But later one, applications such as FTP, SIP, etc. started to open dynamic ports, and firewalls were forced to evolve and become more application aware. On the other hand Proxy Firewalls such as MS ISA – I know it’s a piece of crap – but such firewalls were able to see the application layer, add rules to prevent people from downloading ZIP and MP3 files, Inspect SMTP for spam, etc. So firewall vendors were forced to compete with them in this, especially that such Proxy Firewalls are popular in SOHO and SMB networks. And I think this is when UTM came to life. Vendors also competed with each other and each vendor wanted to have more features in his data-sheet, and I think were are going to see vendors announcing that their firewalls are the first to market with built in Coffee Makers.

I can agree with what you wrote here sometimes. For an ISP’s Data Centre or a Large Multinational Company this can be true. Having an all in one box is not the best choice. But when it comes to normal mid-range enterprises they can have a UTM, and in such case having two layers of clustered UTM’s from different vendors can protect them when complexity lead to a vulnerability in one box.

I’m not sure you get the point I am trying to convey. This might be because my poor use of a quote (yes, I did notice), you guerrilla marketing your site (yes, I did notice), or just straight up miscommunication.

Basically, what I am trying to say, is that we need to get away from trying to lump everything onto one box. At times it does make sense because of cost, either monetarily or in man-hours. But people need to remember that the added complexity in these devices may increase the risks the controls are trying to address.

I hope that helps.

Go forth and do good things,
Don C. Weber

Thanks,

Bill