Talking about the strategy of firewall purchase

Xu Hongtao Internet Security System (China) Co., Ltd.

With the rapid development of global information wave represented by Internet, network security has also become an important problem affecting network efficiency. As the main means to prevent hacker intrusion, network firewall has become the necessary equipment for network security construction. At present, there are a lot of network firewall products, then how to choose to adapt to their own business needs, to achieve the greatest security effects of products? Here the author thinks, the main should be from the following several aspects to consider.

First of all, as a security device, the firewall has its own sensitivity. This means that we choose the firewall products, must pass the relevant national authority of the certification and sales license, these certifications include the Ministry of Public Security and the Ministry of Information Industry sales license, the National Evaluation Center certification.

Second, the firewall as a network device, performance is a must first consider the problem. If the firewall on the original network bandwidth impact is too large, is undoubtedly a huge waste of the original investment. At present, the firewall in the type of basically realized from the software to the hardware conversion, the algorithm also has a lot of optimization, the performance of some firewalls can be done to the original network performance impact is very small. specifically to the user, the performance of a firewall to identify the pros and cons, mainly to see the authority of evaluation agencies or media performance test results, these results are based on international standards RFC2544 standards, including: Network throughput, packet loss rate, latency, connectivity, and so on, where the throughput is the most important. The addition of the firewall should not affect the unit has been the premise of the business, if your original business has some special services, such as video conferencing, IP telephony and so on. You may want to be careful, and be sure to choose a firewall that supports these protocols.

The function of the firewall is the most valued part of the current user. Now the technical progress of the firewall is very fast, functional also do a variety of, user choice is also more difficult. Personally, the firewall as a security device, security, especially the attack and anti-attack capabilities or should be placed in the first place. The granularity and intensity of the access control is also very important, at present each manufacturer uses basically is based on the state detection packet filtering function. Some additional functions can be depending on the actual needs, for example, for everyone does not have a fixed host unit, may require authentication functions, reasonable control of network resources, may require bandwidth management functions, divided into headquarters and division of the situation, may require the function of VPN communication Internal IP addresses may require address translation functionality, and so on.

As far as the firewall itself, it is only a separate product, to rely on a firewall to achieve the security of the network is not realistic. To achieve the security of the network, the most important is a security policy, a security firewall configuration of a set of unsafe policies is also ineffective, security policies include other security devices in the network, even including how these security devices work with the firewall and so on. Therefore, the purchase of a firewall, should not simply understand for the purchase of a product, should be purchased a set of security services, so manufacturers of technical strength and professional strength is also not to be ignored.