Check Point NGFW Reviews

I am currently working with Check Point Firewall because most of your customers have it deployed in their networks. Recently, we were involved in a significant firewall micro-implementation for one of our customers. We created configuration templates, specifically for routing and setting up bond interfaces within CheckPoint. These interfaces are similar to Cisco's port channels, where multiple physical interfaces are bound into one. 

I primarily work on the network side, so my expertise lies in configuring and working with firewalls. I have experience in firewall policies and know how to configure them within Check Point, including blocking URLs and specific website categories. However, I acknowledge that there's room for improvement, particularly in areas related to application-level control within the firewall. While I can't pinpoint a specific area for improvement, I am trying to enhance my skills and knowledge in various aspects of firewall management.

I have been using Check Point NGFW for the last 12 months.

During a project where I was working with a customer deploying Maestro in their network, we encountered an issue related to multicast traffic. Check Point's expert team suggested that we install a package called Jumbo Hotfix inside the Check Point, which resolved the problem. Overall, despite this issue, Check Point NGFW is a stable product with minimal encountered bugs.

Check Point is a stable product, but when compared to other vendors like Palo Alto and Fortinet, I'd recommend going with Palo Alto. Palo Alto is a more stable and robust firewall solution than Check Point.

The deployment of Check Point was straightforward. In the Azure cloud environment, it took approximately thirteen minutes to complete the deployment, while on-premises, the initial setup was relatively easy and not complicated. I have deployed Check Point both on-premises and in the Azure cloud. The deployment in Azure took place around four months ago for a customer's proof of concept (POC). The primary reason for this deployment was to address the customer's VPN subnet limitations with Azure VPN. I suggested that moving to a cloud-based CheckPoint solution would provide better VPN connections without IP subnet limitations. In the Azure deployment, I created a hub and VPN and deployed two CheckPoint instances, not just one. To manage these instances, I used a load balancer within the Azure network.

Regarding firewalls, my role primarily involves designing and deploying them, then handing over the management to the operations team. While I find the deployment process relatively easy, the issues the operations team faces later on can impact my perspective. I'd rate Check Point a 7 out of 10. The ease of deployment is a plus, but we've encountered some problems with Check Point, particularly related to documentation. Compared to vendors like Cisco and Juniper, the quality and comprehensiveness of the documentation could be improved.

The implementation of Check Point firewalls has been a transformative experience for our organization. It has significantly improved our cybersecurity posture, enabling us to detect and prevent threats more effectively, streamline management, and stay agile in the face of evolving security challenges. 

With Check Point, we are not just securing our data, we are also protecting our brand and reputation. The value they bring to our organization is immeasurable, making them an essential component of our overall cybersecurity strategy.

In today's ever-evolving digital landscape, cybersecurity is paramount for any organization. For our company, the implementation of Check Point firewalls has proven to be a pivotal moment in our ongoing quest to bolster our cybersecurity defenses. These firewalls have not only improved our security measures but have also positively impacted our overall business operations.

In our industry, adhering to stringent compliance regulations is paramount. Check Point firewalls help us ensure compliance with industry-specific regulations and standards, such as HIPAA, GDPR, or PCI DSS. This compliance assurance has eased the audit process and instilled trust among our clients.

Check Point firewalls have significantly improved our ability to detect and prevent threats. The robust threat intelligence capabilities, coupled with real-time monitoring, have allowed us to swiftly respond to potential security breaches. As a result, we have experienced a noticeable decrease in security incidents and data breaches, which ultimately translates into cost savings and a bolstered reputation.

As our organization grows, so does the volume of data we need to protect. Check Point firewalls have proved scalable and can handle increased traffic and the addition of new services without compromising performance. This scalability ensures that our security measures are always aligned with our business growth.

One of the standout features of Check Point firewalls is their user-friendly management interface. This intuitive platform has streamlined firewall management, making it accessible to both our in-house IT team and non-technical staff. This has resulted in a more efficient use of resources and time, allowing our IT personnel to focus on other critical tasks.

The product needs comprehensive reporting and analytics capabilities to help organizations gain insights into their security posture and demonstrate compliance to stakeholders.

It requires enhanced automation tools for regulatory compliance to ease the burden of compliance reporting and auditing.

The solution needs to tighten security by facilitating easy integration with MFA solutions to enhance user authentication.

It needs to integrate automation and orchestration capabilities to streamline incident response and automate routine security tasks, reducing the workload on security teams.

As containerization and microservices become more prevalent, it needs to provide security solutions that protect these modern application architectures effectively. Features like runtime protection and security scanning for containers can be beneficial.

I've used the solution for almost five years now.

Check Point firewalls are quite robust and resilient.

Check Point firewalls have proved scalable and can handle increased traffic and the addition of new services without compromising performance.

The technical support is recommended. I'd give them an A++++.

