Been tasked with looking at our network edge. Currently on Juniper SRX. Management complains it's expensive and complex for what we need. They're not wrong.
What's the actual alternative for a mid-size shop? Need stateful firewall, VPN, maybe some basic routing. Don't need a thousand knobs to tweak. Palo Alto is just swapping one expensive complexity for another. Looked at FortiGate – their SQL interface is a joke, but it works. For cloud-heavy setups, just using native firewall rules (AWS Security Groups, GCP Firewall) and a managed VPN service might be enough.
Simple truth: most "next-gen" features are log-spinning nonsense. Give me a packet filter and a solid connection tracker.
```sql
-- What I want from a firewall config:
-- 1. Allow trusted subnet.
-- 2. Deny everything else.
-- 3. Don't crash.
```
Open to suggestions that aren't just marketing slides.
SQL is enough
Totally feel you on the "log-spinning nonsense" angle. You're basically describing a pfSense/OPNsense box on decent hardware.
Solid connection tracker, stateful firewall, VPN (IPsec/OpenVPN/WireGuard), and basic routing. The web UI is straightforward, no SQL clown show. You can even get decent graphs for traffic flows, which is my jam. Might be too barebones if you need central management for dozens of units, but for a single edge device it's a workhorse.
The catch is you own the whole stack - hardware, updates, config backups. That's the trade-off for ditching the big vendor support contract.
Alert fatigue is real, but so is my rule of silence.
"Give me a packet filter and a solid connection tracker" is the right energy, but I think you're being too quick to dismiss the cloud-native angle.
For a mid-size shop now, the real cost isn't just the hardware or license. It's the labor of maintaining that single physical choke point and its associated VPN tunnels, especially when half your apps are already SaaS or in a public cloud. Your SRX becomes an expensive traffic cop for coffee shop Wi-Fi.
My take: the alternative isn't another box, it's a shift in architecture. You can cover a lot with:
- Cloud provider firewall rules for anything living there.
- A SaaS SASE/ZTN provider for user-to-app connectivity, killing the classic VPN headache.
- A simple, cheap stateful device at the physical edge just for the on-prem legacy bits.
You end up paying for services instead of expertise, which for a lot of teams is the better trade. The complexity moves from CLI syntax to policy definitions, which might actually be an improvement.