AlgoSec Reviews

We use this solution for managing an environment with more than five thousand registered devices across firewalls, routers, balancers, and VMware. Highly critical banking environment.

We use FireFlow as our primary ticket management tool.

With AlgoSec, it was able to conduct the environment so that it was possible to get more accurate and fast information about the changes that the environment went through.

It has reduced the time for firewall rule requests to be implemented in the environment.

The most valuable feature is traffic simulation because, with this function, it has become more practical to know if something is released or blocked in my environment.

IPT is valuable because this function is of great help to have a more effective security policy.

I believe Active Change needs to be improved because not all products are supported, and some functions cannot be implemented by Active Change either.

Technical support needs to find solutions more quickly.

Active Change could implement routes in Firewalls, it should also be able to perform the creation of APP control and URL filter rules.

We have been using this solution for six years.

In general, it is a stable product. We have rarely had a problem that resulted in the total unavailability of the solution.

AlgoSec requires a large amount of processing power to perform its tasks, making it a piece of equipment that always requires monitoring to be optimally optimized.

Some troubleshooting took months to resolve. So, I think we have to improve this point.

I used Nipper and FireMon, but I started using AlgoSec due to the great recommendations I received.

The architecture was defined with one master, four slaves, and one remote.

Our internal team handled the deployment.

I do not have many details of this commercial part.

I evaluated FireMon and Nipper in addition to this solution.

Many users have the tool but don't use it with everything it can offer. What I recommend is that you explore all of the features of the product.

We use AlgoSec FireFlow and AFA modules for risk analysis, audit, and change management to enforce appropriate security compliance.

It has streamlined our processes for access and firewall management. It is used by all the IT user community internally and by our service provider who is in charge of our IT run activities.

AFA and FireFlow modules are the one that we use. 

• AFA provides project teams with a simplified way to obtain the status on their current rule set. 
• Fireflow is used for our change management process and is linked to our CP FW. 

Integration to cloud ITSM tools, such ServiceNow.

Be able to automatically analyze application traffic with machine learning capabilities and propose simplification for rule set optimization.

We planned to start with AlgoSec Firewall Analyzer and later procured FireFlow as well.

We deployed Fireflow as we have been migrating the Infrastructure to SaaS, increasing in multi-vendor engagements on multiple Network and Security layers and handling requests from roaming users ends.

AlgoBot has been enabled to few users to validate their requirements and requests on their own, which has helped them to understand their current access and to create requests that are very accurate and relevant.

With respect to the environment, it's distributed with various network and security solutions, with multiple zones and a maintenance team.

Over the period of two years, we integrated the AlgoSec Firewall Analyzer and FireFlow on multiple solutions including next-generation firewalls, web security, proxies, and other network devices.

On the improvement part, we enabled the common set of policies across firewalls and proxies. This tool helped us eliminate the requirement to have L3 engineer in our other data centers and our Tier 1 and 2 engineers utilize the solution well from the configuration and maintenance areas.

We simply pass over three to four external agency audits on various particulars which we spent more time on before onboarding the solution.

One of the most valuable parts for us is to achieve the compliance standards without ample strain and burden. Defined templates assisted us to make effective on following the internal processes and the industry standard.

It enhanced the complete workflow system within six months of deployment. We eventually onboarded by integrating with multiple solutions.

We performed regular audits internally to standardize and to pass the external audits effortlessly.

In simple words, this process empowered us to define a metrics among our industry and set the development goals clearly.

Support tickets and engineer assignments are one of the few concerns we are facing these days. Initially, they were hard to co-ordinate with the technical support team and the AlgoSec management team helped us to follow the defined Service Level Agreements.

We needed to directly communicate with the integrated solution TAC Teams, let say of Palo Alto or Checkpoint, and we needed to co-ordinate jointly for addressing an issue.

The AlgoSec support team came on a joint call to address the issue on time without saying "this is not my cup of tea" and by then we were happy about the support. This happened during one of our major migrations.

Our management is expecting us to set up a CXO/CISO dashboard from AlgoSec. It would be great for us if the AlgoSec team could assist in setting up the new benchmark.

We have been using this solution for more than two years.

Over the period of two years, we have seen multiple enhancements being made available inside the product. One of the new requirements is on containers/Docker/Kubernetes where AlgoSec really needs to focus. I am not sure about the availability of the latest support release, however, these are booming technologies and we require solutions like AlgoSec to support them.

