Topic 'Recommend a new router...' in forum 'ZyXEL' - dslreports.com

Re: Recommend a new router...

Tue, 23 Jun 2015 11:59:08 EDT

FirebirdTN posted : Whoopps-At first I didn't get any replies, then I haven't checked in a while and got TONS...

To those steering me in a different direction-too late-bought two pfsense boxes. I am still figuring them out. I am sure there are better products out there, but I went with pfsense just because it is completely FOSS, and my research landed me in that direction. It also appears to be very popular in that genre of routers.

Although the USG is a UTM device, I don't currently use any UTM features.

To the one poster above (not sure who it was) that said my USG200 shouldn't be having such a hard time with the load I put on it, I disagree. I was warned early on that the USG200 just doesn't have the hardware for as many users as I have. Was told I should have been looking at at LEAST the USG300 which has substantially better hardware, but I was budget constrained.

Plus, bridging the interfaces on a USG will clobber the CPU, as it is "software" bridging. Bottom line, I am asking too much for this little box.

It isn't a total waste though; after I get the pfsense box installed, the USG200 will head over to another one of our sites which current has a USG50. The main benefit is 3 WANS on the 200, so it all works out.

-Alan

Re: Recommend a new router...

Thu, 04 Jun 2015 22:22:46 EDT

Kirby Smith posted : Thank you for the added information.

32000 connections is 3.2X that the USG 50, and 0.32X that of my former Xincom. Still, this state table size is more than I have ever needed after I have adjusted state timeouts. (The number of people simultaneously downloading 64-bit Linux Mint MATE isos via bit torrent is surprisingly modest. :) And with Crunchyroll and Funimation both operating with huge anime libraries, anime bit torrent traffic has greatly decreased from the heyday of the fan sub community. I have no absolute or comparative information for Hollywood agitprop content, but news reports lead me to believe that Netflix has surpassed live-action video bit torrent traffic.)

What most intrigues me about the SOPHOS value proposition is the anticipated need for ever more complex filtering as the threat posture becomes ever more sophisticated. This filtering will be needed without router bandwidth degradation below available ISP bandwidth. The USG 50 with its modest available filtering already provides lower bandwidth than the nominal amount I have available from my ISP. This week's IT security related headlines about Government network penetration are enough to raise the concern that sooner or later residential protection will require more UTM processing power than the computers inside the firewall will need to do useful work.

To put it another way, without low cost high performance hardware and low cost sophisticated software, residential protection could become prohibitively expensive. Then everyone's business becomes everyone else's business.

kirby

Re: Recommend a new router...

Thu, 04 Jun 2015 16:21:28 EDT

mozerd posted : I have a slight update on what's included in the Home Edition License:

Network Protection
Description: This subscription enables the Intrusion Prevention System (IPS) incl. pattern updates, DoS/Flood Protection, SSL & IPsec based VPN and Remote Access, Advanced Routing, WAN Link Balancing and detailed Network Protection Reporting.

Email Protection
Description: This subscription enables mail filtering with dual antivirus incl. pattern updates, Reputation and Fingerprint based Spam Filtering, transparent Email Encryption (OpenPGP & S/MIME), End-User Quarantine Management and detailed Mail Usage Reporting.

Web Protection
Description: This subscription enables web traffic analysis with Virus and Spyware Filter incl. pattern updates, URL filter by Category, AD/eDir SSO Authentication, HTTPS filtering, Application Control and detailed Web Usage Reporting.

Webserver Protection
Description: This subscription enables protection of servers behind UTM from modern attacks and exploits. Keep your Web and Mail servers safe using defenses against Cross-Site Scripting (XSS), SQL Injection, Application Attacks, Cookie Tampering, and more. Webserver Protection supports standard HTTP and encrypted HTTPS (SSL) connections.

Wireless Protection
Description: This subscription enables Wireless Protection.

Endpoint AntiVirus
Max. Users: 12 ( 10 licensed Users + 2 free Users )
Description: This subscription enables Endpoint Protection incl. Antivirus, HIPS and Device Control.

BasicGuard
Status: disabled
Exp. Date: not licensed
Description: This subscription enables basic functions for Network, Email, Web and Wireless Protection.

