No Offense to Steven, but you are running business, do you really want your sites security/reputation to be at the mercy of an Open Source Community? All of the businesses that I do work for dont use FOSS based UTMs (IPfire, pfsesne, etc.) They use Cisco, Juniper, Fortinet, Arbor Networks SonicWall, because when things go wrong and they eventually will, you have a support contract, and someone to call that can fix the issue.
Great points. That was certainly a consideration, even though the rest of the software stack is all FOSS except vBulletin. Also these UTM appliances are great because they are fairly low in terms of power consumption.
I actually had a call with the Dell/ Sonicwall guys, and went over to the Fortinet offices to chat with them about sizing. Basically the Dell Sonicwall recommendation was a NSA 2400 or NSA 3500 and the Fortinet recommendation was the Fortigate 100d, maybe a Fortigate 60c (the Fortigate 60d is announced but when I called, they could not get me a pair so paper launch.) I also have the Fortinet Fortigate 60c sitting next to me right here that I bought for deploying in the DC.
The sizing for these boxes is basically due to the idea that whatever is out there should be able to handle 6,000 new connections/ sec, which is a figure for a hot reddit link. Given, STH has seen one of those back in 2011 but the site at that point couldn't cope. The Fortinet Fortigate 60c does 3,000 new connections/ sec which is realistically what the site would see at most since, let's face it, there is no content around mainstream news.
Now the other side, cost...
Cost wise, even using ebay deals, with 1 year of support and two boxes in HA here is the breakdown:
2x Fortinet Fortigate 60C was going to be around $1,000.
2x Fortinet Fortigate 100d was around $3,200
2x Sonicwall NSA 2400 was about $2,700
2x Sonicwall NSA 3500 was about $4,000
Just as an idea, I have been watching ebay for weeks and there is an element to this which is timing since I've already invested in the servers and switches for the site meanwhile Amazon costs are continuing to rise sharply.
The other benefit from pfsense is that it is not a UTM. Seems like a bad distinction at first, but those boxes are sold on the performance of things like e-mail scanning, virus scanning, content filtering, branch office VPN and etc. All of those features decrease performance so would likely not be turned on. After all, there will not be several office workers sitting behind the firewall. The marketing feature set also means that there are some drawbacks. One is that if you want a load balancer, you need a different appliance that generally costs more.
Not to say that the answer one day will not be moving to a UTM solution, I would want to go that route. But with my $300 and $30/mo project looking at going to 10x those figures, I did have to make some budget trade-offs. We'll see how it goes. If it is looking not so good, the Fortinet units will go in.