Earlier it was good. Possibly due to the pandemic, we faced a couple of challenges in getting the support on time. That said, now it's getting better.

Neutral

Earlier we used to manage everything with our internal and vendor team, where lots of coordination was required. It was a long time-consuming process of gathering requirements and defining the best possible solution.

Since few of the solutions were being managed by outsourced team, it was challenging to make the solutions ready to integrate with AlgoSec during the deployment phase.

Some delays happened due to the lack of support by the external party. There were some delays due to upgrading products to make everything compatible with AlgoSec Analyzer and FireFlow.

Initially, we found this as a complex deployment. Later, it was easier than anticipated. We referred to the technical documents and AlgoPedia portal to understand more and deployed successfully within the proposed timelines.

Our in-house team took care of almost everything and the AlgoSec team did the governance.

We'd like the solution to share the complete Infrastructure details along with the business use cases with AlgoSec SE to evaluate and propose the best fit deployments and licensing.

Pricing-wise, AlgoSec still needs to support the customers.

We evaluated Skybox and Tuffin as well. Our internal team showed interest in AlgoSec right away, however, Skybox was a real challenge to differentiate.

Technical documentation and readily available solution blogs helped us to deploy the solution in a better way

AlgoPedia helped us in many ways - including sharing information on the new vulnerabilities, management of appliances, and maintaining the workflows (by providing enough insights to explore and understand).

We are currently using this solution to audit our firewall policies (both in performance and compliance), as well as automating the creation of new rules and improving application functionality delivery. We are also using AlgoSec to automate machine provisioning (creation of new rules associated with that machine) and machine decommissioning (removal of rules associated with that machine).

With AlgoSec, we are now able to automate several time-consuming tasks. We are currently in a rule base performance improvement process and AlgoSec is an invaluable tool to accomplish this. Furthermore, we are starting rule creation automation, which will also provide some relief on our workload.

The most valuable feature for us is AlgoSec's ability to analyze rules for risks and for performance while allowing the user to submit a change request immediately based on that assessment. Additionally, the fact that it integrates seamlessly with Ansible, as well as providing an API for the users to extend based on their own needs, is a great plus for us.

The product is severely lacking in vendor support. They claim to support some devices, but when you dig deeper, it is only basic support, with enterprise-grade features for those devices being unsupported. This is a big deal for us, as several sections of our network are not fully supported which, in turn, does not allow us to fully automate rule creation. Moreover, we cannot perform end to end connectivity checks. One such feature is the lack of VRRP support on devices other than Cisco or Juniper, which causes the software to interpret a non-existent router as the next hop for a particular flow (the VIP address of the VRRP).

While this solution is somewhat stable, there is definitively room for improvement here. We've had some issues with the solution during our usage but, so far, no show stoppers. Other customers of this solution have complained that a large number of devices can severely hinder the stability of the solution.

This is a very scalable solution, built mostly on open source technology. The customer is allowed to extend its functionalities via the API to integrate with other solutions or existing automation.

Technical support is sometimes difficult to deal with as the response times are somewhat lacking. One good thing is that the case owner you are assigned to is generally the same,  which is great because, after several cases, the case owner is already familiar with your network.

The initial setup is not cumbersome at all. The documentation and training videos are definitively a big plus.

The implementation was mainly performed by us, with the help of a vendor team. The level of expertise of the third party was passable, but we were looking forward to having someone with more expertise with the product.

So far, the ROI is currently only due to the fact that rule automation has decreased the load on our support team, allowing them to work on other projects. We are also able to provide reports to auditors without losing a single day from the network support department. We simply provide AlgoSec reports and analysis.

• To manage the various network security equipment deployed
• Be able to detect unauthorized changes in those equipment.

It is still being deployed, but it shall enable reliance on more third parties out of the IT security team without losing the assurance that the configurations are under control. 

• Ability to manage all the network security equipment centrally
• Ability to delegate to local ITs the network security equipment change requests
• Ability to decrease the necessary workload to enable network connections, troubleshoot
• Ability to detect unauthorized or non-compliant changes in the network security equipment configuration.

Ability to manage more diversity of equipment, as well as simplify the management of the various workflows.

No previous solution.

Yes: Tufin.

