AlgoSec Reviews

AlgoSec is used on a daily basis by both our IT and IS groups to manage BAU and FW change requests. It integrates with ServiceNow, PaloAlto, and our SIEM tool. It helps to perform FW cleanup, regulations requirement, FW migration projects, etc.

AlgoSec has helped me in the last three companies that I have worked for. I was working to do Firewall migration projects, FW cleanups of risky rules (FW policy optimization), process def between IT and IS, audit, SOC reports, GRC support, and Cloud support in both native and Hybrid environments that we use. 

The features that I have found most valuable are:

• Great visibility for High-risk firewall rules
• Mapping business risks
• Mapping risky applications
• Informative regulation reports for PCI-DSS, ISO 27001 and many more
• FW cleanup recommendation
• Easy logging capabilities with leading SIEM products in both LEEF and Syslog formats

I would like to see Bi-Directional API support in order to integrate with SOAR platforms that provide SOC automation and IRR.

Integration with CISO dashboards would be an improvement.

It would be nice to have support for IaaS, CASB, and DLP tools, which will allow full life cycle management of security incidents.

It would be nice to have an out of the box "best practices recommendation" with the relevant "what-ifs". 

This solution scaled to our entire enterprise in a seamless way.

We also used Tufin, but AlgoSec provided us better visibility and ease of use.

My advice is that you must do a POC and show value.

We did not evaluate options other than AlgoSec and Tufin.

Our primary use cases for this solution are:

1. Business Security and Automation
2. Faster change management solution
3. Network Security device analyzing and optimization

• AlgoSec helps to analyze the risk, optimize the rules and policies, and improve performance in network security devices such as firewalls.
• It helps to perform the network security changes four times faster than the normal change request process.
  
• It assists in provisioning the application rapidly, which increases the organization's revenue.
• The ASMS (AlgoSec Security Management Solution) is fully focused on business security and automation. It ensures business security and agility.

The features that we have found to be most valuable are:

• Risk Analyzing: Has helped to identify the risks in security network devices in a very short time, which increases and improves security overall.
• Policy optimization and IPT: Has helped to identify the garbage rules and improve the device performance. Also, has assisted in removing any rules causing IPT failure.
• Compliance: Helps prepare for the audit in a short time, and assists with continuous compliance.
• Active push: It is capable of pushing the changes and configuration from AlgoSec itself, which decreases manual errors during implementation and configuration. 

This product could be improved in several ways, including:

• More device support - such as barracuda devices
• An automated rollback process and options in active push. when we do a active push Algosec takes a policy backup for recovery purpose. if we did any change using active push from Algosec and if the customer wanted to rollback the particular configuration, better if Algosec able provide automated rollback process through AFF rather creating a manual a ticket. 
• Software-defined WAN integration and support 
• Application-aware policy identification and optimization - now a days most of NGFW are creating applications (such as Salesforce, Skype for business etc..) aware policies using their application database. normally destination object will be these applications and not the legacy objects that we created in firewall. if Algosec able to understand these application it will be good move for future market. 

We are very impressed with the stability of this solution. The product is very user-friendly and does not cause many technical problems while in operation. Sometimes we might have issues with newly supported device integration and features.

AlgoSec has multiple form factors such as a hardware appliance, VM appliance, and software. The customer can choose the most suitable solution for their environment. Further, AlgoSec has three main components and the customer can purchase them phase by phase, based on their requirements and budget. It can scale up to the total ASMS solution using the same resources.

As per my experience, AlgoSec provides very good customer service and technical support. They are very friendly and their response time and SLA are very impressive.

We did not use another solution before this one.

The initial setup is very straightforward and easy. Further, AlgoSec provides better documentation and self-support services where we can learn, reference, and be empowered.

We are a value-added distributor of AlgoSec and have implemented this solution for many customers in addition to ourselves. Our customers are happy with the implementation.

Our return on investment with this solution is between one and two years.

The setup for this solution is not very costly. The licensing is very easy to set up, with flexible licensing methods such as subscription and perpetual. The pricing itself is also flexible, with it being related to the number of devices and applications.

Before selecting this product, we evaluated Tufin.

This solution is very useful for any type of organization with multiple network security devices such as firewalls, routers, etc, and have the goal of achieving business security and automation.

AlgoSec has main three components that can be purchased in different phases if required. They are:

• AFA: AlgoSec Firewall Analyzer
• AFF: AlgoSec FireFlow
• ABF: AlgoSec BusinessFlow

• The flagship feature used is its correlation of filtering rules (ACL/firewall).
• The audit of changes made in our environment is also very useful in the investigation of failure.

