Checkpoint licensing - software blades and containers

[normski]

Hi

Im looking to buy some new firewalls this summer and Im trying to narrow it down to one vendor. As part of this Im trying to do some cost comparisons over 1, 3 and 5 years. Ive been quoted a figure for 1 year for a particular checkpoint appliance and 7 software blades. What Im looking for and have failed to find (other than the marketing speak) is a straight forward guide on what I will have to buy per year to get the applicance to do the things i want (eg URL filtering, IPS, firewall) or what will happen if I decide not to pay for the software blades at all. 

The appliances Im looking at are the 4000 series.

thanks

Normski

[Michael McNamara]

I would probably suggest you look at Check Point, Juniper and PaloAlto Networks.

If you are an all Cisco shop the ASA is still pretty dependable in my honest opinion although it's fallen behind some over the past few years.

You'll need to understand the licensing (and costs) for each and how the performance is impacted as you enable features.

Let us know how you make out!

[Flintstone]

Hi normski,

I believe the quote you have is for the basic firewall blades.  The subsequent blades is to be licensed to use IPS, URL filtering etc for the first year.

If you decide not to pay after the first year, your firewall should still continue to work but you won't have any maintenance support.  You will also not get the latest updates for IPS, URL filtering etc

CheerZ

[jfarinha]

I think I can help you, went the same path a few months ago.

If you buy an appliance, for example a 4610, you get the hardware and the 10 software blades, all licensed for the first year of signature updates in case of the IPS, App, URL, AV, etc.


For that first year you just need to buy the general support for the hardware itself.

After the first year, you need to buy the support for the hardware plus the signatures for all those other blades, and if you don't, they will stop to work properly. Thw firewall, vpn and management blades are perpetual, so if you don't pay anything to checkpoint you can keep on using them, just without software  updates.

 

[normski]

Hi All

Its been a long time since I visited. My inactivity has been due to the demise of google RSS reader. Anyhow I reviewed lots of firewalls and in the end it was down to about 3 fortinet, sonicwall and paloalto. We couldnt load test them properly but we just sized them on the lowest throughput figures  and played with demo kit. In the end we went with the paloalto 3020 which was a completely new box they released in 2013. We been pleased with it and seems to working ok. Its our first NGFW so we are gradually turning on the features.

regards

Normski