Positive

I did not previously use a different solution. 

The initial setup was straightforward.

We deployed the solution using Check Point's PS Support. Their team is highly experienced and professional.

It's worth the cost.

Initially, the cost of the investment might seem high compared to other vendors. However, in the long run, it might prove to be economical and cost-efficient.

I also evaluated Fortinet and Cisco ASA.

We have multiple customers that use this product.  Integrated logging is the best around.  

It's clear and does the job it's supposed to do.  

We typically install this as the network edges and encourage our customers to have one at each location. Some prefer to backhall the smaller sites to the main branch where it handles all the inspection and rules.  

We also set up multifactor SSL VPN solutions at the main location which allows visibility into remote worker traffic. Overall, it's used mostly by small to medium businesses.

We have been able to sell this product for a long time as it's highly rated and has a deep feature set. We have probably sold millions of dollars worth of Check Point products over the years.  

When the customer comes to us wanting the most protection we typically suggest Check Point first. Our engineers enjoy being able to quickly deploy a solution and have the familiarity with the product to be able to troubleshoot it quickly once it's deployed. For the most part, we train our customers to be able to manage it themselves.

Mostly the logging features of the Check Point NGFW are the most valuable.  Being able to search in clear text is simple for the customer and for troubleshooting an environment. 

I also like that you can get trial licenses for just about every product solution.  This allows us to suggest a feature, implement it, and then show the customer that it has value. We tend to retain the customer on that product for the long term once it has been deployed and they are able to see what it's doing to protect them.

The only thing holding it back is the price. It's too expensive for mid-market companies. There are other platforms that have emerged that have a similar feature set, however, are more difficult to deploy. This is really only a problem for the engineers as the customer doesn't care how many hours the engineer has to put in to make it work in their environment. If the Check Point product came in at a lower price point it would make it easier for the customer to see the value in cost, thus making it easier for us to sell.

I've used the solution for seven years.

It has been the most stable for a long time.  That track record is something that you can show the customer. 

The product is highly scalable especially if you integrate the orchestration solution. 

Support is hit or miss lately. They have lost too many good reps to other companies. 

Positive

We have used other solutions, however, we continue to use Check Point NGFW.

The initial setup is simple once you have the appropriate infrastructure setup.  Once Check Point gets away from the central management solution and allows for on-box management it will make small businesses happier. 

I am part of the vendor team. We do a good job implementing it, although sometimes it takes too much time to deploy a product. 

We tell the customer that the ROI is the protection they are receiving and the stability of the product.  

We tell customers truthfully it's the best product, however, it has the highest cost and you'll pay for each license.  

We are always evaluating other solutions for our customers. Palo Alto and Fortigate are the top two others at the moment.

They just need to get the pricing down or do a better job of bundling the licensing.

The primary distinction between an NG Firewall and a traditional firewall lies in their configuration flexibility and scalability. Regarding options and features, the spoofing functionality in Check Point has been instrumental in enhancing security in our critical environment. It plays a crucial role in securing our internet connectivity.

Its functionality is highly satisfactory. In the newer Check Point version, there are additional features in VPN and IP security that enhance tunnel security. This flexibility extends to the Check Point MDM platform, allowing for streamlined management across different domains. In my current client's complex infrastructure, there's often a need to replicate rules from one firewall to another within the same room. With Check Point, it's a straightforward process of creating the rules in one policy and then easily copying and pasting them into other policies.

The log management process in MDS consumes a significant amount of storage, so it would be highly beneficial if there's an opportunity to optimize these logs and save storage space. While it does enhance network security, it tends to consume substantial resources, including CPU, memory, and storage. It could be an exceptionally useful and efficient solution if there were outgoing or AI-driven algorithms to streamline log management and periodically delay the logs.

I have been working with it for almost four years.

Regarding stability, I would rate it seven out of ten. While there have been occasional issues like false positives and blocking misreads in my NGFW, overall, it's a good product.

In terms of scalability, I would rate it seven out of ten.

The level of support provided depends on the specific contract. With a premium contract, it gets you treated as a top-priority customer, and they respond promptly, making every effort to find solutions. If you have a standard support contract, your experience might be more like that of an ordinary customer. In general, I've found them to be helpful, and I would rate their support six out of ten.

Neutral

I was working with Palo Alto for a couple of years, and I found their data protection functionality to be particularly interesting. I believe this feature is quite innovative and that other vendors should consider taking inspiration from it.

When it comes to the setup process, I've noticed that publishing and informing policies in different steps can be a bit complex. The typical sequence of publishing policies, configuring them, and then deploying them to the firewall can feel suboptimal at times. There are situations where an immediate policy installation is needed and it would be beneficial if there were options to install policies directly before the publishing step. Overall, the setup process is not overly complex, but it's not as straightforward.

When it comes to the quality-price ratio, I've found that Check Point offers a competitive balance in the market. I would rate it four out of ten.

