Check Point 4000 Appliances vs. Cisco Firepower 4100 Series

Well suited for small to medium business with less than 1000 users. Good edge device, NAT is easy to work with. The anti-malware, anti-spyware are worthwhile paid add-ons. Anti-spoofing is built in, and required to be put in. The split of management between Gaia and secure platform applications is painful, but nothing that can't be gotten around.

Incentivized

When we are asked by local partners which security equipment we use we always recommend our Cisco security products. The Firepower firewall is no exception and we can easily recommend this to others who need a fast, secure, and well built system that integrates well with all your existing hardware and software.

Incentivized

• If you have critical data then you can use this firewall for secure your organization
• You can also use for cloud security
• If you want the deep packet inspection then this is one of the best firewall for you.

• Policy management in the GUI. I'm old-school, and still create ACLs in the CLI, but using the GUI for this is very nice.
• Event monitoring and reporting is great, and you can get very granular when it comes to what information you are viewing.
• I really like the troubleshooting features that are built in, especially the packet tracer and the ability to generate and download a troubleshooting package to review or send to TAC.

• Steep learning curve for admins
• No packet tracer application like the ASA to test flows prior to putting in new rules, etc.
• Policy packages are all or nothing. I cannot uninstall or turn off a piece of the overall policy, it's all or nothing.

Incentivized

• When deployed as Firepower Threat Defense, configurations cannot be made within the device itself.
• Troubleshooting can be difficult if the Cisco Firepower 4100 Series firewall is managed by the Cisco Firepower Management Center.
• There are two operating systems in Cisco Firepower 4100 Series, firmware upgrade process will take a long time.

We were using the Cisco ASA 5525 but this firewall was not fully secure. Lots of advanced features were missing so we installed the Check Point 4000 Appliances and we are really happy with the features, advanced IPS and web filtering help us to protect our organization and also more control our user traffic.

As I mentioned before, the Fortigates have better failover. I think the Cisco interface is easier to use that that of the FortiGate. My only criticism would be that with multiple CLIs, it can get a bit confusing when you are trying to configure something or troubleshoot from the CLI.

• We have not seen a zero-day exploit since implementing the anti-spyware, anti-malware, and URL filtering functionality
• We have not seen a successful intrusion into our systems since the implementation of our checkpoint 4000
• We have had this firewall for 5+ years, and it still has much life left in it.

Incentivized

• Positive impact would be our increased security network wide.
• Another positive would be the increased processing power, saving us time and [from] needing more equipment.
• A negative impact would be the increased need for having to learn a new interface.

Incentivized