Check Point 4000 Appliances vs. Juniper SRX

If you have middle-sized and large-sized organizations and you have a very good budget for network security then you can install this firewall. Sandboxing and ips features are very useful and you can use them for deep packet inspection and protect your organization from external attacks.

Juniper vSRX is an excellent edge gateway device. The combination of Tunneling protocols supported and the advanced routing & security features makes it perfect for this kind of deployment. It is available in physical, virtual appliances as well as support on multiple clouds so you can have the same box be your edge gateway in multiple environments for consistency.

It can also work as a Internet Gateway, DMZ Firewall/Router and it would function just fine.

While it can also work as a DC firewall (North-South), the poor GUI will make it harder in the day to day administration for the multiple policies in a DC.

Incentivized

• If you have critical data then you can use this firewall for secure your organization
• You can also use for cloud security
• If you want the deep packet inspection then this is one of the best firewall for you.

• The Juniper SRX platform is easy to set up (out of the box).
• The support team responds to tickets quickly and with good solutions.

Incentivized

• Steep learning curve for admins
• No packet tracer application like the ASA to test flows prior to putting in new rules, etc.
• Policy packages are all or nothing. I cannot uninstall or turn off a piece of the overall policy, it's all or nothing.

Incentivized

• Some of the more complex setups (clustered HA, etc.) can be a little difficult to configure.
• The lowest-end model that supports true multi-site HA is relatively expensive. It would be nice to have that option in lower models.
• Some configuration options (particularly the way address book entries are done) can get tedious and make for very long configs.

Incentivized

This is the one area where I have a beef with Juniper. When I called into Cisco TAC, 90% of the time, the first person I spoke with was able to resolve my issue. With Juniper TAC, 90% of the time, the first person I speak with is not able to resolve my issue, seems to almost be reading from a script, and must escalate my ticket. All of which takes time.

Incentivized

WatchGuard was a little more like a Sonicwall, and we felt the Soho-type interface wasn't what we wanted out of a security product. The anti-malware and spyware products were not nearly as good or pronounced as the checkpoint products. Secondly, we have to have the checkpoint for access to our parent company's networks.

Incentivized

Equipment prices ran about the same. Performance and management were also more or less equal. The biggest deciding factors for going with Juniper were (1) fewer security incidents related to SRX firewalls and (2) technical support costs were significantly less.

Incentivized

• We have not seen a zero-day exploit since implementing the anti-spyware, anti-malware, and URL filtering functionality
• We have not seen a successful intrusion into our systems since the implementation of our checkpoint 4000
• We have had this firewall for 5+ years, and it still has much life left in it.

Incentivized

• It is a workhorse for our field operations. It provides the last touch for an ISP to the customer. The customer has no view of the device, but with the repeatability of the device, they do not need to.
• The ability to roll out a dynamic routing protocol attached to a security zone allows elasticity to the environment that supports growth.
• VLAN support on the inside interfaces allow this to be the only device in some smaller deployments we install these in.

Incentivized