2015年Gartner防火墙魔力象限图Magic Quadrant for Enterprise Network Firewalls

2015年Gartner企业防火墙魔力象限图

MagicQuadrantforEnterpriseNetworkFirewalls

22April2015ID:G00263955

Analyst(s):AdamHils,GregYoung,JeremyD'Hoinne

VIEWSUMMARY

"Next-generation"capabilityhasbeenachievedbytheleadingproductsinthenetworkfirewallmarket,andcompetitorsareworkingtokeepthegapfromwidening.Buyersmustconsidertheiroperationalrealities,theburdenofswitching,andthetrade-offsbetween"best-of-breed"functionandcosts.

MarketDefinition/Description

TheenterprisenetworkfirewallmarketrepresentedbythisMagicQuadrantiscomposedprimarilyofpurpose-builtappliancesforsecuringenterprisecorporatenetworks.Productsmustbeabletosupportsingle-enterprisefirewalldeploymentsandlargeand/orcomplexdeployments,includingbranchoffices,multitiereddemilitarizedzones(DMZs)and,increasingly,theoptiontoincludevirtualversions,oftenwithinthedatacenter.Theseproductsareaccompaniedbyhighlyscalable(andgranular)managementandreportingconsoles,andthereisarangeofofferingstosupportthenetworkedge,thedatacenter,branchofficesanddeploymentswithinvirtualizedservers.

Thecompaniesthatservethismarketareidentifiablyfocusedonenterprises—asdemonstratedbytheproportionoftheirsalesintheenterprise;asdeliveredwiththeirsupport,salesteamsandchannels;butalsoasdemonstratedbythefeaturesdedicatedtosolveenterpriserequirementsandserveenterpriseusecases.

Asthefirewallmarketcontinuestoevolve,NGFWsaddnewfeaturestobetterenforcepolicy(applicationandusercontrol)ordetectnewthreats(intrusionpreventionsystems

[IPSs],sandboxingandthreatintelligencefeeds).Thestand-aloneSecureSocketsLayer(SSL)VPNmarkethaslargelybeenabsorbedbythefirewallmarket.Eventually,theNGFWwillcontinuetosubsumemoreofthestand-alonenetworkIPSappliancemarketattheenterpriseedge.Thisishappeningnow;however,someenterpriseswillcontinuetochoosetohavebest-of-breedIPSsembodiedinnext-generationIPSs(NGIPSs).Morerecently,enterpriseshavebegunlookingtofirewallvendorstoprovidecloud-basedmalware-detectioninstancestoaidthemintheiradvancedthreatefforts,asa

2015年Gartner企业防火墙魔力象限图

cost-effectivealternativetostand-alonesandboxingsolutions(see"MarketGuideforNetworkSandboxing").

However,next-generationfirewallswillnotsubsumeallnetworksecurityfunctions.All-in-oneorunifiedthreatmanagement(UTM)approachesaresuitableforsmallormidsizebusinesses(SMBs),butnotfortheenterprise(see"Next-GenerationFirewallsandUnifiedThreatManagementAreDistinctProductsandMarkets").

Theneedsforbranch-officefirewallsarebecomingspecialized,andtheyaredivergingfrom,ratherthanconvergingwith,UTMproducts.Aspartofincreasingtheeffectivenessandefficiencyoffirewalls,theywillneedtotrulyintegratemore-granularblockingcapabilityaspartofthebaseproduct,gobeyondport/protocolidentificationandmovetowardanintegratedserviceviewoftraffic,ratherthanmerelyperforming"sheetmetalintegration"ofpointproducts.

MagicQuadrant

Figure1.MagicQuadrantforEnterpriseNetwork

Firewalls

Source:Gartner(April2015)

2015年Gartner企业防火墙魔力象限图

VendorStrengthsandCautions

AhnLab

SouthKorea-basedisalong-establishedsecurityvendor.Knownmostlyforantivirussoftware,AhnLab'snetworksecurityofferingsincludefirewalls,IPSsand

advancedthreatsolutions.AhnLabbeganofferingafirewallproductundertheTrusGuardbrandin2007,andnowthereare10models.ThefirewallisCommon-Criteria-certifiedEAL4,butdoesnothaveotherthird-partyevaluations(suchasICSALabs,NSSLabsorFIPSPUB140-2).

