BASEDFIREWALLWITH VPN2000’s7NEXT GENERATIONFIREWALLAPPLICATIONCONTROLAND URL FILTERING2010’s

Essential NGFW CapabilitiesZone-Based Firewall (ZBF)Application ControlZBFs offer stateful inspection with advanced network securityfeatures for large enterprise network infrastructure. A ZBF orstateful firewall is the foundation for any NGFW, and a basicrequirement to support other features. Choose ZBFs overstateful firewalls for enterprises with large networks, as it iseasier to configure and define policies with ZBFs.NGFWs came into fruition with the addition of applicationcontrol, IPS and URL filtering, forming a single enterpriseclass platform. Application control allows enterprises todefine firewall policies based on applications (e.g., Facebook,YouTube, Salesforce) and micro-applications (e.g., chat andIMs). Application Control gives granular control over networktraffic based on user identity and email addresses whileproviding application-layer access control to regulate webbrowsing, file transfer, email exchange and email attachments.Virtual Private Network (VPN)Distributed enterprises typically have remote branch officesthat need secure access to the corporate network. Therecent expansion in Work-From-Home (WFH) policies has alsoresulted in many employees working remotely. VPNs providerobust, secure access to corporate networks and resources,so it is essential to consider VPN as part of your NGFW.It is important to make sure the NGFW provides acomprehensive VPN solution with site-to-site andremote-access encryption. It should include advancedfeatures such as route-based VPN and easy VPN with dynamicrouting. A VPN is also important in case you are considering anSD-WAN solution.VPN configuration should be simple. It needs to be managedfrom within the NGFW user interface, with configurationwizards that provide step-by-step guidance in setting up theVPN tunnels. Enterprises should consider a VPN concentratorat the edge to manage both IPsec and SSL VPN connections.Intrusion Prevention SystemIntrusion Detection and (or) Prevention System (IDS/IPS)was originally developed as a stand-alone solution, whichlater became part of the NGFW stack. IPS within the NGFWprovides an additional layer of needed security by stoppingattacks that exploit vulnerabilities. The intrusion detectionis done using signatures for known exploits, and is based onanomaly detection.IPS within the NGFW can be deployed in detection mode(alert only) or in prevention mode (alert and block). There isno performance penalty for detection mode compared toprevention mode. Initially configure IPS in detection modebefore moving to prevention mode to understand exploits,explore false positives and perform incident responses. Animportant aspect to look for in an IPS is the threat intelligencefeed that keeps the signature database up to date in the NGFW.5 SonicWall NGFW Buyer’s GuideLook at the type of applications that are included in a NGFWdatabase to make sure all the applications that are in use withinthe enterprise are supported.Web Control (URL Filtering)Web control compares requested websites against a massivedatabase containing millions of rated URLs, IP addresses anddomains. It enables administrators to create and apply policiesthat allow or deny access to websites based on individual orgroup identity, or by time of day, using pre-defined categories.It also dynamically caches website ratings locally onto theNGFW for instantaneous response times. An NGFW should beable to do URL filtering based on business point of view (blockbased on category – business) as well as based on security(block based on reputation – security).Consider NGFWs with threat intelligence feeds that issupported by world-class research team for IPS, applicationcontrol and web control to make sure NGFW stopslatest threats.

This year, we havealso seen VPNs asone of the top securityfeatures being usedby customers.2019 MAGIC QUADRANT FORENTERPRISE FIREWALLS6 SonicWall NGFW Buyer’s Guide

Selecting Advanced NGFW FeaturesNetwork and Cloud SandboxingFor effective zero-day threat protection, enterprises needNGFWs that include malware-analysis technologies and candetect evasive advanced threats. Sandboxing technologyscans traffic and extracts suspicious code for analysis, butunlike other NGFW security controls, it also analyzes a broadrange of file types and sizes. This enables enterprises tostop zero-day and evasive threats that can slip through othersecurity controls within NGFW.Enterprises need to consider solutions that offer both onpremises and cloud-delivered sandboxing based on theirperformance and privacy needs. This technology should beaugmented with global threat intelligence infrastructure thatrapidly deploys remediation signatures for newly identifiedthreats to all NGFWs in the enterprise, thus preventingfurther infiltration.Enterprises should consider sandboxing technology thatexamines every byte until the last byte before delivering afinal verdict to allow or block. This avoids any false positivesor negatives and ensures that highly elusive zero-day threatsare blocked.Multi-instance firewallMulti-instance is a modern next-generation approach to legacymulti-tenancy that supports multiple firewalls with separateconfiguration on a single appliance. With this approach, eachfirewall instance is isolated with dedicated compute resourcesto avoid resource starvation.7 SonicWall NGFW Buyer’s GuideLook for dedicatedthreat intelligence whenevaluating NGFWs.This allows enterprises to use containerized architecture.Enterprises can run multiple independent firewall instances,software versions and configurations on the same hardwarewithout managing different physical appliances.Dedicated Threat IntelligenceAs mentioned earlier, most of the security controls in an NGFWshould be augmented by threat intelligence to keep themup-to-date on the latest threats and signatures, among otherthings. Threat intelligence feeds should be supported by aresearch team that gathers, analyzes and vets informationround the clock and across the globe. Look for vendors witha dedicated team of cybersecurity professionals, advancedmachine learning algorithms and security sensors that arespread around the globe to deliver up-to-date threat feeds thatautomatically block threats in nanoseconds. While looking intothreat intelligence in NGFWs, it is important to consider DNSsecurity that protects enterprises against malicious domains.