In an environment where onion layer security is strongly implemented, the filter elements can be configured in various places, and the traffic simulator proves, in this case, to be life-saving, whether in diagnostic time or in efficiency.

The AlgoSec solution has allowed us to achieve a clean-up and optimization of our filtering rules across our entire environment. The rules analysis allowed us to delegate the tool for operational purposes for the evaluation of firewall opening and audit requirements.

• The filter rules correlator allows us not only to have a clear view of the blocking points but also the quality of the filtering performed on the various firewalls highlighted by their risk index.
• Another interesting feature of the product is its ability to highlight filtering rules that would mask other more specific rules and thus lead to an optimization of the system.
• AlgoSec also allows us to have a history of changes. This feature is especially useful in the event of an outage or an unwanted change.

Although I'm very satisfied with the product, one of the ways of improving the product could lie, perhaps, in the acceleration of the analysis process and especially in the section — traffic simulation query.

Another improvement would be the support of an orchestration of different firewalls in a heterogeneous environment, mainly at the level of the management of the objects so as to have a homogeneous nomenclature.

I have a North American wide multi-site network with a large amount, 100+ primary firewalls and hundreds of remote firewalls. We have loaded into AlgoSec most of these via CheckPoint CMA and Palo Alto Panorama. Currently, the primary use is log analysis as we are migrating from CP to PA and need to purge the unused rules during migration. 

It is helping with the migration as we don’t carry over empty rules and allows consolidation of rules. 

AFA analyze reports are the biggest use case to review the rules before migration and removing the unused rules for cleanup.

The Network Map is a feature that could use work, it is a big piece but is always a moving target with large routing tables in use and speed of use becomes an issue doing queries. 

In 2018.1 release the VIP always up is a great feature and a 3-way cluster is a good idea. 

We were a Tufin user but moved due to a POC with another asset we acquired which had AlgoSec and at the end we preferred AlgoSec. 

Implemented in a Managed Security Service Provider and had every managed customer firewalls integrated as part of the service. The tops were used to generate baseline reports and compliance views suiting all kinds of businesses.

The solution greatly improved the value delivered to the customer, generating reports and providing suggestions for improvements.

AlgoSec Firewall Analyser (AFA): Providing reports and security improvements actually added value to the services provided to our customers. This was a key feature provided as a service allowing us to be proactive anticipating possible flaws and vulnerabilities.

• Support more and more vendors, like minor ones: WatchGuard and others. 
• Also, it would be interesting if it could analyse iptables and IPFW rules and support migration.
• Windows Firewall and Forefront would also be nice since we often need to migrate from those platforms and prove the value of the newly installed solutions.

Very stable, I've had minimal problems using it, and the solution feels really mature.

Not that great, they are improving though.

Great support. Always available.

No.

Completely straightforward except with the configuration of Check Point devices which requires additional steps.

In-house.

Great return since the firewall analysis was sold as a service to our customer.

Setup is really straightforward, and their professional services are available for your every need. About costs, I don't see much difference from its competitors.

Yes. Tufin and FireMon.

It's not a solution to install and forget. To bring out the best of its value you must always keep generating reports and applying corrections. It's a great tool to have especially if you have too many juniors operators.

To down level firewall care so context owners and operations can be more agile in their day-to-day operations. It improves audibility and security by having instant access to firewall configurations. It has the ability to create architectures improving performance, reducing costs and KPIs. 

AlgoSec makes it quite easy to down level firewall auditing, running, and maintenance. This has given the operations team, audit, and security instant  access to firewall configurations.  

The whole platform is extremely useful. I like the auto-mapping features and configuration overview. We use this for many things, but primarily for quick reactions to security events, audit, project management, and quick operational efficiencies. 

A modernized GUI would be a nice feature upgrade. The GUI looks a little outdated. 

There are a lot of updates for the product which have been good. However, it is a pain to always have to upgrade the product. 

No stability issues.

No scalability issues.

Our experience with the support is fair. 

No.

It is pretty easy to set up and run.

We implemented it in-house. 

It has improved our performance in operations, projects, and security. 

It will reduce your operations costs with improved team performance. 

We evaluated FireMon.

Overall, the product is very good for firewall insights. 

To be able to monitor all firewalls under one umbrella. It makes it easy for customer to get their reports.

