Juniper SRX vs. Sophos Firewall

Juniper vSRX is an excellent edge gateway device. The combination of Tunneling protocols supported and the advanced routing & security features makes it perfect for this kind of deployment. It is available in physical, virtual appliances as well as support on multiple clouds so you can have the same box be your edge gateway in multiple environments for consistency.

It can also work as a Internet Gateway, DMZ Firewall/Router and it would function just fine.

While it can also work as a DC firewall (North-South), the poor GUI will make it harder in the day to day administration for the multiple policies in a DC.

Incentivized

It is well-suited for small, medium, and large organizations looking for comprehensive cybersecurity protection. It will not only safeguard their network from cyberattacks but also provide them with many advanced features like deep packet inspection, centralized management, web filtering, application control, etc. in one place. It will help them optimize bandwidth and ensure continued connectivity.

Incentivized

• The Juniper SRX platform is easy to set up (out of the box).
• The support team responds to tickets quickly and with good solutions.

Incentivized

• Web filtering. This allows us to monitor web usage and block certain categories from being access at the perimeter.
• Application Control. With application control we can block certain applications that get categorized from working accessing the Internet.
• Synchronized Security. When utilizing the Sophos Endpoint product you can use Synchronized Security to minimize Lateral Movement in a network. If a machine is shows a Red status you can auto-isolate it and it is unable to communicate with anything else on the network.

Incentivized

• Some of the more complex setups (clustered HA, etc.) can be a little difficult to configure.
• The lowest-end model that supports true multi-site HA is relatively expensive. It would be nice to have that option in lower models.
• Some configuration options (particularly the way address book entries are done) can get tedious and make for very long configs.

Incentivized

• If using Endpoint security and the Firewall it would be nice to have an easier back and forth between the portals rather than have two separate tabs open. Especially if using more than one in multiple locations.
• If dealing with different revisions options are moved around and sometimes in places that doesn't normally seem like they should be there.

Incentivized

Because this is a user-friendly interface, and anyone can use it there are multiple articles and guidelines available, it has advanced-level security features. they provide VPN solutions all the features are very practical, SSID MAC-based authentications web control, Firewall rules segregation of the rules and policies, On-premises Active directory single sign-on feature is also available.

This is the one area where I have a beef with Juniper. When I called into Cisco TAC, 90% of the time, the first person I spoke with was able to resolve my issue. With Juniper TAC, 90% of the time, the first person I speak with is not able to resolve my issue, seems to almost be reading from a script, and must escalate my ticket. All of which takes time.

Incentivized

As we are all addicted to graphics-oriented interfaces for all our life products. Easy to manage and access as a good way of using anything

Equipment prices ran about the same. Performance and management were also more or less equal. The biggest deciding factors for going with Juniper were (1) fewer security incidents related to SRX firewalls and (2) technical support costs were significantly less.

Incentivized

I was a big fan of Cisco ASA products, but when I saw all of the security feature differences between both firewalls, I moved to Sophos devices. Its sandbox, IPS, and many more features are really advanced. Cisco does not provide features like this.

Incentivized

• It is a workhorse for our field operations. It provides the last touch for an ISP to the customer. The customer has no view of the device, but with the repeatability of the device, they do not need to.
• The ability to roll out a dynamic routing protocol attached to a security zone allows elasticity to the environment that supports growth.
• VLAN support on the inside interfaces allow this to be the only device in some smaller deployments we install these in.

Incentivized

• True UTM device.
• Very Active customer help for any help.
• Easy license and cost effective.
• Should [do] more work on logging and reporting.