AhnLabisassessedasaNichePlayerforenterprises,becausemostofitswinsarewithinaspecificgeography—SouthKorea—and/orareassociatedwithanexpansionoftheendpointsecuritybusiness,notbecausethevendorcompetesonbest-of-breedenterprisefirewallfeatures.

Strengths

?

?

?SouthKoreaclientsshouldconsiderAhnLabfortheirfirewallshortlists,givenitssignificantlocalmarketshareandsupportpresence.Themodelrangeisverybroad;theenginewasdesignedtominimizedistributeddenialofservice,includingfeaturesoptimizedforhandlingsmallerpacketsizes.AhnLab'sendpointproductcustomerscanhavethesamevendorprovidethemwiththeirnetworkfirewallsolution,reducingvendormanagementchallenges.

Cautions

?

?

?TheTrusGuardfirewallisnotoftenseeninenterpriseselectionsintheGartnerclientbase.AhnLabwasnotlistedbyanyvendorwesurveyedasasignificantenterprisecompetitivethreat.AhnLabdoesnotoffervirtualfirewallmodels,andhasnotyetintegrateditsMalwareDefenseSystem(MDS)malwaredetectionappliancewithitsfirewall.AhnLabdoesnotallowmultipleadministratorstomakerulechangessimultaneously,placingitatadisadvantageinlargeenterprises.

BarracudaNetworks

Campbell,California-basedhasbeenfocusedprimarilyonsellingawiderangeofsecuritystorage,andinfrastructureappliancesandcloudservicesto

midsizebusinessesandsmall-enterprisemarketsatlowprices.TheBarracudaenterprisefirewallofferingistheNGFirewall,whereastheBarracudaFirewallseriestargetsSMBs.TheNGFirewallhasapplicationcontrolandreputationservices,whiletheBarracudaNGFirewallVxisavirtualversion,andthereisaMicrosoftAzureinstance.AnadvancedthreatoptionhasbeenaddedwiththeBarracudaadvancedthreatdetection(ATD)option,repackagedfromATDvendorLastline,providingacompetitivechoiceversuscompetingfirewalls.

2015年Gartner企业防火墙魔力象限图

BarracudaisassessedasaNichePlayerforenterprisesbecauseBarracudadoesnoteffectivelysellitsenterprise-capableproducttoenterprisesotherthaninWesternandCentralEuropeandincertainpublicclouddeployments.

Strengths

?

?

?

?TheBarracudaNGFirewallisagoodoptionforcustomersthatalreadyhaveotherBarracudaproductsorarelocatedinWesternorCentralEurope.TheBarracudamanagementconsolescoreswellinselectionsforsimpledeployments.TheNGFirewalltiedforthehighestscoreinasurveytoreferencesforIPSfunction.TheBarracudaNGFirewallisastrongcompetitorinsituationswherepriceishighlyweightedintheselection.TheNGFirewallshowedastrongcorrelationforselectionsinasurveyforhighavailabilityandclustering.GartnerhasobservedaconsiderableincreaseinNGFirewallsalessincethepreviouseditionoftheMagicQuadrant.

Cautions

?

?

?BarracudacustomersareprimarilySMBs,andthevendordoesnotyethavewell-establishedenterprisenetworksecuritychannelsorsupportoutsideofWesternandCentralEurope.AlthoughhavingdifferentiatedproductsforenterprisesandSMBsisgoodandreflectstheirdifferentneeds,Barracuda'sproductnamingisconfusingforenterpriseclients.TheBarracudaFirewallseriestargetsSMBs,whiletheBarracudaNGFirewallseriestargetsenterprises.NovendorwesurveyedlistedBarracudaasasignificantenterprisecompetitivethreat.AlthoughweseeBarracudaFirewallinSMBdeals,BarracudaisnotvisibleonthefirewallshortlistsofGartnerenterprisecustomers,exceptinsomeregions,notablyGermanyandAustria.MostinteresthascomefromincumbentcustomersthathaveotherBarracudaproducts.

CheckPointSoftwareTechnologies

isco-headquarteredinTelAviv,Israel,andSan

Carlos,California.Itsportfolioincludesnext-generationfirewalls,threatprevention,Websecurity,endpoint,mobilesecurity,cloudsecurityanddistributeddenialofservice(DDoS)solutions.CheckPoint'senterprisefirewallproductlineincludes17appliancesandtwochassisforhardwareblades,scalingupto400Gbps.Itcanalsobedeliveredasavirtualappliance,deployedonVMware,AmazonWebServices(AWS),OpenStackandMicrosoftAzure,ordeliveredassoftware.CheckPointfirewallcapabilitiescanbeexpandedbypredefinedpackagesofadditionalsoftwareblades.Customerscan

supplementCheckPoint'sfirewallwithanadvancedthreatoffering(CheckPointThreatCloud),andcanaddadditionalthreatintelligencefeedsfromthirdparties(CheckPointIntellistore)andintegrateCheckPoint'sfirewallwithitsMobileSecuritysuitetoenforcesecuritypolicyformobileusers(usingCheckPointCapsule).

