I have not had much success compiling a workable overview on the topic of firewalls and application service providers, despite making a rather extensive contribution to Google's workload this month. I'm hoping the SE community can share some pointers, perhaps shed enough light to balance the Vendor brochures and "the completely unbiased paper that we paid someone to write" :)
There is a lot of focus on
NGFW (like Palo Alto),
WAF (like Imperva) and
ADC (like F5) alongside feature-packed upgrades to classic firewall brands (like CheckPoint).
Most of the marketing appears to be target around users and systems accessing a wide variety of applications and services using any number of protocols. Surely the common scenario if you have a corporate network with users, assets and also services, but mostly behaving as what I might refer to as
However, it's not clear to me which features will be of value to a
service provider, where the application delivery network only has to support a very few, very specific applications, services and protocols - and where there are no users that must be protected from nothing and everything ranging from phishing attacks and e-mail attached malware to unhealthy surfing habits. On the other hand performance and availability is critical, and we can safely assume APT (likely several).
Typical traffic might be:
inbound HTTPS - Application access (clients) - API access (partnering services, clients) - VPN access for operational personnel outbound DNS - lookup external services - reverse lookup connections to application(s) outbound HTTPS - External API access (vendors, partnering services) - SSO integrations - Access to software updates outbound SMTP (STARTTLS) - Forwarding mail to specific relay services outbound NTP - Need to sync with something.
How do you go about finding and selecting a vendor or solution?
- What considerations come into play?
- Any features particularly useful to service providers?
- Any next generation firewall (NGFW) features that can safely be ignored?
- What about application firewalls (WAF)?
- Which firewall features might be required and which add value but remain optional?
- Can you safely leave firewall functions to an ADC or load balancer?
- Might one need to combine several types of firewall devices?
- IPS/IDS functions covered in the firewall, or dedicated?