If you want to use more advanced functions in your UTM like RED, HTML5 VPN portal, Wireless Hotspot vouchers, two AV scanners, and others, you can easily upgrade to a fully featured FullGuard license via our MyUTM licensing portal.

Support Services
Type: Web Support » Standard Support » Premium Support
Status: enabled
Exp. Date: 31 May 2018
Description: Web Support is included with every Base License.
Standard Support is included with the subscriptions.
Premium Support is a dedicated subscription and allows 24x7 access to the Sophos Support Team as well as upfront replacement of defective Hardware Appliances.

[EDIT] Apparently Support Services is not included:

From: Scott_Klassen
One last thing to add. Sophos Support is not included withe the Home License. Even though the license details say you have Standard Support, do not contact Sophos. With the Home License, your support channel is via these forums and your own due diligence research.

FYI, all my services listed above are set to expire 31 May 2018 -- so I will currently speculate that they renew every 3 years.
--
David Mozer
IT-Expert on Call
Information Technology for Home and Business

Re: Recommend a new router...

Thu, 04 Jun 2015 13:21:23 EDT

Anav posted : I can confirm the software download size and nomenclature for both versions are identical

Re: Recommend a new router...

Thu, 04 Jun 2015 12:57:22 EDT

mozerd posted :

said by Kirby Smith:

A page that clarifies just what is in the Home Edition (or not in the Home Edition) so far eludes me

Check the following link to see if we get a proper answer to your dilemma.

[EDIT
OK 2 experts answered my call as linked above:

From BAlfson:
The only limit to functionality is that you can't have more than one Active node, use more than 50 IPs or some number of connections. The cosmetic difference is that you cannot customize pages to NOT show the Sophos logo and information.

From: TheDrew
To Expand on Bob's comments.

-Clustering is limited to HA mode only (Active-Passive), Active-Active Clusters aren't permitted.

-IP's are limited to 50 total (IPv4 & IPv6 combined) and concurrent connections can't exceed 32000 (hard to hit in home use unless you are a serious bittorrent user on a very fat pipe)

-And certain screens within the UTM (content filter warnings, user portal, email portal, etc) are stuck at the Sophos defaults.

Beyond that, it's the exact same software under the hood as runs on the appliances and paid licenses.

Re: Recommend a new router...

Thu, 04 Jun 2015 11:16:02 EDT

Kirby Smith posted :

said by mozerd:

said by Kirby Smith:

Apparently there are 2 versions of the FREE system:

[1] The Sophos UTM Home Edition
[2] The Sophos UTM Essential Firewall for Business

Thanks for the further clarification, David.

The Business Firewall link suggests that the UTM components are add-ons, and I would assume that all are subscription based.

A page that clarifies just what is in the Home Edition (or not in the Home Edition) so far eludes me.

kirby

Re: Recommend a new router...

Thu, 04 Jun 2015 08:25:45 EDT

mozerd posted :

said by Kirby Smith:

According to the Register this morning, SOPHOS was going for an IPO soon on the London Exchange. I hope that going public doesn't lead to some unwanted change to the present software distribution model.

The SOPHOS UTM is not Trivial to set up --- it requires skill.

So I suspect that SOPHOS want to have as many "partners" as possible to promote their product to business users -- the way to do that is to make it easy for people to learn and join their fraternity once they do become skilled. The objective is to make money --- so I doubt that they are going to change their business model :)
--
David Mozer
IT-Expert on Call
Information Technology for Home and Business

Re: Recommend a new router...

Thu, 04 Jun 2015 07:08:22 EDT

mozerd posted :

said by Kirby Smith:

Apparently there are 2 versions of the FREE system:

[1] The Sophos UTM Home Edition
[2] The Sophos UTM Essential Firewall for Business

So, when the software gets downloaded and one imports the License file they send you the software adjusts to the features and capabilities the specific license allows.

if YOU DO NOT IMPORT the specific License you get 30 days to play -- unbridled -- with all of the features and capabilities.

Interesting read on whats new in 9.3
--
David Mozer
IT-Expert on Call
Information Technology for Home and Business

Re: Recommend a new router...