GartnerassessesCheckPointSoftwareasaLeaderforenterprisefirewallsbecauseagoodscoreduringtechnicalevaluationcontinuallydrivesnewclientwinsandcontributestoretainingalargeportionofitsexistingcustomerbase.CheckPointalsoshowsstrongexecutiononitsenterprise-focusedroadmaptodeliverfeaturestargetingthevariousfirewallplacementusecasesforenterprises.

2015年Gartner企业防火墙魔力象限图

Strengths

?

?

?

?CheckPointhasoneofthelargestexistingenterpriseclientbasesandcontinuestoappearfrequentlyonfinalshortlistsforenterprisefirewallselection.Itisabletosupporttheseclientsgloballywithastrongchannelpresenceandasignificantinternalteamdevotedtofirewallfeaturedevelopment.ItscomprehensiveproductportfolioallowsCheckPointtobedeployedinavarietyofenterpriseusecases.ThenewchassissolutionsfurtherexpandCheckPoint'sabilitytoscaletothelargestdatacentersandtoadapttotheirfuturegrowthrequirements.CheckPointfirewallsconsistentlygethighscoresfromclientsonsecurityandeaseofmanagementincomplexenvironments.Itcontinuestoinvestinitsmanagementsuite,withseveralfeaturesintheR80versionintendedtoimprovetheauditabilityandmanageabilityofthesecuritypolicy,andithasfinallymergedthenetworkandapplicationcomponentsinaunifiedpolicy.GartnerbelievesthatCheckPoint'sstrategytosupportVMwareNSX,OpenStackandCisco

ApplicationCentricInfrastructure(ACI)isagoodsignalforclientsconsideringCheckPointsecuritysolutionswhentheyevaluatesoftware-definednetwork(SDN)projects.

Cautions

?

?

?PriceisthemostcommonfactorinvokedbyGartnerclientstointroducecompetitionforCheckPointsolutionsatrenewaltimeorasareasontofavorcompetitionduringshortlists.Gartneranalystsnoticedthathardwareplatformssubmittedinresellerproposalstendtobemoretightlysized,andseeitasatactictocontroltotalcosts.Inafewreportedclientsituations,undersizingwasaclearreasonforperformanceissues,andcausedunnecessaryback-and-forthdiscussiontogettheadequatemodel.In2014,GartnerobservedahigherthanusualnumberofclientsreportingstabilityissueswithCheckPointsolutions,andunexpectedlongresolutiontime.Thispeakedin2Q14,thenplateauedatalowerleverduringthesecondhalfoftheyear.GartneranalystsobservedthatmanyoftheseincidentsinvolvedclustersofnewhardwareplatformsrunningthefirstversionsoftheunifiedGAiAOS,withthesituationimprovingasCheckPointsimplifiedthenumberofsupportedlegacyversions.CheckPointcustomersareoftenslowtoadoptnewsoftwareoptionslikeitsthreatemulation

softwareblade.Gartnerbelievesthatreasonsincludeinsufficientresultsofmarketingoperationstosupportthelaunchoftheseoptions,aswellasthefactthatCheckPointclientsarenotwillingtosubscribetoadditionalsoftwareoptionsaftertheinitialsizing,infearofperformanceissues.Thisincreasesthetimeforthesenewoptionstobecomemature,astheybenefitfromaloweramountofclientfeedback.

Cisco

SanJose,California-basedhasabroadnetworksecurityproductportfolioacrossfirewall/IPS,Websecurityandemailsecuritytiers.ThefirewallofferingisprimarilyviatheAdaptiveSecurityAppliance(ASA)brandthatincludesanIPSreleasedin2014.ASAwithFirePOWERservicesistheASAwiththeSourcefireIPSAdvancedMalwareProtection(AMP)andapplicationvisibilityandcontroladdedin.Cisco'svirtual

firewallinglines,theASAvandtheVSG,requirethepresenceoftheNexus1000vvirtualswitch.