I would rate it six out of ten.

We've used the solution for perimeter and DMZ security as we host a website that is accessible online.

On the perimeter, we have Check Point acting as the entry point to our web server farm with load balancers. The access policy is configured with the least privilege, only allowing connections that are part of business requirements.

Intrusion prevention is enabled in prevent mode to detect and block well-known vulnerabilities and attacks. The device connects to Check Point's cloud for updates on signatures to new threats. 

We are peering with Partners via Site-to-Site VPNs for Services.

1. It's offering perimeter security to publicly accessible sites. There's better security at the edge and DMZ with the use of access policies. 

2. The activation of Intrusion Prevention Blades offers better security at the perimeter and between DMZ Zones. IPs also have prebuilt security profiles making deployments of IPS fast and efficient, and exceptions to the rule base are easy.

3. The use of a remote access VPN is used to connect to partner sites.

4. Check Point offers virtualized systems, making it easy to scale. Instead of buying new equipment, we have set up virtual systems for the DC and user networks.

1. Intrusion prevention. Preventing and detecting well know vulnerabilities to our publicly accessible systems is easy. Inbuilt predefined security profiles can be deployed out of the box.

2. Virtualized security. Virtualized products are used to provide more scalability and ease of administration to the network.

3. Identity awareness. Granular policies on the firewall are based on identities.

4. Site-to-site VPN. We can make connections with partners securely.

5. Reporting. Prebuilt reports that are already in a well-presented manner could be presented to management.

6. Access Policy and NAT rules base.

1. Complexity in upgrades. Currently, upgrades are quite cumbersome. I would prefer the click of a button and process upgrades.

2. Pricing. The pricing is quite high as compared to other industry firewalls (such as Cisco or Fortinet).

3. Documentation. They have to improve on providing more documentation and examples for certain features online. In other sections, it feels shallow and we could use more information and examples.

4. Complexity in system tweaks. There are some knobs that need to be tweaked at the configuration files on the CLI which can be considered complex.

5. Check Point Virtual Security. The features take a bit more time to be released as compared to physical gateways.

I've used the solution from 2017 until now.

A word of caution, especially on new software: you might hit a couple of bugs. Therefore, the general recommendation is to wait for a few takes before upgrading to a major version.

With older versions it's stable.

The solution offers high-performance devices ranging from small to big data centers.

Virtual Security offers up to 13 connected gateways helping with managed security.

First-line support is hit or miss, and at times getting an engineer to assist on the call can take hours.

Opening tickets on the Check Point platform is ok with the first response depending on the workload of the engineers.

This is one place Check Point needs to improve.

Positive

Previously we were using Cisco ASA 5585. However, the performance was not reliable, and scaling would have been an issue.

We opted to go with Check Point, which could handle high performance and scaling was easier. Check Point also offered IPS features which were easier. Check Point also had better reporting and management tools.

The initial setup was a bit complex since we were deploying virtual systems.

The interface configurations, access policy, VPNs, and NAT setup were easy. The complexity was in understanding how Check Point handles virtualized security instead of physical security gateways.

The initial implementation was with the help of a vendor with good knowledge of the product.

It's used to protect the organization from security threats and provide connectivity to our applications which is the main platform for business. That's the ROI we've noted.

The pricing and licensing for Check Point are high.

Due to experience with Check Point, we did not evaluate other options (like Fortigate or Palo Alto).

Generally, Check Point is a good product with a lot of security features that I would recommend to any organization.

We are a top enterprise with a huge Check Point presence. We have been using Check Point since its older R65 version, and we are currently on the R81 version. 

We have close to 200 Check Point devices for DC and all remote sites. We are also using Check Point for our edge security along with the Sandbox environment. 

Check Point is also used as a VPN solution which is a pretty easy setup. 

Check Point Cloud Guard is an excellent find we were able to do some cloud-based networking in our private cloud. 

HTTP forwarding is one feature that I haven't seen in Check Point's competitors. With it, I can just send all HTTP traffic to a cloud-based proxy directly without building a GRE tunnel or VPN. 

We took some major leaps with Check Point virtualization. VSX is one of the phenomenal features of Check Point. It allows us to virtualize multiple environments. We have saved hundreds of thousands of dollars with VSX. 

Instead of using a number of small firewalls, we bought a couple of CP 23K series with 20 virtual licenses. It really worked for us with the MDS and smart log. 

HTTP forwarding is something I haven't seen elsewhere.

VSX, URL filtering, and DLP are all excellent. VSX is the best thing we have used. We can use virtual switches and virtual routers for VLAN extensions. Another great feature is the "Active-Active" state that no other firewalls provide. I worked with other vendors as well; however, Check Point is the only one that can provide very good support on the Active-Active state. I still like the traditional way of troubleshooting using TCPDUMP and the FW monitor. Application IDs can be used, which is a significant improvement from previous versions.