• Reports run easily to my management.
• Searching on IP address to find out the firewalls.
• Streamline tickets

Reports and baseline are the most important feature for auditors. Auditors can get PDF or CSV reports without having to give them access to firewalls.

Having the ability to patch an issue as oppose to upgrading the entire suite.

Once you upgrade to latest version, it is stable.

No issues.

Needs better technical support and quicker response times.

Setup is easy. Just run the script and all seems fine.

In-house with some help from Professional Services, who are knowledgeable and helpful.

Pricing is okay and the licensing can be a little tricky with the initial setup.

We evaluated other options. FireMon and Tufin were on the list but AlgoSec won out. It is better.

AlgoSec may be little pricier with its licenses, but it is probably better than any of other competitors.

If a use case comes where a customer who has different firewalls, e.g., Palo Alto and Fortinet, wants a single pane of glass, where all the firewalls are visible, this is the only use case where AlgoSec would be used.

The customer has to judge, "Are they going to pay hundreds of thousands of dollars for the feature of seeing firewalls of different vendors under the same hood?" Is that the value they want versus the dollar value they are spending? Most of the time, the answer is no. Customers don't want to spend $300,000 or $400,000 just to see a single dashboard. Especially during COVID times, it has become even more impossible to sell such a product. 

From a product perspective, AlgoSec has multiple components. Its security management solution is the primary one that you need to have. You must have this in order to install the platform. 

There are some legacy customers still using AlgoSec. The benefit is the ease in management of firewalls and rules. Also, if they have a small setup, making changes to multiple firewalls at the same time is something the customer enjoys due to limited resources. When an organization becomes an enterprise, then change management comes into the picture as well as best practices, so making changes to multiple devices at the same time is not good. 

It has the capability to be an enterprise grade product, but the use cases have not been fine-tuned for that in the past four years.

There are some integration-related issues too. For example, AlgoSec does not integrate with Forcepoint, and Forcepoint Firewalls have become very prevalent these days. They also don't integrate with Aruba devices. So, the integration ecosystem of AlgoSec is very limited, which is also the case with Firemon.

These days, people are looking at products which can visualize not only their firewalls, but also their networking equipment, under a single map. Can AlgoSec do this? Yes, it can, but with very limited capacity. If I try to sell the automation story of firewall management, there are vendors, like Forcepoint, who are not supported, so if a customer has Forcepoint, then I have to straight away walk off. The worst part of the story is they don't have even a roadmap for this.

Another problem with AlgoSec is that it gives you the capability to make changes to hundreds of your firewalls at the same time, but big enterprises have change management policies. Change managers will never allow you to make changes to more than 10 devices at the same time, which is a feature in AlgoSec. Because, what if something goes wrong, then you have to roll back and figure out what caused the impact, e.g., which firewall did not work well. Doing that post-mortem becomes a difficult thing. So, change automation on a firewall is actually defeating the purpose of the change management policies in any organization. If you run a bank, you will not allow anyone to make changes at the same time from a single click for 10 firewalls. The bank will never allow this. So, what is the use of this automation? Even if you are using this automation, you can do it from your native firewall vendor, e.g., Panorama or FortiManager, where everyone has their own cluster managers. At least if something goes wrong, you can still call Palo Alto and tell them you are Panorama has not done the change right, causing you an impact, and this is your Palo Alto firewall. 

In this case, if I have to raise a case first, then I have to call AlgoSec and check why it has not worked. Second, I have to call the firewall vendors that their firewall is not working well, but AlgoSec has done the right job. Handling multiple vendors for such a trivial issue becomes a problem.

I have been using AlgoSec for four years. First I was a customer, then I became a partner.

If you hit a bug with mass changes, do you troubleshoot on AlgoSec or the firewall? Now, you have two products that you have to tackle for bugs. The two vendors then finger point and you waste time. That is why having the firewall and firewall manager together from a vendor, like Palo Alto, is better.

If the scope of work is just firewall management, it is easy to deploy. However, when you add the flow information, since AlgoSec can also import the flows of your firewall rules, that is live traffic. Then you include FireFlow, or it becomes a nightmare, because what you have to do is take a copy of traffic from different segments/firewalls and bring it into AlgoSec. Doing that becomes a challenge because a lot of companies, such as banks, will not allow you to sniff the firewall traffic live traffic because they have credit card information. 

