Check Point CloudGuard Network Security Reviews

As per the solution's blade design, there are many options. For example, you have to buy a UTM blade and an advanced malware blade, etc. If the blade license is there, we can configure from the firewall GUI. 

The net policy and routing are also great features.

If you compare the GUI with the Palo Alto and Cisco, they're very easy. Check Point, due to its design, is a little bit complex. They should make the GUI easy to use so that anyone can understand it, like Fortinet's GUI. Many companies end up using Fortinet because the GUI is very easy, and there's no need for training. They just deploy the box and do the configuration.

Also, we have to inform customers that with Check Point there's no need to purchase any routing device. Check Point can do that routing as well as the Firewall and the IPS. The marketing should be stronger, to show that customers only need one box to handle all the features. It will be cost-effective and enhance the performance and value, but because of their poor marketing, customers don't realize this.

In the future, a color string would be powerful. Sandboxing should also be offered. Many people want the Trend Sandbox but not on the cloud. In the Middle East, there is a policy for Sandboxing that states it should be on Trend as per the government law. They have Sandboxing solutions on the cloud, but they have to bring the solution onto Trend also. Palo Alto has Wildfire, Cisco has Talos, and Forcepoint has one available as well.

In the future, routing protocols should be more supported like OSPF and BGP. There needs to be integration with the SDN. I don't know if SDN is there or not in Check Point, but SDN is one of the major requirements nowadays.

The solution is very stable.

We just deployed the solution, so scalability I cannot speak to right now. But, as per Gartner and NSS Lab, they're allegedly very good. I don't think there will be an issue with scalability.

I am currently also working on Cisco ASA, Fortinet, and Palo Alto.

I'm an Operation Engineer; I handle the deployments myself. 

Compared to Cisco Firepower Threat Defense, the solution is cheap. However, not as cheap as Fortinet or Palo Alto. If clients have smaller budgets, we would have to advise one of those instead.

There are two deployment model modes in Check Point. One is a gateway level and one is a no gateway all-in-one box solution. With the gateway level, only hardware will be there, all operating systems are stored in a VMware and if there are any issues in the hardware, you just replace the box; all of your policies will be saved into VMware.

The all-in-one box you have the GUI policies and also the gateway so it's secure. If there is an issue in the box - like failure or downtime - all of the networks will be affected.

I would rate the solution eight out of ten. We haven't been using it too long, so we haven't had a chance to look at all aspects of the solution. I would recommend Check Point to customers because it is an affordable option.

We install the solution for our customers and Check Point is our preferred solution in any firewall deployment. The two-layer architecture with the administration and security makes a difference and in every instance, we know who the user is.

The touch features are very different than other brands. From the feedback I get from my customers, Check Point is the best.

Check Point gives us a strong solution that we can depend on when deploying it for clients.

The most valuable features are within the unique architecture that creates flexibility in the deployment.

The knowledge base that is available is limited and it is on a closed network where only a customer or certified engineer will know about it. A beginner who wants to learn about the product actually has to enroll in training or get certified and have a valid license or certification to access information. That is something I find strange as most users would like to know about it. The new users would like to be able to see those areas and what type of concerns or any configuration issues they may have before deciding to work with the product. To me, that is a simple open-mindedness. In terms of the availability of the system and functionality of the product, there's no concern. But the problem is that efficient VSX (Virtual System Extension) deployment is complicated. Most of our customers are afraid to deploy any configuration changes because they are afraid something will happen.

It's not the same situation as with other products. I guess the reason behind it is the kind of architecture which they are using. There are more possibilities to crash than other products. That is the feedback I normally get from end-users, but even so, for us, I would say it's one of the best product.

Check Point is very stable. I would say that initially there were a couple of issues we had during deployments. But now we have climbed the learning curve of the product and all installations are very stable. We have most clients running on version 7.3 and didn't upgrade most further from there because we know that 7.3 is stable and it is what we are running most of the customers now.

Scalability is fine. In fact, we are demonstrating the hyper scale with most of the customer now. There is no doubt about the scalability and it is not a problem.

Up until now, we have not had to register with technical support from Check Point. If we needed help we got support with the presale technical support team from our region. He was able to help us internally. The team helps us to get products stable. Up until now, we did not contact them. It is not very transparent. They approach resolutions through a partner and the partner solves the case. They seem to mostly depend on partners for the resolution of issues.

