Why buy high end hardware firewalls?

Solution 1:

It's just a matter of scale. The thousands-of-dollars firewalls have features & capacity allowing them to scale & be managed globally. A myriad of features that anyone not using them would have quite a bit of research to do before they (we) could appreciate their individual merits.

Your typical home router doesn't really need to be able to handle an officeful of devices or multiple ISP connections, so it's cheaper. Both in the number/type of interfaces, and the hardware capacity (RAM, etc). The office firewall also may need some QoS, and you might want it to be able to make a VPN connection to a remote office. You'll want slightly better logging for that small office than you'd need for the home firewall, as well.

Keep scaling that up until you need to handle a few hundred or thousand users/devices per site, connect to dozens/hundreds of other firewalls the company has globally, and manage it all with a small team in one location.

(I forgot to mention IOS updates, support contracts, hardware warranties - and there are probably a few dozen other considerations that I don't even know about...but you get the idea)

Solution 2:

Typically, along with the hardware firewall you get a recurring yearly maintenance fee and the promise of a future date when "hardware support" won't be available anymore and you'll have to forklift the gear out and replace it (ala the Cisco PIX to ASA transition). You also get stuck with a relationship with a single vendor. Try and get software updates for your Cisco PIX 515E from some other Cisco Systems, for example.

You can probably tell that I'm fairly negative about purpose-built firewall hardware.

Free and open source (FOSS) operating systems power some well-known "hardware" firewall devices and aren't unproven technology by any stretch. You can buy software support agreements for FOSS from many different parties. You can purchase whatever hardware you want with whatever spares / service agreement you choose.

If you're really pushing a lot of bits around then, perhaps, a purpose-built hardware firewall device would be necessary. FOSS can cover you in a lot of situations, though, and give you tremendous flexibility, performance, and total cost of ownership.

Solution 3:

You've had some good answers already talking about technical stuff and support. All important things.

Let me introduce another thing to consider: Your time to create, configure and support a "roll your own" hardware firewall internally is an investment for your employer. Like all things, the business has to decide if that investment is worth it.

What you/your manager need to consider is where your time is best spent. The question of whether or not "rolling your own" is worthwhile might change completely if you're a specialist network security person and/or your employer has specialist firewall requirements that aren't easy to setup in an off shelf product compared to someone who has lots of duties to consider besides network security and whose needs can easily be met by plugging in a network appliance.

Not just in this specific case but in general, there's been a few times I've purchased a solution "off the shelf" or hired in some consultancy for something I'm quite capable of doing myself because my employer would rather my time was spent elsewhere. This can be quite a common case, especially if you're facing a deadline and saving time is more important than saving money.

And don't discount the ability to "blame someone else" - when you've traced a major outage to a bug in the firewall at 3am in the morning it's very nice to be able to speak to the vendor and say "I don't care if its software or hardware, its your problem either way".