These days, the traffic has changed to HTTPS, which is all encrypted. Four or five years back, it was HTTP, which was all plain text. Even if you take a mirror of the traffic, how can you decrypt it? You need a decryptor to look inside. FireFlow looks at the packet of the transaction. In order to look at the packet/payload, I have to decrypt it because now it is encrypted. But, who will decrypt it? Then you have to buy another product that does decryption.

Customers look at return on investment to determine the benefit from a product, e.g., the tangible value in return. If I go to sell AlgoSec or Firemon today, the customer will say, "I already have Palo Alto," because Palo Alto Panorama has picked up a lot in the last five years of this market. 

AlgoSec is not a cheap product. If I compare Firemon and AlgoSec, because I am also Firemon certified, Firemon is still cheaper in price than AlgoSec. That is another catch. 

AlgoSec-type products and requirements are not necessary or prevalent these days. If you look at AlgoSec, what do they have? They do firewall management, predominantly. Firewall management as a technology is dying. If you look at Palo Alto, Fortinet, Forcepoint, Cisco, or Juniper, all these firewall vendors are coming up with firewall management platforms. If you talk about Palo Alto, they have Panorama. If you talk about Juniper, they have Junos Space. If you talk about Fortinet, they have FortiManager. You can manage their firewalls using the respective vendor management consoles. The question comes, "Why would someone want to use AlgoSec to do firewall management?" The usability takes a dip in terms of capability because people trust the native vendor, e.g., someone who manages Palo Alto firewalls will do it with Panorama because Panorama is a product of Palo Alto.

AlgoSec's use case was good four years ago before FortiManager and Panorama. If you have a hundred firewalls from Fortinet, then you can manage all of them for a single FortiManager. If you have 50 Palo Alto Firewalls, you can manage those from Panorama in a single pane of glass. These solutions did not exist four years ago, and now AlgoSec is losing its essence in the market since these native vendors have been launched.

Four years ago when I started off with AlgoSec, and I'm still working with them, it was strategic. Now, it has become tactical. AlgoSec has a very good feature of doing firewall rule optimization, which has not been there in the native products. For the last couple of years, the native products also started coming up with firewall rule optimization. For example, Palo Alto (from PAN-OS 9.0 and above) was released a year and a half back. It does firewall rule analysis for you. It is the same case with Fortinet and Forcepoint. Therefore, if I have to sell products on firewall management, which does firewall rules on analysis, what is the use case that I give to customers with AlgoSec?

I am running out of AlgoSec use cases because the native vendors give you the capability to do firewall management, firewall rule analysis, and pushing conflicts to multiple firewalls from a single screen. These are the use cases of AlgoSec. This is what AlgoSec does. This story is not just limited to AlgoSec. Products like FireMon and AlgoSec and the way they used to do firewall management have become a commodity. Now, most of the firewalling vendors have the same functionality in their management console. 

Companies, like RedSeal, or even to an extent, Skybox, are better built because they take the story to the next level. They don't just look at firewalls. They also look at the network, vulnerabilities, risk, governance, compliance, architecture issues, and incident response. This is the story which customers love to see because none of the native vendors are providing this. 

RedSeal and Skybox are doing firewall management for free. They don't charge you for it. On top of it, they do:

• Complete network visualization.
• Give you best practice conflict checks.
• Security architecture issues.
• Risk analysis of every IP asset in your organization.
• Vulnerability prioritization.

AlgoSec has been amazing, but it did not evolve well with time. If you look at AlgoSec from a cloud perspective, it does not support service chaining. So, if I have Palo Alto Firewall in the cloud, which has become very common, they can't detect that firewall. If I ask them to detect Oracle Cloud, they can't detect that. The problem about cloud, even if I'm doing service chaining with VMware NSX and Palo Alto, which is a very famous integration, they can't detect them. They cannot detect these because they are new things which have happened in the market in the last three years. So, they aren't able to catch up. The legacy part is good, but they are not able to catch up on the latest stuff, like service chaining. With anything new, AlgoSec is unfortunately running behind. 

I have used all the components: CloudFlow, Firewall Analyzer, FireFlow, and Algo Bot (which I have used to optimize policies). I have not used AppViz a lot because it just came out. If you talk about the complete suite, then AppViz gives you application-related visibility. However, when you don't have a rich integration ecosystem versus a native firewalling vendor, like Palo Alto, who does give this. What is the use of having AlgoSec (or Firemon)?

I would rate this solution as a seven out of 10. The product is good, but the issue is with AlgoSec's use cases.