Andrew,
I realize that every vendors, checkpoint,
Juniper and cisco have bugs in the code. I am
not a Security expert but I, like yourself,
work for a large service security service
provider and I can tell you that Pix/ASA has
the most bugs that I have run into. Because
of issues like this that I am having a job
that pays quite well so I am not complaining.
That being said, I would think a big player
such as cisco would roll out code that are
reasonable "stable". I would not think that
cisco would roll out version 7.2.2-2 code
that resulted in "show run + q" equal reboot.
That is very poor quality, IMHO.
I've worked with Checkpoint for the past six
years and when Checkpoint roll out NG with AI
R55. In the past 3+ years, they only 18
release patches, called HFAs for version NG
with AI R55. In contrast, within version
7.1.x alone with cisco you have almost like 26
different releases. That I found to be
completely unacceptable.
When I rolled out pix 7.0(6) a few months ago
and I ran into issues, Cisco TAC told me "well
this is ED code, if you want something
go with 6.3(5)". This is 2007 and I don't
want to use 2003 technologies, isn't it too
much to ask from cisco for a stable release?
I do not know anything about GTP/GPRS to make
an educate comment on this topic.
Checkpoint TAC really sucks and I like Cisco
TAC a lot because Cisco TAC is much responsive
to customer need but it seems like Cisco
doesn't know anything when it comes to
security products. When I was preparing for
the Security lab I was using Cisco IDS 4.1,
this product is a piece of junk. It took
almost 5 mins to apply a change and sometimes
it would not accept changes. How can you
call an ASA a secure firewall, when by
default, the "no nat-control" is enabled, and
that traffics from the high level can traverse
the low level by default?
Juniper and Checkpoint would not let you get
away with that. Their mantra is quite the
opposite. Everything is dropped unless
explicitly allowed.
David
CCIE Security