Thu, 04 Jun 2015 06:09:12 EDT

mozerd posted :

said by Anav:

How bout the ability to assign 802.1p to any VLAN traffic AND MOST IMPORTANTLY to the dhcp discover initial negotiations traffic.

The SOPHOS UTM v9.3x does not currently provide support for IPTV however there is a HACK that someone in Germany developed [IGMP proxy] that can be utilized --- since its a HACK that means that any update that SOPHOS submits will destroy the HACK and you'll have to re implement.

I do suspect that since IPTV will become the dominant transmission medium SOPHOS will add a native IGMP proxy mechanism ---- however, I have no idea if its on the to-do-list. SOPHOS Bulletin Board
--
David Mozer
IT-Expert on Call
Information Technology for Home and Business

Re: Recommend a new router...

Wed, 03 Jun 2015 19:37:41 EDT

Kirby Smith posted : For shareholders, it should be about maximizing long-term profits and company value, but the shareholders' official representatives, the board of directors, perceive that it is about short-term profits, perhaps because the noisiest (and majority) investors are hedge and mutual funds. In any case, most modern corporate activity in the markets is intended to transfer corporation value to the C-suite. Else why would many companies, including Intel and IBM, be buying their stocks at their highs.

In the case of SOPHOS, there is nothing intrinsically wrong with going public; investors have to eventually be rewarded. The problems arise when management, per par. 1, start doing (IMHO misguided) things that appear to increase profit but at best do so only short term, and at a long-term cost that doesn't matter to them because by then they are retired. It is probably a waste of typing to address this here; there are many sites that do it more thoroughly, and with greater tsunami of cynicism then I can manage tonight.

kirby

Re: Recommend a new router...

Wed, 03 Jun 2015 18:59:57 EDT

Anav posted : Concur Kirby, shareholders don't care about value for us, its all about maximising profits.

Re: Recommend a new router...

Wed, 03 Jun 2015 18:07:30 EDT

Kirby Smith posted : Lightning Strike: Good name for a thoroughbred.

Yes, Anav, there is a section of the Admin Guide that when I read it last night led me to think of your WAN complexities re VLANs (VWANs?). What I can't answer, though, was whether the capabilities described address what you need. There is so much in there, though, that I'd be surprised if we could come up with a real SOHO need that wasn't addressed.

According to the Register this morning, SOPHOS was going for an IPO soon on the London Exchange. I hope that going public doesn't lead to some unwanted change to the present software distribution model.

kirby

Re: Recommend a new router...

Wed, 03 Jun 2015 17:02:22 EDT

mozerd posted : I have not tried 802.1p so I do not know but you can get the admin docs and see for yourself. When you downlas the ISO and burn that on a CD then on boot up the Linux bootstrap takes over and wipes your disk clean etc.

I do not recommend an old PC .... I suggest one builds a good box with quality NIC like I stated above. An old PC may not have the proper chain of components.i built mine for under 500 and it Performs faster than a lightning strike. :)
--
David Mozer
IT-Expert on Call
Information Technology for Home and Business

Re: Recommend a new router...

Wed, 03 Jun 2015 16:03:24 EDT

Anav posted : Kool so basically you take a computer and run it as a router.....with the software... Specific OS required?
How bout the ability to assign 802.1p to any VLAN traffic AND MOST IMPORTANTLY to the dhcp discover initial negotiations traffic.

Re: Recommend a new router...

Wed, 03 Jun 2015 13:40:09 EDT

mozerd posted :

said by Kirby Smith:

I know that they sell the box with software and subscription signatures; I know that they give away the software (or some part thereof) for home use on one's own PC hardware (less than 50 IP addresses -- I'd need a really big family to challenge that number); what I don't know for completeness is the third possible option, whether they sell the box with software and allow free signature updates if one qualifies as a home user. (This would establish a cost comparison with ZyXEL.)

They sell an assortment of SOPHUS UTM appliance that they have designed and built. You buy the appliance model that best suits your needs --- the number of users that you need to support.

