Do you have a specific model number?

Their performance can vary based on the model, and we found that the older devices (TZ205, etc) are very-very slow with UFB. Had to replace quite a few of them to get the full bandwidth out of the UFB connection.

engedib:

 

Do you have a specific model number?

 

Their performance can vary based on the model, and we found that the older devices (TZ205, etc) are very-very slow with UFB. Had to replace quite a few of them to get the full bandwidth out of the UFB connection.

 

Yes, the Sonicwall SOHO (It's called that).

The SOHO (in just firewall mode - without content filtering or UTM) can route 200/200Mbit however this is pushing it to its limits. As soon as you enable UTM this will drop down to ~60-80Mbit. Really, not suitable for a UFB connection and rather suited for a small office lets say 50Mbit connection. They're not fast devices.

Take a look at the Fortinet products - they're fast (ASIC powered) and also have very good firmware Here. The local NZ supplier (Ingram Micro) was pretty happy to provide me with one for a couple of months for testing.

michaelmurfy:

 

The SOHO (in just firewall mode - without content filtering or UTM) can route 200/200Mbit however this is pushing it to its limits. As soon as you enable UTM this will drop down to ~60-80Mbit. Really, not suitable for a UFB connection and rather suited for a small office lets say 50Mbit connection. They're not fast devices.

 

Take a look at the Fortinet products - they're fast (ASIC powered) and also have very good firmware Here. The local NZ supplier (Ingram Micro) was pretty happy to provide me with one for a couple of months for testing.

 

We have Sonicwall everywhere else, so I am not keen to switch brands and Fortinet are just as expensive or more so than Sonicwall. We are evaluating Sophos UTM appliances right now, and they are pretty slick despite the brand being pretty poor in terms of reputation. They are likely to be our low cost alternatives. 

The Sophos UTM appliances are indeed pretty good too. Depending on what you're doing (if it is just content filtering) the Edgerouter (believe it or not) is another option with its DPI L7 firewalling however won't scan for malware etc. I did really like the Fortinet products but yes they're expensive but they were almost wire speed on the connections I tested.

Another one is the Meraki line of routers except the entry level products won't be suitable for 200/200Mbit UFB.

michaelmurfy:

 

The Sophos UTM appliances are indeed pretty good too. Depending on what you're doing (if it is just content filtering) the Edgerouter (believe it or not) is another option with its DPI L7 firewalling however won't scan for malware etc. I did really like the Fortinet products but yes they're expensive but they were almost wire speed on the connections I tested.

 

Another one is the Meraki line of routers except the entry level products won't be suitable for 200/200Mbit UFB.

 

And Meraki are subscription based. No pay, no device. I won't sell products that work like that in good conscience. I don't mind paying for extra features, support, subscription for security services, I won't pay a sub for basic device functionality. 

I don't like the UI/Rules config on the edge routers, I think the Sonicwall, and Sophos are easier for our juniors to understand and manage too. 

SonicWALLs have better than an ASIC, they use Cavium Octeons (same network CPUs used in Palo Altos).

x86 = crap layer 3 performance, abysmal layer 7/DPI performance

ASIC = excellent layer 3 performance, meh Layer 7/DPI performance

Cavium = excellent Layer 7/DPI performance, good layer 3 performance.

The Soho is an older gen Cavium, the Soho W and up have the newer gen Cavium more suitable for UFB. On a 200/200 circuit with Intrusion Prevention/Gateway Antivirus/Gateway AntiSpyware/App Control/Web Filtering a 200Mbps download would load the CPU to ~ 50%. The comparible Fortigate 60D is spec'd at around 23Mbps (on Fortinets own datasheets).

The Cavium is also orientated to multicore operation (the little ones only have 2 cores, big ones scale up to 64). So on a single stream test the Fortinet may run a higher speed single core stream so does better. In real world multistream testing the Cavium shines. Also the Forti ASICs aren't always what they claim to be, if you need some bedtime reading check this: http://docs.fortinet.com/uploaded/files/2855/fortigate-hardware-acceleration-54.pdf

So if you want a plain layer 3 firewall, Fortigate, if you want to run the security services, SonicWALL. I would not touch sophos with a barge pole, they regularly fail independent testing (don't believe the miercom tests, they are paid for by vendors). Look at NSS Labs tests as a good guide. Sophos is also x86 based so DPI performance is attrocious.

Cisco... maybe if you want to NSA/Chinese/Russians in your network: http://www.networkworld.com/article/3109165/security/cisco-fortinet-issue-patches-against-nsa-malware.html

You should also start checking SSL decrypt performance, it's becoming important for malware protection now.