We deploy a variety of products for our clients depending on their needs. Check Point is one of the most reliable.

I would say that the installation is straightforward when you have learned about the architecture. Before that, the installations may be a little confusing.

We are partners with Check Point so we handle the installations and deployment. In the beginning, we did have some engineers from Check Point assist us in the initial installations, but after that it was fine and we were able to manage it by ourselves.

Check Point pricing is high. It is a sector where there is heavy competition so it does not help when trying to sell the product. But one thing is that the sales chain is fantastic. The price is usually the most difficult thing when we discuss Check Point with customers, their feedback is that it is not a competitively inexpensive product. Clients want to know why that is and if we could scale the price. Check Point can have more presence in the market, but if they want it to compete, they have to come down in price a little more. I would say 20 to 30% lower. The product is fine.

The web application firewall is commonly used in most firewalls now. If they can add that as a feature, it would be a very strong scenario. When we use Check Point on a perimeter or a DMZ zone, the first thing that clients ask is if there is wireless protection. Check Point has IPS (Intrusion Prevention System) but it does not have wireless protection. So if production is using the cloud if they can integrate mobile app protection, mobile shielding, there's more value for Check Point, but if they include that, Check Point could be the very best firewall option.

On a scale from one to ten, when one is the worst and ten is the best, I would rate Check Point as an eight. It needs to do better in pricing and with broader features for mobile.

One thing that I learned from multiple installations of Check Point is that you have to train the customer before implementing. Unless the customer is already a highly skilled security engineer so that they know what they can get out of the product, they will not be as satisfied. Otherwise, just before the deployment, we have them go for training so they understand the product and what it can do.

They will be happier and they won't choose to go with another product in the future. Even with my engineers who understand many other products, I trained them properly before I send them out for deployments. Check Point is not a product that if you don't know you can just install without knowing anything about it. You have to know the architecture first. You have to know each and every option than work on the product. Then it will be far better and say no to certain features which are not important to use. On the other hand, knowing it is available is fantastic and becomes an option in the right situations.

We primarily use the solution as firewall security for our clients.

The IPS, application and URL filtering, as well as Identity Awareness, are all very valuable features.

Reporting needs improvement. It's difficult to utilize properly. Currently, I'm in a situation whereby a client of ours is looking for reporting on their organizational unit. Check Point has failed to do that. We've been trying to do it for the past month and we haven't been able to. We've also gotten techs from Check Point to call us to help and we just can't get the solution to do what we need it to do.

Sometimes, if you aren't familiar with the solution, it can be a bit complex, but it does become easier to use with time. However, every time they launch a new version, it becomes more complex and you need to take time to get familiar with all the changes. For every version that they upgrade, you need to upskill yourself. 

The stability of the solution is fantastic.

The scalability potential of the solution is great. We use the solution quite extensively. We do plan to increase usage in the future.

If I were rating technical support out of ten, I would give it a seven. They're inconsistent. Sometimes you do get guys from Check Point to help you out and then sometimes you don't. Sometimes it's hard getting a hold of them.

We didn't previously use a different solution.

The initial setup is straightforward. The time it takes to deploy depends on the organization.

We handled the implementation ourselves.

I am familiar with Fortinet, although I didn't do a direct comparison. I did compare other solutions as well.

For those who want to implement the solution, they should make sure they have a very strong networking background.

I would rate the solution eight out of ten.

We are able to use the solution for cloud protection and in parallel with or just for network protection. In our scenario, we use it as a border network firewall, which is based on a virtual environment and we're using it for the border protection of our network. 

We find Check Point valuable because they are 100% focused on security. It totally closes the potential vulnerability channel. We can check our mail and our attachments and we can scan everything easily. We get an immediate report about the situation of the attachments. We can discover if the target's security attack was started from phishing, etc. We also enjoy using the additional features that protect our internal customer from targeted attacks.

The stability of the solution could be improved, but this is the problem of all the solutions in the market. This isn't just a problem specific to Check Point.

The stability is good. It's really good compared with Palo Alto, Fortinet, and Cisco, most of all. But it definitely can be better.

The scalability of the solution is good. Right now, the solution protects about 400 customers.

