Opinion:Checkpoint Buys Nokia Security Appliances — Time to Change

Clever Move, Cheap Buy and Stops Losing Sales

This is an over­all good move for Checkpoint. In the middle of the bad reces­sion, Nokia who, lets face it, is the only hard­ware part­ner they have, tries to sell the appli­ance divi­sion after ten years of try­ing to make it into some­thing big­ger. Nokia seems to be des­per­ate to sell, and it seems reas­on­able to assume the Checkpoint got the busi­ness for a cheap price.

But does any­one also want to make a bet that sales were under threat ? How many com­pan­ies stopped pur­chas­ing while they waited to hear about the future of the IPSO plat­form ? How many star­ted to recon­sider their fire­wall plat­form depend­ent on who bought the IPSO hard­ware ? Yeah, I am pretty sure that man­age­ment at Checkpoint were very nervous about what might hap­pen and were forced to step in.

The net­work secur­ity mar­ket is now con­verged on using appli­ances at almost every level and this has left Checkpoint with a twenty year old strategy and no options. If they integ­rate the hard­ware and soft­ware, they now look like a viable secur­ity vendor, cus­tom­ers will be able to buy their fire­walls from a single vendor.

Internally, there are going to be prob­lems too. Checkpoint has always said that they are a soft­ware com­pany and they rely on part­ners for hard­ware, there­fore they might not have any “hard­ware cul­ture”. They are going to need to find it quickly. Their own appli­ance team for their UTM soft­ware are going to be won­der­ing what is going to happen.

Oh yeah, Crossbeam is going to be in trouble and users with Crossbeam hard­ware are going to be ask­ing ser­i­ous ques­tions. I would expect Crossbem to release their own fire­wall products quickly. Since Crossbeam is at the biggest sites, some very big Checkpoint cus­tom­ers could be unhappy.

Customer Viewpoint and Experience

Finally, the Checkpoint /​ IPSO plat­form will come from a single vendor. No longer will I have to sit in meet­ings dis­cuss­ing why Nokia and Checkpoint claim its not their fault (yes, we have all had that experience).

The scary part is whether any­thing will ever get done. Usually, it was Nokia that was able to get Checkpoint to fix things.

Will we see integ­ra­tion between Checkpoint and IPSO as last ?

Let me quote Joe from the com­ments at The Register

Wow, what have we to look for­ward to? Yup more bad ser­vice and sup­port from CP! Oops i mean over­priced bad sup­port. The reason why we stuck with CP the last dec­ade is because Nokia gave bet­ter sup­port for CP than CP does. Now we will have to learn Hebrew so we can trans­late their pathetic doc­u­ment­a­tion. That’s why we paid Nokia so we didn’t have to. Tis sad sad days ahead. Now i sup­pose they are going to kill off IPSO and run everything on SPLAT. That really sucks! Anyone who has used both can testify that IPSO is so much more mature and man­age­able plat­form. I guess when our FWs come up for replace­ment we will just exit com­pletely from CP and con­tinue down the road with Juniper.

Why WOULD you buy Checkpoint firewalls ?

This move makes it look easier to buy Checkpoint fire­walls. However, why would you ? I have had so much pain with Checkpoint /​ Nokia sup­port and products that I don’t regard them as a ser­i­ous vendor.

Let me give you a brief list of my com­plaints and prob­lems with Nokia /​ Checkpoint firewalls:

• The price of Nokia and Checkpoint main­ten­ance con­tracts is astronomical.
• New fea­tures and cap­ab­il­it­ies take a l-​​o-​​n-​​g time to appear in the product, usu­ally after every other vendor has delivered.
• Upgrading and man­aging Provider-​​1 is much harder and more pain­ful than Cisco Security Manager or Netscreen Security Manager. Yes, I have installed and oper­ated them all.
• Using Cisco Security Manager and Netscreen Security Manager is much easier and intu­it­ive than using Provider-​​1
• The pro­cess for upgrad­ing IPSO /​ Firewall-​​1 soft­ware is pain­ful com­pared to Cisco ASA /​ Juniper NetScreen.
• IPSO /​ Firewall-​​1 per­form­ance is low and poor value for money. Delivering multi-​​gigabit per­form­ance is point­less exer­cise since its costs so much in licenses and hardware.
• legendary sup­port — so legendar­ily bad that many people don’t even bother con­tact­ing Checkpoint with problems.
• poor integ­ra­tion — load­ing a static arp in IPSO for every NAT rule in Firewall-​​1 makes my teeth ache.
• Documentation is atro­cious, and hid­den behind a paywall.

and I could go on. And on.

Viewpoint

Checkpoint fire­walls were one of the first products in the secur­ity mar­ket­place. And they look and act like it. Features and per­form­ance are lim­ited, and the soft­ware, when com­pared to other vendors, is not com­pet­it­ive. So why do they still exist ? Because it’s too hard to change.

In fact, migrat­ing from one fire­wall brand to another is an easier task these days. All fire­walls are sim­ilar in func­tion, have sim­ilar inter­faces, and deliver the same out­come — many people don’t believe this, espe­cially people who have a nar­row view after ten or fif­teen years of Checkpoint hell. I won­der if these people believe that all other fire­walls must be dif­fi­cult and pain­ful, and there­fore it is bet­ter to stay with the “one you know” instead of mov­ing into the next gen­er­a­tion. Both Cisco and Juniper have soft­ware tools that migrate Firewall-​​1 rules to make it even easier.

To make things worse, the devel­op­ment of entire secur­ity eco­sys­tems means that it is even more import­ant to make the change now. Cisco and Juniper have both built the IPS hard­ware into their fire­walls, Checkpoint still uses a sep­ar­ate device — an obsol­ete and expens­ive option.

I would sug­gest that this is a good time to be con­sid­er­ing your secur­ity plat­form, and look­ing to eval­u­ate whether Juniper or Cisco will deliver bet­ter, cheaper, faster and with a stronger future. Migrating away from Checkpoint is much easier than you think, have bet­ter oper­a­tional func­tions and can save a lot of money. Think about that in the next budget session.

Please rate this post:

(1 votes, average: 10.00 out of 10)

 Loading ...