CrowdSec vs. WatchGuard XTM - Discontinued Product

Since I've only used CrowdSec in a homelab/small-medium sized business setup, that's really the only market I can safely recommend it and say it's well suited for, because I don't know how much it would cost to run it in an enterprise environment. I've heard some pricing and how they plan on rolling out a subscription model, but it's still in talks. Either way, if you have publicly exposed web applications hosted locally or on a virtual private server, then CrowdSec should be part of every virtual machine and/or network. Even with the lmited number of filter you get out of the free subscription, it provides a nice layer of constantly updated data,

Incentivized

WatchGuard XTM comes in different models, so you can choose the model best suited for your company size. I think it works well in small as well as very large networks. I have not used this feature, but you can create a "FireCluster" to connect member devices of the same model if you need to put multiple WatchGuard XTMs in your environment. Coming from command line, it took a little adjusting to learn which screen to use to set up the different rules. Once you understand how to set up policies, it is simple to create more. New firewall administrators would appreciate the ease of creating policies, and expert administrators should find everything they need plus extra features.

Incentivized

• Provides great integrations with tools you already use, such as fail2ban, Cloudflare, WordPress, NGINX, Linux Firewalls, etc.
• Lightweight agents can run on individual servers and report to a main security engine so that if there's an attack on one server and a block is implemented, the entire network can be protected
• There are a lot of ways to receive alerts and store logs
• CrowdSec Central API is a nice way to manage everything externally

Incentivized

• Proxy filter.
• Link redundancy.
• Security.

• Getting CrowdSec to run on OPNsense can be a challenge, but that's also a limitation of the OS
• You can only subscribe to a couple of feeds before paying an unknown amount of money that's part of their "Enterprise" package. So, there could be better transparency.

Incentivized

• Support can be hard to work with. While they are typically knowledgeable, there can be a language barrier. Also, most troubleshooting seems intrusive which is a problem in a production environment.
• The throughput of the cheaper models leaves something to be desired.
• Have had some issues running VOIP behind these, but have not been able to narrow down the issues to the phone provider or WatchGuard yet.

Incentivized

Again, WatchGuard is priced much lower than other vendors in its space. It may not have some of the bigger features such as Layer 7 awareness. It's more simple to manage and provides IT staff the time to work on other tasks versus time spent to create complex rule sets.

Incentivized

• It flat-out blocks malicious IPs from accessing any PC on my network.
• It's free-tier makes this a no brainer to implement

Incentivized

• Easy to set up and connect firewalls
• Easy to set up branch tunnels
• Less time spent training