The solution's technical support is good. If we have problems, we can speak directly to Check Point, or we can speak to one of their partners or a local partner. The solution has a great community that surrounds it.

The initial setup was complex because we were using a complex networking architecture. It took us about two days to implement the solution. For administration of all of this infrastructure, we need two people. For deployment and maintenance, we need just one person.

We used the implementation guide provided by the company to assist with deployment.

Our licensing is yearly at a fixed cost.

The solution has a very flexible pricing model. It can provide the same level of security and performance, but in parallel, can be subscription-based.

The solution is the on-premises deployment model which we use in our server environment.

We are an integration company, and although we deal with other solutions, we mainly focus on Check Point.

The solution is a great mix of user experience, flexibility, security features, and cost. After five years, I believe the total cost ownership will be much cheaper than any competitor.

The advice I would give to others interested in implementing is that this solution does have security problems. Not Check Point, per se, but in the network environment. The security recommendation from the Check Point and from us is to use the VSX in the internal network. It should not protect your border because there are some issues around bugs, etc. It could cause vulnerabilities if it's used this way. 

I would rate this solution eight out of ten.

Our primary use case of this solution is for security.

The IPs and the VPN are the most valuable features of this solution.

I would like to see an improvement on the zero-day threat detection. It is also not very user-friendly, so it would be great if it could be less complicated and easier to operate. The dashboard needs to be easier to use.

Also, if the solution could be cheaper, it would really help, because it is very expensive. 

I would like to see sand boxing added to the new version.

The program is very stable.

The technical support is excellent and they always responded when we had an issue.

The initial setup wasn't too complicated, but it wasn't very easy and straightforward. Deployment took us about a week. 

It is a very expensive program and there are additional costs despite the standard licensing fees. So I would like to see it being more affordable in the future.

I will recommend this program to others and my rating is seven out of ten. I do recommend that users should always use the checkpoints and backup as often as they can.

We are a solution reseller, and we also assist our clients with support. This is one of the solutions that we provide to our customers.

This solution can be deployed in many ways. It is available in the cloud on AWS and Azure. You can install it in a virtual machine, you can have it as a hybrid, and you can have it on-premises.

The most valuable feature of this solution is that you can start off with a simple firewall and expand it to UTM. You don't have to buy a UTM to start off with, but rather, you can buy a simple firewall and upgrade it. The simple firewall comes with many of the UTM features, in any case.

The management console can be simplified because at the moment, it is a bit of a challenge to use.

I would like to see support for software-defined wirings in the next release of this solution.

I've got Check Point systems that have not been rebooted in two years, so it is quite stable.

This solution is quite scalable, but it requires hardware upgrades from time to time. Or, if you go with a virtual environment then it is very scalable because you start with one CPU and can increase to twenty-four CPUs.

Technical support for this solution is fairly good. We have got enough skill in our business to do most of it, but once you raise a call with support, they give you quite the fast and effective answer.

The initial setup of this solution is in-between, but more on the complex side. It's not the most complex product that I've worked with, but definitely not the simplest product that I've worked with.

The price of this solution varies from small to extremely expensive. On average, it is normally on the lower end, being less expensive than Palo Alto or Cisco.

The biggest lesson that I have learned from this solution is to never assume that something is simple, because there's always a hidden snag that we run into.

I would rate this solution a nine out of ten.

This solution is very important for our network. We use it for the data on our servers and for our internet connections. We also use it for all of our user devices to connect to outside corporations. The IPS on our devices prevents any issues from occurring. We use the on-prem version of this solution.

We currently upgraded our devices to a new version. We have noticed a performance increase. We tested filtering features and it's an interesting feature that helps us with our tasks. We don't need very complex features.

It's a high-performance device. The network performance is also really good. We check how much time it takes for the servers. Our network performance has increased since using this solution. 

We have a local consultant for this solution. They can handle most of the operations with my team. We work together with the consultant sometimes for complicated scenarios like migration.

The initial setup is difficult. It took me three tries to get it right. The setup took two or three hours. We migrated from an old to a new one. It's not so complex but Check Point is complex in comparison to other firewalls. For example, Palo Alto is easier to install than Check Point. 

We negotiate every deal to get a discount for a higher number of devices. 

I would rate it a nine out of ten and I would recommend this solution. Their support team should be faster because sometimes when we need support their responses are late. 

