How to Keep a Bouncer Healthy – Comparing Algosec/Firemon/Tufin vs indeni

Many of our users work in the information security operations departments of mid-size to very large enterprises. As such, they regularly work with Check Point firewalls (which indeni supports), When you work with a firewall, you need to make sure the rule base matches the organization’s security policies.

To help with that, there are companies such as Algosec, Firemon and Tufin, that have developed solutions for monitoring changes in the rule base and building a workflow around the on-going work done with it. While I hope these companies will excuse me for referring to them as a group (I’m sure each of them considers itself as the best in class, rightfully so), we see them as a group because they fulfill a certain need.

indeni fulfills a very different need. The best way to understand it is to imagine the firewall being a bouncer at a party. The Algosec/Firemon/Tufin solutions help make sure the bouncer knows who to let in and who not to. indeni makes sure the bouncer stays alive, healthy, and can do his/her job.

Therefore, every user of Algosec/Firemon/Tufin should look into indeni. We are complimentary solutions that together ensure your firewall will achieve the security goals you have set for it while at the same time ensuring the firewall doesn’t become a source of traffic loss and downtime.

Note that there is one major difference in the way indeni is set up: indeni must be able to reach every single firewall on the network directly. Connecting to the management servers (such as Check Point’s Provider-1/MDM) is not sufficient for indeni to be able to truly analyze the health of the firewalls.

Another difference is that indeni isn’t directed solely at security devices. indeni can cover the networking aspects of routers and switches (not just ACLs) as well as devices like F5’s load balancers. Adding this entire variety of devices to indeni’s analysis engine will allow you to identify cross-device issues. For example, a Check Point firewall cluster failover can go very wrong if the routers around it are dropping GARP replies. We identify that as part of our on-going analysis and are unique in that capability.

Bottom line: if you are an Algosec/Firemon/Tufin customer, you should seriously look into indeni as a means of providing you an overall solution for getting your job done. It takes just 45 minutes to see indeni in action on your network.