The web UI for VSX could be better. As we enable VSX on physical gateways we cannot access the web UI. Smart log setup isn't so easy. We have some issues with some domains, however, overall, the smart log is a really good feature that helps navigate to the right domains for troubleshooting. 

We have so many applications, including smart updates, provisioning, etc. I would like to see a single pane where I can do everything instead of going to each application and making changes. 

More and more application IDs and integration is a really good thing and that's something I am looking for. 

I've used the solution for eight years.  

We used another solution before, which was only command-line based. Check Point was only the major competitor and best option a decade ago. 

We need to choose technology first, and obviously, others follow. Check Point's three-tier architecture is the main reason for us using it. I believe the pricing is pretty competitive.

We did look at other options, including Fortinet, however, nothing is as good as Checkpoint. 

Check Point is a good solution. It is a reliable solution above all. 

We are Check Point's Authorized partners, and Check Point NGFW is used for our Client's network security. These Next Generation Firewalls are excellent. All of our customers are happy. Check Point gateways provide superior security compared to any competitors in the Indian market. 

Our clients have networking solutions that range from 50 to 200 routers and hubs. Also, their endpoints range from 100 to 2,000 endpoints. Check Point's unique solution helps us to cater to all sizes of companies, from SMEs to large enterprises without compromising on any security vulnerabilities.

Check Point NGFW gateways provide superior security compared to any Indian market competitors. It delivers the highest-caliber threat prevention with excellent SandBlast Zero Day protection out of the box. 

Also, its on-demand hyper-scale threat prevention performance provides our customer with cloud-level expansion and resiliency on-premises. By integrating the most advanced threat prevention and consolidated management, Check Point's security gateway appliances are designed to prevent any cyber attack, reduce complexity, and lower our clients' costs.

The features which are most valuable include:

1] Uncompromising Security

2] Security at Hyperscale

3] Unified Security

4] Check Point's Quantum helps our clients in their overall cybersecurity practice

5] Protects network, data center, endpoints, and IoT

6] Ultra-scalable protection against Gen-V cyber attacks

7] Best Protection with SandBlast Threat Prevention

8] Maestro Hyper-scale Networking

9] Remote Access VPN protects your Remote Users

10] Highest level of security with Autonomous Threat Prevention

11] Modular Hardware and high-performance CPUs

We would like to see the following improvements:

1] Check Point can improve a little better in their technical services, especially in the Indian market. 

2] Check point can add features like log management which would be very useful to get compliant with CERTin standards. 

3] Check Point should look into SIEM solutions as today's Indian market is going towards SOC capability, and SIEM is the backbone of any SOC solution.

4] Automation is the crux of today's digital transformation era, and Check Point should include automation in its products.

5] Incident forensics like UBA or CASB is the next challenge in the security domain, and these features should be included if possible.

Its been three years since I strated using the product.

The solution is highly stable.

This solution is highly scalable.

The technical support is nice.

Positive

We are currently working with Sophos, however, we started recommending Check Point to our clients due to the excellent capabilities that they carry.

The setup is straightforward.

The setup, pricing or licensing cost of other products is on-par or a little higher than Check Point.

We have evaluated Sophos and Palo Alto.

We have deployed this product for the protection of our MPLS connection between 20 geographic distinct sites, two data centers, and an internet connection.

We are also using the product to establish IPsec tunnels with 5 external entities totally transparent to our users.

We're a new company that started to invest in cybersecurity and protection products and chose Check Point for their cloud solutions that protect a vast majority of our devices. 

We are happy with the deployment of the product and the ease of use.

Since the deployment and go-live of the solution, we noted a rise in productivity of some people, we think it has to do with the deployment of the application control and web filtering capabilities of the product.

We're also happy with the deployment process and the help that the Check Point partner provided in the initial configuration of the product. 

Our users also noted more speed on the internet connection, as I said probably because of the block rules implemented with the features mentioned above.

I have to say that it was Application Control and web filtering are excellent. We knew we had users watching videos and using not approved apps yet didn't have a way to centrally block them. With NGFW we do and we can set up profiles/groups of users with different permissions which allow for example IT to have media streaming access and "regular" users don't.

Also having a VPN concentrator on the same device is a plus since made our user management with Active Directory connection a lot easier and faster.

We're a new company so regarding additional features we can name only a few, for example, a better API for extracting data so that we can integrate with our monitoring solution, at the moment we use Nagios/Icinga.

It would be nice if there is a mobile-friendly console for our techs so that they can help users when not at their desks since they do frequent external work.

Better connection between the legacy console and the new one since we have a company that still uses an on-prem device and we have to use two consoles.

We've been using this product for one year.

We didn't use a previous solution. 

I'd advise others to read the license differences and features.

We've evaluated Fortinet and Forscout products.