Our primary use case of this solution is cloud protection for MC65 Operating System, AWS, and Microsoft.

Right now, we have a hybrid infrastructure. We needed security on the cloud, and this solution has provided the security that we were lacking.

• Traps prevention
• Security on the cloud

The product can still grow.

It is fast. It provides what we need at the moment, and it's still growing.

It is scalable. It's a cloud solution, so it's easy to implement and manage.

Technical support is fair. I have had some good support technicians when I call in. 

We were not on the cloud before. We're a big Check Point customer. Our secure perimeter is checkpoint, so we needed security for the cloud. So, it was a pretty easy decision right there. We evaluated other vendors, but it was easy decision.

The initial setup was straightforward, not complex.

We did our own deployment. We used a reseller for buying the product, but not for the implementation.

We also looked at Cisco's cloud products since we have a lot of Cisco products.

Look into it. I like how straightforward it is and simple it is to implement in the cloud. 

Our primary use case is for major cloud vendors: AWS and Azure. 

Moving into the cloud without having to change a lot of our internal processes and retrain staff is one of the biggest benefits of this solution. 

It is what we use mainly for on-premise. That is really what has us using the product, as it is sort of our standard for data centers.

I would like to see more focus on east-west traffic inspection and AWS.

Things are changing very quickly in the cloud. There is a lot more maturing that needs to happen as far as CloudGuard goes, specifically more around some cloud native type situations where everything is being shoehorned through one or multiple VMs is not optimal.

We definitely have to watch new versions and deploy them in a smart way, but that is the way with any type of software.

The scalability depends on the situation. Some situations are not very scalable. High scalability, in AWS, without matting is just not there. It's more of an AWS problem than it is a Check Point problem.

We are receiving our technical support through a partner. Therefore, we do not really engage directly with Check Point that much. We use the partner for technical support matters, who is great.

We did not use anything previously. Going to the cloud was a new requirement for us.

The initial setup was just as straightforward as setting up a physical Check Point box would have been.

We implemented in-house by deploying it ourselves.

We don't really track the ROI on this.

We also considered Fortinet. Check Point has better overall integration with Azure.

I was part of the decision-making process.

I would rate it a six out of ten. 

Other vendors typically are working with hardware acceleration and various other products, which you can't get in the cloud. One of the key things that made us more comfortable with Check Point is this is only thing that they do. It's the same exact thing as they are doing on-premise for the most part.

We use this solution to secure networks. We block unwanted malware. 

We have a development team who asked us to open reports. We asked that they initiate traffic to see what is blocking them. We then give them reports and after that, they ask to open the report for the traffic application and we work accordingly.

The most valuable feature is the monitoring. We can easily monitor what kind of stuff comes over to our network and we can then check the dashboard and work accordingly.

I would like for them to develop guides. If you compare it with Cisco, you can just type out any problem you're having regarding Cisco and you will easily get a solution. With Check Point, it's not easy to get a solution.

We maxed out scalability. 

The initial setup was a bit complex. Is take two or three months to implement and we have to continuously work on it. We needed two to three engineers for deployment. 

We researched the top firewall solutions and settled on Check Point and Palo Alto. Comparatively, both are good. 

Ultimately Palo Alto is a very advanced firewall. This firewall can easily identify what application is running behind the network.

I would rate this solution an eight out of ten. 

We consolidated from three management consoles and three clusters to only one, which is a big improvement. 

In general, Check Point VSX is a good solution. Its blades and VSLS (Virtual System Load Sharing) work fine.

Having a web UI in the VSX (or something similar) would be nice. However, you can do everything in the CLI.

We are replacing three old cluster ASA firewalls and concentrating it into an all-in-one VSX cluster. This allows our central management have more time for other tasks.

Monitoring using SmartConsole and all its features is extremely easy, and I find SmartEvent an excellent monitoring tool for spotting threats and user behaviour.

The multiple virtual firewalls on one box are extremely useful and the interconnection with virtual switches is simple and easy to understand.

We need a product that is logical and for which we can find people skilled who are interested in learning it. Check Point is always a winner, as its an industry standard.

We have Microsoft CASB cloud app security and it's one of the least compatible firewalls. They really need to look at this, as both Check Point and Microsoft are major players. Why aren't they compatible? If we had Palo Alto then we wouldn't have this problem.

