Snort vs. SonicWall Capture Advanced Threat Protection (ATP)

If a colleague was looking to tighten down their network I can easily recommend Snort to them. It gives you some more peace of mind knowing that its always scanning traffic for malicious looking code. Even things your major firewalls and security hardware might miss, Snort has picked up. Its an easy recommendation for me.

Incentivized

Our customer base is SMB so I can not speak about a larger customer base or organization. I have customers with 3 end points behind the SW and customers with 200 end points behind the SW. The biggest confusion on selection is the WAN / LAN throughput. Once you understand the limitations and select the correct product I have been happy with the product on a wide range of customers. It is a bit pricey for a small operation but if they are handling sensitive data it is very cost effective.

• IPS detection.
• DoS detection.
• Packet logging.

Incentivized

• Filters and prevents phishing attacks
• Filters and prevents malicious attachments
• Provides quantitative reporting

• At times can be unstable with Cisco bugs, require frequent upgrading.
• FTD images that are being pushed for ASAs are less efficient from an administration standpoint, no CLI.

Incentivized

• Sorry, I am very satisfied with the product, nothing I need to change

For our organization, the Cisco defense in depth concept works the best. While Cisco can be made to work with other vendors, we have found the best in depth protection by integrating Cisco products for maximum visibility. We had a Barracuda Web Filter, but it was difficult to maintain when you had limited scope on what you could block, so we created a whitelist only setup which required a lot of additional manpower. This wouldn't have covered new threats with DNS spoofing and the like. Sourcefire also integrated with our anti-malware platform (Cisco AMP) for even better visibility on what may be happening on the end users workstation. We are planning on adding in Cisco ISE to complete the approach and possibly stealthwatch to cover our bases in the future. The Palo Alto gear was interesting, but it was priced far out of our range.

Incentivized

Support from SW is superior. End of discussion. Fortinet support was lacking in product knowledge and was noting but reading from a script. SW, if the T1 can not answer I get to T2 immediately. Never an issue to get a resolution in minutes, not hours or days. The staff knows their limits and escalates without question.

• Being open source, ROI on free is hard to beat for something that works.
• I believe it greatly enhances the security of my network.

• I trust the product to protect my customer base.
• They do not differentiate themselves very well. It is a difficult sell cycle.