• Traffic simulation queries allow an engineer to simply find all firewalls involved in the path between a source and a destination on a given service. AlgoSec allows an engineer to issue their own traffic simulation query to be tested against a single device's policy, or against a group of devices. When running a traffic simulation query on a group, AFA finds the devices in the path of the traffic and queries all these devices. Querying the policy or a group of policies produces an AFA report that shows whether traffic of the given service is allowed between the source and destination. If traffic is blocked by the device, you can then find out which rules block it.
• The change history feature provides detailed information about changes to the device, over the entire history of AFA reports for the device. The information is divided into policy changes and risk profile changes.
• The optimize policy feature allows an engineer to find out which rules are redundant, unused or already covered by other, more general rules. We can find:
  
  • Unused rules
  • Covered rules
  • Redundant special case rules
  • Consolidate rules
  • Disabled rules
  • Time-inactive rules
  • Rules without logging
  • Rules with empty comments
  • Duplicate objects
  • Unused objects within rules
  • VPN cleanup
  • VPN analysis report
  • Unused rules
  • Unused objects within rules

We can optimize and produce reports for 744 firewalls from different vendors (Check Point, Juniper, FortiGate, and Cisco) with one application.

We have requested improvement to VRF functionality on Cisco IOS and Nexus L3 devices and to support Juniper routers.

We have discovered that AlgoSec doesn’t work with loopback interfaces. We use OSPF and BGP, which run over multiple Virtual Routing and Forwarding (VRF-Lite) instances and, in some cases, distributors are connected to the core via loopbacks routed by an OSPF instance and a BGP address family. AlgoSec doesn’t recognize those loopbacks as a route, so it doesn’t find a route to the destination. This behaviour makes the “traffic simulation query” feature unusable in our environment.

3 years

I have not encountered any stability issues.

I have not encountered any scalability issues at all.

7

The level of technical support is good.

I did not previously use a different solution; we have been using this solution since 2012.

I don’t know if they evaluated other options before choosing this product.

This product only supports L3 devices such as Cisco IOS and Cisco Nexus, so if your primary network is based on a different technology, AFA wouldn’t be the best choice.

The solution is mainly used for auditing firewall rules and inter-zone connectivity within the client environment. 

Another use case we have at the moment is to audit all changes done on the firewalls across the environment. We are also using Fireflow which significantly reduces the administration effort and time required to analyze, plan, and implement firewall changes on a day to day basis. 

Compliance reports are a big help and ensure that the client environment is up to date in terms of their security standing.

AlgoSec has definitely helped to improve the process of auditing all firewall rules and access. 

From a security standpoint, it has significantly improved an organization's standing from identifying all risky items in a given firewall policy as well as change audits, among others. 

Using Fireflow has also significantly reduced the amount of effort and time required to analyze and plan firewall changes that normally happen on a near-daily basis. 

Change audit has also reduced the effort during audit season especially when clients are running multiple-vendor firewalls.

Risky rules and compliance profiles are very valuable. With these reports, we are able to identify gaps in the client's firewall policy and this allows us to effectively remediate such gaps. 

The time and effort saved by using these compliance reports or profiles are definitely welcome. Another feature that we would use on a near-daily basis is the Fireflow and simulation query functionality. With the simulation query, one would not need to log into a specific firewall vendor console to verify if access is allowed or not; we run it through the simulation which saves us a lot of effort.

Support could be improved. Support of the KB database is extensive but still does not cover all subjects, at least from my experience. 

Another area of concern that I think could be improved is the licensing system. With the version we are currently running, it is a bit confusing since, for some reason, AlgoSec license usage is handled differently between firewall vendors. It may be a bit challenging to properly size the purchase of a new license - especially if a client is running multiple vendor firewalls in the environment.

I've been personally been using AlgoSec for more than ten years now.

The solution is very reliable. No issues encountered during daily operations.

I haven't personally done a lot of scaling projects with this product.

The technical support is all right, however, it can be improved.

Neutral

We did not previously use a different solution. 

The setup is pretty straightforward and AlgoSec did provide support during the process.

We worked in-house, with AlgoSec, and with a vendor found that both are highly knowledgeable.

I'm not part of the business team and do not analyze this aspect.

I am not part of the team in charge of licensing. 

We also looked into FireMon and Tufin.