Three to five years.

No stability issues, not even once. The firewall is set up and and the various parts are interconnected. It works just fine. R80.1 is also a major improvement.

No scalability issues but I don't think we are utilizing the device to its maximum capability.

Good. We go with a distributor but they work okay. It is a lot more reliable with the latest OS than it used to be.

No previous solution. It's always been Check Point, though before the virtual firewall we used to have a Juniper fw. Now we are just Check Point because for the threats we face now, I don't think we need different firewalls at different layers.

The issue normally is getting SIC working between the gws and the management server. Actually it's reasonably straightforward, though you have to get it right. It used to be you had to have a certain type of disk drive but this is a better solution.

Look into this carefully and be sure you use all you buy. We haven't bought SandBlast or the bot solution but they look effective.

We did not evaluate other solutions. It was decided we would stay with Check Point.

Make sure you can make use of the virtual firewalls and read up on the device or take a course before you implement. Or, if you get it installed, make sure you have the right devices in the right virtual firewalls.

Valuable features include centralized management using the MDM solution of Check Point and the Log Management module. The latest version of VSX supports all blades of Check Point's security suite.

I get maximum flexibility as I can use a standard management server to manage all virtual gateways along with a dedicated log server for each virtual gateway. Sometimes I can use a single server to manage all virtual gateways.

Earlier versions only supported the Firewall and VPN feature. Now I can run Anti-Bot/Anti-Virus, URL and App Filtering, Threat Emulation, and other blades.

I can assign weights to each virtual gateway depending on how critical each virtual gateway is.

The VSLS feature provides linear scalability so I can keep adding hardware (maximum of eight) to meet my performance expectations.

It is somewhat difficult to upgrade the entire hardware without downtime.

We have been implementing this solution to many customers in India and the SAARC region for seven years now. This is one of the most popular virtual firewall products in the industry.

We have not encountered any problems with stability.

A sufficient amount of planning is required to deploy a solution that is scalable. However, as Check Point allows an Open Server to deploy its VSX solution, scalability is not a problem once the base hardware is chosen appropriately.

Support is one area where efforts should be required from Check Point. Customers having multiple, more than ten, gateways are encouraged to consider Diamond Support services.

We did not use any other solution previously.

Engineers having less than three years of hands-on experience on Check Point products may find this product somewhat challenging. However, the best part is, once the product is deployed, there is no difference between virtual gateway and physical gateway from the operational perspective.

Check Point pioneered this product, so don't look anywhere else if you are looking for a stable and scalable product with top-notch security blades.

We did not evaluate any alternative products.

Choose your implementation partner very carefully. Choose someone who has done multiple, large-scale implementations and can show proof of the same in terms of customer references through emails or phone calls.

The ability to host multiple virtual systems, categorize them based on their function and importance and the ease of use with which these can be deployed.

We do not need to keep provisioning hardware each time there is a requirement for a new firewall. Having a physical server capable of hosting many virtuals and also provide performance and redundancy is a big benefit and hence our preference for VSX.

Each new version does offer a new set of features plus also incorporates bug fixes identified during the life cycle of the previous product. Hence, this product keeps on maturing as newer versions are released.

More than 15 years.

Not from a product point of view. The critical aspect here is proper planning, performing several dry runs and identifying potential issues to the best possible extent. It's really about planning and testing prior to implementing.

No, because we keep on top of our installations. We maintain them by performing routine maintenance, and hot-fix applications. Stability wise the product is stable but we had issues when we had really old hardware that had a less than stable OS.

No issues encountered.

Excellent – the vendor always supports us and is very proactive. We have excellent relations with the vendor.

Definitely excellent. It’s a pleasure to talk with the tech support people and know they fully understand the issues – this gives us a sense of comfort.

No previous solution used.

It was simple. That is because the solution is architectured and designed from the ground up and the relevant teams were involved from the beginning.

We did an in-house implementation.

Cannot give exact figures but we have made a lot of saving by implementing this product in our organization.

We were clear on our options – no we did not choose any other options save for the most important ones.

Think of VSX as similar to VMware ESX solution. It will, in the long run, save a lot of money with the return it gives to the company. It is easy to maintain by a capable support team and can easily fit within the network where there is a requirement.