Once we moved the units up to the Gen 6 platform, they could support SSL-DPI. We are huge fans of the DPI. That piece is incredibly easy to implement. I'd say probably the most powerful thing about the solution is that coupled with the captured functionality.
We've turned the SSL inspection on, and it is a nightmare. It doesn't mean it doesn't work, but it will turn your world upside down for weeks until you tune it and get it right. That's an across the board problem. It's not just TZ. That's TZ's, NSA's, etc. Wherever you're using their implementation of SSL, where you've got to implement a certificate on every machine. Once you even get past that it's still going to be particular and finicky. Banking sites are driven crazy by it every time we turn it on.
It is trying to lock down outbound traffic so tightly that you get to sites that are already very security conscious. It's just a battle to get the traffic through. Intentional traffic, the traffic you want to get through, seems to be a problem. It will stop almost everything. Too much in fact. I understand the concept. It's just a little threatening. We just had a client sign off on a 6650. Then we send them a scope of work for implementing it. We specifically put a note in there in enormous bold type: "Note does not include SSL-DPI implementation". That is additional. The client responded that "That's the one piece I wanted you guys to do. I'm scared of it."
He said, "We're scared of it," and I told him, "We're scared of it too." I said, "I don't know how long it's going to take. And it's going to turn your universe upside down for a week to 10 days to maybe two weeks." He said that he heard that this would be the case.
My fear is that the client thinks that we'll say it will take four hours and then, when it turns into 40, try to make us give them the submission for free.
Even tiny environments, for example, 10 user environments, once you turn it on, you will spend days tuning it. The last one we did took us 22 hours to get it perfect. We learned our lesson. We slotted in four to eight hours to do it and it took us 16 to 20.
From a support perspective, if we're talking tech support I think Silver Partners, Gold Partners, Platinum, whatever level, should have a different number to call. End users can call tech support over at SonicWall if they've paid for support as part of their AGSS or whatever services they bought. The end-user can call, or we can call, however, I don't want to be calling the same line that an end user's calling. I don't want the same response time. I need a different level of expertise.
We've been a SonicWall dealer for 21 years approximately. We've been handling the solution since 1999. I personally didn't start using the solution until 2004.
Once you get past all the configuration issues, If you are on a rock-solid GA (Generally Available firmware), I don't know if I want to say it's bulletproof, however, the stability is really, really good. I don't sit and worry, thinking, "Oh, God. We know another one's going to fail today." We never think that way about that type of stuff. It's the odd time where we might get hardware failures or random reboots. We've had a couple of SMA units go sideways. Even SonicWall couldn't solve the problem. However, that said, it's rare.
There's a couple of different ways to answer the question of scalability. They've built the TZ line wide enough so that we've got enough of a selection to be able to fit most bandwidth and user count situations. It's never going to fit everybody and it's not meant to. It shouldn't. It is a little challenging to try to get one of the boxes to do full wire speed. I'm not so sure inside that box, at the price point, you're going to solve that problem.
That's why we sold the 6650. One client has got a one gig fiber line and they're in a school. On an NSA 3600, he can't get over 400 on it. I told him he never would. Some days I'd be surprised to get 400, depending on the user count. The TZ lineup is pretty good, however, I'm not so sure I'd use the word scalable.
If what we mean by scalable is, "oh, well, I buy a 300 and I buy it for 10 users, but I can scale up to 30 users with that box," the answer to that is no you can't. If you ask "could I scale up to 25 users and move to 200 or 300 or 400 meg?" You can't. We've got somebody in that situation right now and we're quoting a box replacement because it just can't scale that way.
You can't necessarily scale on the appliance. You've got to get the right size. That's the easiest way to scale. If it's the right-sized appliance for the environment with some headroom then I think most situations users are going to be fine. There's going to be some issues where somebody cheaps out. For example, we worked with a law firm. They bought a TZ 300 because they didn't want to spend the money for the 500. Now they're going to have to spend the money for the 500 anyway because they need to scale up.
I don't think they really separate support from line to line. Maybe if you get all the way up into supermassive issues they do. Between NSA and TZ, it's the same level of service that you get on the other end of the phone. To be quite honest, level one support is not sparkling. Level two is usually really good. Level three is usually a combination. You get to level three, and you're almost talking to development or a combination of a crew that's dealing with development and senior technical expertise. Those guys rarely fail us.
That's a typical support story. The level one guys will read the scripts and don't necessarily fix anything. We've already run through level one through three on our end with my staff. If they can't fix it, talking to a level one script reader is definitely not going to get it fixed. You should be able to bypass those guys if you're a reseller and a long-standing Silver Partner, like we are.
We've also used Cisco previously. A while back, we used to have Cisco as our primary choice, with SonicWall being our second. That changed when I came to the company in 2004, where SonicWall became our solution of choice. We've got 400 or 500 firewalls out there and we don't plan on changing over to anything else.
We're a Silver Partner.
I'm not an engineer. I was a field engineer for nine years a long, long time ago. However, I'm not typically the one that gets my fingers into stuff, and it would be my engineering and senior engineering staff that do that. That said, I can say that I don't think any of our guys have touched the virtual platform yet.
We use TZ and traditional NSA tech every day. That's our bread and butter.
The current version we're using right now is the 600 series, although we do still have some 350 series. 90% of what we use are Gen 6. They're either TZ 300, 400, 500, 600 or NSA 2600, 3600, 4600.
We've got a smattering of 2650s that we've rolled out, which have been really, really good. Those are powerful units.
I'd rate the solution eight out of ten. It doesn't warrant more than that. There's plenty of products I'd give a five to out there, however, for the quality of the product offering, I think an eight is a fair mark.
