Comments on: Cisco ASA DMZ configuration…

By: skepticals

skepticals — Fri, 30 Mar 2007 13:38:02 +0000

I agree, given the time, the open source solutions can work just as well. I’m not sure if we have the budget for a commercial product, but I would prefer one. I will look into both of the options and go from there. Thanks for the insight.

By: astronomer

astronomer — Fri, 30 Mar 2007 12:07:37 +0000

I hadn’t heard of them before but it looks like they do a lot of the things the barracuda does. Expect to put more time into this than we put into the barracuda but this may be a good solution for you. It does some of the things our mcafee system couldn’t. I had investigated spam assassin before we chose the barracuda. I believe if you are willing to put in the effort, these open software packages can work as well as any commercial package.
rt

By: skepticals

skepticals — Thu, 29 Mar 2007 22:16:42 +0000

astronomer,

I’m glad that my question has helped you. I really appreciate your time. I also search the internet and read a great deal of reviews, tutorials, and books; however, I like to get first-hand opinions from people in the field.

I looked into the system and it seems a little pricey. I was put on to a system called aasp: http://assp.sourceforge.net/

Have you ever heard of it?

By: astronomer

astronomer — Thu, 29 Mar 2007 19:08:49 +0000

I would check out their smallest system. It will handle up to 500 users. They have a free evaluation period. Also, check out their competitors and look for magazine evaluations. No doubt things have changed since we bought ours two years ago.

Like I said, only you and your management can decide if it’s worth the expense. We have ~500 users currently and will ramp that to ~1500 when the students get email so your experience will be different from ours. Regardless, you will need to do something to filter spam or your users will be overwhelmed as soon as their new email addresses get out.

Thanks for nudging me into checking out the specs. We have a model 300 and it looks like we are going to have to upgrade when we add the student accounts. This adds another expense to the project no-one had thought about.
rt

By: skepticals

skepticals — Wed, 28 Mar 2007 16:35:46 +0000

Our company will not have a great deal of traffic. We would probably only have around 50 email users. I just know how much they complain about spam with our current email system (not in my control). We are bringing the email in house and I am looking for various solutions. Would you suggest this device for my situation or is there a better approach?

By: astronomer

astronomer — Wed, 28 Mar 2007 12:23:49 +0000

Overall, we have been very pleased with the barracuda. Before we purchased it we used a mcafee appliance and I was constantly having problems and being told it couldn’t do what I needed. I checked with the other state colleges and asked about their experiences with barracuda. The response from all of the colleges using it was positive.
The quality of barracuda support has declined somewhat from when we first purchased it but it’s still much better than our previous experience. It has proved capable of everything I asked for that the mcafee box couldn’t do. The price is significantly lower. No device in this category will be perfect but this one has done all we expected and a little more.
With that said, you need to consider if you are willing to spend the kind of money and time required to manage a device like this. Does your company have the kind of email volume to justify this investment? Only you can make that decision.
rt

By: skepticals

skepticals — Tue, 27 Mar 2007 19:45:26 +0000

Are you happy with the barracuda? Would you suggest I look into getting one? Currently, I do not have a spam filter or a anti virus program. Do you have any suggestions?

Thanks again.

By: astronomer

astronomer — Tue, 27 Mar 2007 18:25:14 +0000

A relay is an SMTP server with basically no users. Before we decided to use the barracuda antispam appliance as our DMZ email presence, I was looking at setting up a linux system running postfix in the DMZ to relay emails to/from the outside.
The barracuda is rejecting four of every five incoming emails as spam. You can do a variety of things to enhance security with this arrangement. For example, we don’t accept emails claiming to be from our domain unless they come from our exchange server. Also, the barracuda won’t accept internal emails from any other source, regardless of the source domain. Our network, which uses public addresses, only allows SMTP to go out through the exchange server then through the barracuda. Before I set this up, we had a fair number of spam servers appearing in student labs. This is why I am so adamant about email. If this was still going on, we could easily end up on a spammer blacklist.
rt

By: skepticals

skepticals — Tue, 27 Mar 2007 17:39:35 +0000

astronomer,

I think I jumped the gun with the DMZ question. After more reading, I believe I have a clear picture on how to configure the network.

I was looking into putting the Exchange server on the internal network with a relay. Do you have any documentation on how to set this up? Is the relay another computer?

Thanks for your help.