Firewall Reviews From the Frontlines

What do you recommend for a corporate firewall implementation? I have six geographically dispersed locations.

We have been using SonicWALL for about 12 years but over the last couple of years have been moving to the Sophos SG Series. I know many people complain about SonicWALL reliability issues, but for us the UI just didn't keep up with the features they have added on over the years. I also don't care for the perpetual "early release" firmware. We also have a couple of FortiGate units for specific uses. Very reliable but not nearly as user friendly.

Depending on the size of the company, most enterprise-level firewalls will demonstrate a centralized management console capable of managing many disparate firewall locations, as well as the virtual elements within each.

If you are at this level, my preference would be the Palo Alto system, that allows the administrator to create rules, and abstractions that ultimately lead to an administrator putting together a policy like: "Inbound reverse web proxy" -> "any external system" -> "our reverse proxies" -> "web protocols". So, while this terminology is still ancient rule-base logic, the wording of the policy is actually readable. In other areas of the system you define what IP address belong to your reverse proxies, what web protocols you will allow, etc.

Like many complex systems, these firewalls may be more capable than you need; IPS, firewall, threat intelligence, malware detection, etc...just ignore the added features until you find the need to expand your requirements, and they will come naturally if needed.

The original question did mention ease of use, showing throughput, and the need to connect several regions, which is why I recommended Meraki products. In my opinion, they are by far the easiest firewall to set up and a total no-brainer for distributed use. It is nigh on impossible to accidentally disconnect your remote offices due to configuration mess up, and even if you do, the out-of-band management will allow you to correct the issue. If you know what you're doing, then I'd go with pfSense. Powerful and affordable, and free even if you can do without the support.

We have Meraki MX in our headquarters office as the needs there are simple and ease of management is a top priority along with all the stuff the Advanced Security license brings. We use pfSense in our data center rack

FortiGate firewalls are best suited for these purposes. You may select the appropriate model either by comparing specs on their website or talking to one of their consultants. Only shortfall with Fortigate is that one needs to be trained to configure and manage these devices. So, you either learn it yourself or sign up a support partner. Online support is not very great for setting the device up. But, pretty quick and efficient in helping resolve specific issues faced.