The purpose of this article is to share firewall recommendations for a small business (SMB) under 50 users. The needs of a small business can be very different than a mid-size or enterprise-size company. Some firewall vendors align well with certain market segments (sizes) and don’t align well with others.
You need to understand what your key requirements are, know the security package options, support, and terms. You also need to know how your firewalls are going to provide the most value and be able to articulate that with whoever holds budget for IT projects. Knowing the vendor landscape and where they fit will also help you determine which vendors to look at for replacing your existing firewalls. Once you have your vendors lined up, then you need to look at their products and determine a best fit based on your needs and costs. Installation and ongoing management will play a huge role into your decision criteria, unless you plan on having a third party do this for you.
Topics Discussed
- Determining Your Key Requirements for a Firewall
- Understanding Options, Support, and Terms
- Cost vs Value
- Vendor Landscape
- Installation and Management
Determining Your Key Requirements for a Firewall
As a small business under 50 users, you may have an idea of your needs for a firewall. Here are some key areas for you to think about as you develop your criteria list:
Security
- Do I need the ability to scan files for malware at the firewall? What size of files come through my network that need to be scanned?
- Do I need additional security features like web content filtering and antispam?
- Do I need a VPN client for my end users?
- How long do I need to keep firewall log data for?
- How much of my traffic is encrypted and do I need to decrypt it for inspection for malware or malicious activity (SSL/TLS inspection)?
- Should I put security policies based on application? Is visibility into the applications and software being used on the network important to you?
- Is data loss/leak prevention needed at the firewall level? Do you have sensitive data that can be identified easily via a pattern, such as a credit card number, or social security number?
Routing
- What kind of routing protocols are needed? OSPF, RIP or BGP?
- Should I prepare for IPv6 by making that a requirement? Is IPv6 used anywhere in the environment today?
- Is there VoIP or QoS sensitive applications in the environment that would require QoS policies?
- Is there a need for outbound NAT or dynamic NAT?
- Do you need internet redundancy (SD-WAN)? Would you like application steering / dynamic path selection? This is the ability to automatically choose internet paths dynamically based on application.
Ease of Use, Management, and Installation
- How will you manage the firewall? Will you hire a third party or do it yourself?
- Who will install the firewall? You, the vendor, or a third party, such as an MSP or VAR?
- Do you want to manage and change settings on all your firewalls from the proverbial single pane of glass (Centralized Management)?
- Are there other components in your network that you would like to manage from a single pane of management (switches and access points) that are also being replaced?
- Do you plan on using any automation? e.g., Create an incident from IPS activity.
Multiple Locations / Multisite Requirements
- Does your company have multiple locations? Do you need different settings at each location?
- Do your locations directly access the internet or is connectivity backhauled through your headquarters?
- Are there resources (e.g. file share) at the corporate office that are used by employees at remote locations? Is there a need for site-to-site VPNs?
Cloud Presence
- What applications are in the cloud today? What type of security do they need?
- Do you need to identify users and devices that use your cloud applications?
- Do you need to enforce least-privileged access on your cloud applications?
- Have you deployed servers/virtual machines in AWS or Azure that need firewall protection? Would you like the same firewall at the cloud level as on premise?
Firewall Support
- How easy would it be for the next person after me or any vendor to step in and manage this firewall?
- Is this a popular brand of firewall that has a good reputation for support?
- Is support U.S. based? Are there 24×7 options available if needed?
- Are there local managed service providers or IT project companies (value added resellers) that can come in and troubleshoot or manage if needed?
Understanding Your Options, Terms, and Support Level
Every firewall vendor has different security packages and options you can choose from. They delineate somewhere between basic and advanced security services. Some firewall vendors include SD-WAN as an option, others include it in their base package. You should work to vet out the vendors you are evaluating and the packages included.
Firewalls usually come with licensing terms of 1, 3, or 5 years. Most organizations choose between 3 or 5 years, given the rate of change they expect. The more years you bundle together, the less cost it will be up front.
Firewalls usually come with basic or production-level support. Basic support is typically Monday through Friday, during normal business hours. Production support is 24×7.
Weighing Cost vs Value for Firewalls
You need to understand the business impact of a firewall in order to articulate its value to a business. There are several critical aspects of a firewall that determine its value to an organization. For the most part, this comes down to reducing risk and increasing productivity. Let’s look at perhaps the most critical factors that determine reducing risk.
Security Gateway / Next Generation Firewall
Certainly, we must take into account the strength of the product for being able to protect the organization from security threats. Each vendor has their strengths and weaknesses and the security requirements listed above should help determine the value of the selected firewall for your organization. Aside from that, there are other sources we can look at to determine maturity, such as the Gartner Magic Quadrant for Firewalls, Gartner Peer Insights, and other third-party review websites.
Implementing SD-WAN
SD-WAN is a design consideration for 1) organizations who would like to replace MPLS with a less expensive option; 2) would like to mitigate against the risk of performance degredation; and/or 3) would like to mitigate against the risk of downtime. All three of these reasons justify the cost of adding a redundant internet connection and can easily be calculated by previous experience of poor application experience, downtime, and cost of an MPLS.
Implementing High Availability
High availability is a design consideration that can come at a little bit of a cost or a lot of cost, depending on how you implement it. If each site needs to have redundant hardware, you could be potentially doubling the cost of hardware and licensing depending on the vendor. However, if you have already made the investment in redundant ISP connections to mitigate internet downtime, it is a clear sign that the organization has identified a site as needing redundancy. The cost of loss in employee productivity outweighs the cost of hardware, licensing and internet charges. Firewall hardware failures happen and when they do, they bring the entire organization down.
Vendor Landscape – Which firewalls fit best with small businesses under 50 users?
The million-dollar question is which firewalls align best with small businesses under 50 users. And of course, the answer is: it depends. It depends on your needs, goals, and wants. That being said, cost is always a factor. And there are certain licensing strategies that are used by some firewall vendors that are not used with others. For example, both SonicWall and WatchGuard firewalls have a SKU for an HA firewall that is discounted and an HA license SKU. There are many other firewall vendors that do not have that.
There are also firewall vendors who primarily sell into large enterprise organizations and price accordingly. They have every bell and whistle you could want out of a firewall and more – all included in their base package. Fortinet FortiGate firewalls are an example of an enterprise-grade next gen firewall that also has an attractive pricing model for small business. You can add options as needed, but aren’t included in the base package (example of this is FortiManager for managing multiple firewalls at multiple locations).
The most common firewalls for a small business under 50 users to evaluate in my opinion are these:
- SonicWall
- WatchGuard
- Fortinet (FortiGate)
- Cisco Meraki
Larger organizations may find these firewalls more common:
- Fortinet (FortiGate)
- Cisco FirePower
- CheckPoint
- Palo Alto
Of course, you can absolutely find use cases and organizations who do not follow this trend.
Installation and Management
Installation and management are key considerations when selecting a firewall. Unless you implement firewalls regularly or have done it in the past, you should seek the help of a good firewall engineer. I have seen it time and time again when poor implementations of firewalls have left organizations crippled due to poor design from someone who had good intentions to save money and do it themselves.
The concept of management can be similar to installation. Do you have the time and expertise to manage a next generation firewall, keep its firmware updates, and monitor IPS alerts? Most IT Directors and Managers who have no other IT staff tend to rely on Managed Services Providers to manage their firewalls for them.
Contact a Specialist
If you would like to contact a specialist to help you with a firewall project, please fill out the form below. Someone will contact you to set up a meeting and talk about your needs for a new firewall. Response time is less than 24 hours.