Skybox Security Suite Review

Helps us clean up firewall rules and backup device config, but it needs a web interface


What is our primary use case?

Primary use case for us is configuration management and configuration compliance.

How has it helped my organization?

It's given us more visibility in terms of what are the kinds of configurations that are on these devices, and how many of these are stale rules. So it's helped greatly in terms of cleaning up of rules, for sure. And it has definitely given a more secure way of backing up the configuration on these devices.

What is most valuable?

For us, it's more important for our firewalls, to maintain the configuration compliance, to look at duplication of rules; clean up functionalities on the firewall and compliance of the firewall. That's where it's most important. We're still looking at making use of this tool for other purposes, but it's still a work in progress at this moment.

We are using Network Assurance, primarily for our devices like routers and switches.

Change Manager is still a work in progress for us. While we have that module, we're still working on customizing it. It's understandable and it works well, right now. We are looking at automating that whole change management procedure using a third-party API integration along with Skybox. So that's still a work in progress at the moment.

What needs improvement?

The primary room for improvement would be to enable a web interface, which is not something which is there in the product. This is supposed to have come a year, a year and a half ago, but still has failed to come out. It still needs a client application to be installed on a workstation to be able to access that server and then run these reports. So I cannot extend that access to anybody. It has to be one administrator all the time. So unlike a web interface, where you can give multiple users simultaneous access and generate the various reports, that isn't a possibility at the moment.

For how long have I used the solution?

One to three years.

What do I think about the stability of the solution?

The stability is something that is questionable. I don't know whether it is because of the kind of infrastructure we have or because of the product in itself. We're running it on a virtual machine right now. Maybe once a month, or once in every 45 days, it requires a restart because the application fails to connect. So I have to restart the whole Skybox Manager itself, the Skybox server itself, and then connect to it from our Skybox Manager. As I said, I don't know whether it's because of our environment or if this is primarily how the application behaves on a VM environment. That's still a question mark at the moment.

What do I think about the scalability of the solution?

I don't think scalability is a problem area, to be quite frank. As to how much you can run, it primarily depends on the type of licenses you have. And they also have a hardware appliance which can take on any workload. So I don't think this is a problem area.

How is customer service and technical support?

The technical support is only telephoning. While I do have a local contact with whom speak, more often it's via the telephone. They do have a fairly decent turnaround time. I wouldn't rate them as the best people around in terms of turnaround time, but it's fairly decent. I haven't had too many negative experiences with them so I would rate them fairly satisfactory at the moment.

Which solutions did we use previously?

We were not using any other solution, not something similar to Skybox at least. Our principle company was using a competitor product from Tufin. Their use case was fairly limited to firewalls. We wanted something beyond firewalls and also wanted an ability to manage and automate the change on the firewalls, etc. That is why we went for Skybox.

How was the initial setup?

It was definitely complex. It wasn't straightforward by any means. It's not something that a person who doesn't know the product can deploy. It's not a simple double-click on an MSI or an EXE and it starts running. The documentation needs a lot of improvement, the setup documentation. But we had brought in our Professional Services at the time of installation, so someone was here to do that installation. But if you were to ask me to do it from scratch, I would hesitate to do so because it was rather complicated even just looking at it.

What's my experience with pricing, setup cost, and licensing?

I think for the cost, what we got definitely is worth it. We're looking to expand it come next financial year, that will start from April of 2018. We'll need to look at how we will get better pricing this time around. So we're looking to expand the scope four-fold or five-fold, beyond what we have actually done initially.

The only caution I would give is that whenever you license for Firewall Assurance at the same time, for some weird reason, you have to get one Network Assurance license, just to manage one firewall. That's a little bit of overkill. But otherwise, in general, the pricing is fairly okay. But I would prefer that they change that licensing model for a firewall not having to consume a Network Assurance license.

Which other solutions did I evaluate?

We did a proof of concept with Skybox and Tufin, both. In terms of setup times, in terms of the interface in itself, Tufin was much better. But Skybox had better features and we felt it fit in more for our use cases, which is why we went with Skybox.

What other advice do I have?

If you choose Skybox, then I would say spend a lot of time making sure that your network and your IT segment and all your devices and scope are properly documented. Make sure everybody fully understands how each of your networks are interconnected and exactly how your deployment happens. Because without that documentation, you will have a real hard time even explaining to a Professional Services guy how this needs to be set up. Because, like I said, this is not something which is straightforward.

It does need some time, especially in an enterprise environment where you're primarily using an RFC 1918, which is a private address space. Most of the time you will see that address space being used across different LAN communication technologies, so you will see a lot of conflict. You might see a lot of duplication. That is where the real problems start. So I would rather spend more time analyzing the whole setup, sitting and making sure it's well documented, before even getting into documentation. That's what I would tell the prospective buyers of Skybox.

Right now, based on my experience of having gone through, of having used it for the last one-and-a-half to two years, I would rate it about a seven out of 10. The reason for that is because of the lack of a web interface which is a big no-no for most companies. In today's world, nobody wants to use a fixed client to manage a security appliance. And the second one is because of the complexity of the whole setup itself. Otherwise, the product in itself is fairly good.

Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
1 visitor found this review helpful
Add a Comment
Guest
Sign Up with Email