The UTM software -- regardless of commercial version or home version -- is one of the same. When you sign-up for the Home Edition they send you a special file with the home license embed. After you install the software in your box you have 30 days to play with all the features and capabilities --- and yes they are very extensive -- if however you install the home license some of the more advanced commercial capabilities get disabled --- you are informed of which capabilities will be disabled once the home license gets imported into the system before you HIT the Apply button. I do not remember which of the features gets disabled but I do remember that none of those disabled features have relevance to my needs and I am fairly certain that will apply to 80% of anyone reading this thread.

The Home edition gets all the signature updates for all the active modules free of charge and that process is automatic --- as long as no more than 50 IP addresses are involved. If you exceed the 50 IP address count you will be notified and be given an opportunity to subscribe to updates.

If you want to Buy their Appliance You will need to send them a email and find out the details of how subscription's are handled - I have no idea.

Anav -- There is absolutely NO COMPARISON between the USG and the SOPHUS UTM features/capabilities --- the Home edition BLOWS away the USG in every way shape or form PERIOD. For 50 users [IP addresses] no additional cost for software, software updates or signature updates.
--
David Mozer
IT-Expert on Call
Information Technology for Home and Business

Re: Recommend a new router...

Wed, 03 Jun 2015 12:09:07 EDT

Anav posted : Same questions here. Do the UTM components provide the same capabilities as the USG, and what are the costs?

Re: Recommend a new router...

Wed, 03 Jun 2015 11:57:36 EDT

Kirby Smith posted : Thanks!

I got a chance late last night to skim the Admin Guide and saw that the scope of control features was extensive. ( <--Probably a candidate for understatement of the day.)

I know that they sell the box with software and subscription signatures; I know that they give away the software (or some part thereof) for home use on one's own PC hardware (less than 50 IP addresses -- I'd need a really big family to challenge that number); what I don't know for completeness is the third possible option, whether they sell the box with software and allow free signature updates if one qualifies as a home user. (This would establish a cost comparison with ZyXEL.)

(I recall "blueshoes" acquired an Atom-based box for this purpose, although at the moment my notes on what box manufacturer he used aren't handy.)

kirby

Edit: Supermicro, I believe it was.

Re: Recommend a new router...

Wed, 03 Jun 2015 06:45:00 EDT

mozerd posted :

said by Kirby Smith:

does the SOPHOS home addition provide dual-WAN, PPPoE, VLANs, the usual firewall capabilities, and, for those who care, typical VPN capabilities?

DUAL WAN capability and support --- YES and if you want you can have QUAD WAN Capability and support --- just make sure that the NICS you add are of excellent quality --- I use Intel Server Gigabit NICS. You define the role each NIC plays.

VLAN's support --- YES

PPPoE support --- Yes

Full Featured Firewall --- YES, by default everything is blocked with the exception of the Local WebAdmin interface.

Since the system will run headless -- after initial install and preliminary configuration --- balance of configuration is via WebAdmin from any of your local computers via SSL --- can be from Windows or Linux Desktop or Apple Mac.

VPN support --- YES, and is full featured --- quite amazing actually.

IPv6 Support -- YES !!!

some words of advice: the box you build should have a minimum of 4 GB of RAM, 1.5 Ghz dual core, 80 GB eSATA drive or SSD drive and High quality NIC's --- I prefer Intel Server grade NICS.

The configuration Interface is GUI --- no CLI is needed --- the granularity of the GUI is DEEP :) very deep and well laid out and SUPER fast on my box.

Sophos UTM Home Edition

Excellent configuration Guidance to start you off in the right direction
--
David Mozer
IT-Expert on Call
Information Technology for Home and Business

Re: Recommend a new router...

Tue, 02 Jun 2015 21:23:44 EDT

Kirby Smith posted : Thanks David. For fair comparison with the USG, does the SOPHOS home addition provide dual-WAN, PPPoE, VLANs, the usual firewall capabilities, and, for those who care, typical VPN capabilities?

kirby

Re: Recommend a new router...

