What is our primary use case?
Our company works in developing and delivering online gambling platforms. The Check Point NGFWs are the core security solution we use to protect our DataCenter environment located in Asia (Taiwan). The environment has about ~50 physical servers as virtualization hosts, and we have two HA Clusters consist of 2x5400 hardware appliances, managed by an OpenServer Security Management Server on a Virtual Machine (KVM), all running on R80.10 with the latest JumboHotfix.
The Clusters serve as the firewalls for both inter-VLAN and external traffic. We have the Intrusion Prevention System (IPS) blade activated on both Check Point HA Clusters as the counter-measure against advanced threats and malware. The IPS blade mostly used for ingress traffic from the Internet to the DMZ VLAN.
How has it helped my organization?
I think that the security of our DataCenter has been increased to a large extent by activating of the Check Point Intrusion Prevention System software blade. Before that, we used the Cisco ACLs and Zone-Based firewall configured on switches and routers, which currently not an efficient solution for protecting from advanced threats. Now we have state-of-the-art, true, and efficient Next-Generation firewall, and the IPS blade is the heart of it. The security profiles activated in the IPS blade check the traffic not just by TCP/UDP port of the connection, but by traffic patterns and the application behaviour.
What is most valuable?
The number of IPS protections is amazing - after the latest update, I see more than 11000 in the SmartConsole.
All the protections are tagged and categorized by the vendor/type/product, the severity of the threat, confidence level, and performance impact of the activation, which helps in finding and enabling only he profiles that we really need (e.g. we don't have any Microsoft Windows servers in our environment, so decided to disable such protections by default).
The protections are updated based on the schedule - we used the default once-a-day approach.
I also like that the new protections may be automatically activated in the "Staging mode", which only detect the possible threat and alerts them, but doesn't block the actual traffic, thus minimizing the impact of the false positives.
What needs improvement?
In my opinion, the Check Point software engineers should works on the performance of the blade - when it is activated with the big number of the protections in place, the monitoring shows us the significant increase in the CPU utilization for the gateway appliances - up to 30 percents, even so, we are cherry-picking only the profiles that we really needed.
Due to that fact it is also not so easy to choose the correct hardware appliance when you are planning the infrastructure. It is even more important when you realize that the Check Point hardware is very expensive.
For how long have I used the solution?
We have been using this solution for three years, starting since late 2017.
What do I think about the stability of the solution?
The solution is reliable and stable, we didn't have any software or hardware issue while using it.
What do I think about the scalability of the solution?
The Check Point software blade is activated on the HA Clusters in Active-Standby mode. There's a space to grow with the current setup, but eventually, we may switch to the Active-Active mode and add additional appliances to the clusters.
How are customer service and technical support?
Even so we had a number of the support cases opened with the Check Point team, none of them was connected with the IPS blade. In general, there are professionals in the support team, but some cases took surprisingly long time to be resolved.
Which solution did I use previously and why did I switch?
Before the Check Point IPS, we relied on the simple stateful firewalls configured on Cisco switches and routers and moved to Check Point to get improved security against the modern threats.
How was the initial setup?
The initial setup was easy, as was the configuration. Now the solution almost doesn't require the time for managing it.
What about the implementation team?
The implementation was done by the Certified Check Point Expert we have in the in-house team - the Check Point solutions are popular, so there are such engineer available on the job market.
What's my experience with pricing, setup cost, and licensing?
The overall cost of the solution is really high. You should properly scale the setup you are planning to purchase.
The licensing model is simple, but some of the software blades are not included into the default bundles and should be purchased separately - pay attention to that.
Which other solutions did I evaluate?
We didn't evaluate the other solutions.
What other advice do I have?
The correct performance sizing is essential for this kind of software - use the tools provided by the vendor, and consult the sales if you are still not sure.
Which deployment model are you using for this solution?