Tue, 02 Jun 2015 13:10:09 EDT

mozerd posted : For UTM I strongly endorse SOPHOS UTM v 9.3x

And if you build your own box with server quality NIC's the SOPHOS UTM cannot be beat for protection and every other SERVICE you want to include. I built my box for under $500 --- includes 4 Intel server quality GB NICS --- performance under heavy load is remarkable. :)

BTW, the Home edition of SOPHOS UTM 9.3x is free of charge as long as you IP count does not exceed 50 users.
--
David Mozer
IT-Expert on Call
Information Technology for Home and Business

Re: Recommend a new router...

Fri, 29 May 2015 11:12:09 EDT

riahc3 posted :

said by FirebirdTN:

WOW, its been forever since I have posted here...

Anyway, for those that know me, please spare me the "I told ya so's" as CHEAP is the name of the game where I work...Wish they would listen a little more.

Anyway, I have a USG200, and I love, love, LOVE all its features...BUT...its getting clobbered during peak hours.

I was thinking about either one of the ubiquity offerings OR pfsense...

On the USG200, here are some of the "not so common" features I use:

BRIDGING! I bridge one of the WANS to one of the LAN ports for the purpose of placing public devices BEHIND the router for QoS.

Load balancing/failover

Daily Emailed reports

We have about 150 network devices, and about 50-100 active users. We also serve streaming content.

I'm really leaning to pfsense, but then comes the hardware cost.

I'm open to suggestions!

-Alan

I don't mean to offend you but that load you are describing shouldn't be too much for the USG200...

Could you please state everything your USG200 is actually doing?

Re: Recommend a new router...

Fri, 29 May 2015 10:33:31 EDT

SuperTechie posted : I don't use pfsense but was interested as well so I found this which shows snort integration:
»www.moh10ly.com/blog/pfs ··· -pfsense

But comparing snort with zyxel IDP etc, I found this:
"PFSense shouldn't even be in a thread about UTMs.....even with snort 'n clam, it can't find a herpe in a [deleted due to racial slur].
If you want to toss free *nix UTM firewalls in the mix, look at Endian or Untangle...especially Untangle since it has several other modules in it which actually deal more with web based malware..."
»www.snbforums.com/thread ··· 8/page-2

I get the impression pfsense is for those who need a powerful but more basic firewall/router. For those of us who depend on IDP, etc. to help keep the bad guys out maybe pfsense is not the best alternative . . .

Anyone that can compare more advanced features?

Re: Recommend a new router...

Fri, 29 May 2015 10:16:21 EDT

riahc3 posted : Snort can installed as a package on pfSense

Re: Recommend a new router...

Thu, 28 May 2015 20:39:16 EDT

Kirby Smith posted : A question for when you have familiarized yourself with the unit and its features: When pfSense describes the rackmount unit as "integrates with Snort," does that mean that Snort can be loaded into the unit and use the same (eight-core) processor?

Thanks

kirby

Re: Recommend a new router...

Thu, 28 May 2015 17:28:35 EDT

FirebirdTN posted : Just a bump of my own thread while I was doing some research. Got them to spring for a top of the line model from the pfsense store. Actually bought two.

Love it so far, but still figuring out some of the things pertinent to my setup.

I'm still keeping my USG50 at the house (it works perfectly), and taking the USG200 we now have at the main office and moving it to a satellite office, but looks like pfsense is the way we are going to stay for the quite some time to come. This 8 core router will hopefully will be the LAST router we buy for a long time...

-Alan

Recommend a new router...

Fri, 27 Feb 2015 13:23:35 EDT

FirebirdTN posted : WOW, its been forever since I have posted here...

Anyway, for those that know me, please spare me the "I told ya so's" as CHEAP is the name of the game where I work...Wish they would listen a little more.

Anyway, I have a USG200, and I love, love, LOVE all its features...BUT...its getting clobbered during peak hours.

I was thinking about either one of the ubiquity offerings OR pfsense...

On the USG200, here are some of the "not so common" features I use:

BRIDGING! I bridge one of the WANS to one of the LAN ports for the purpose of placing public devices BEHIND the router for QoS.

Load balancing/failover

Daily Emailed reports

We have about 150 network devices, and about 50-100 active users. We also serve streaming content.

I'm really leaning to pfsense, but then comes the hardware cost.

I'm open to suggestions!

-Alan