Tufin Orchestration Suite Reviews

What I like most is the end to end view which is quite important for supporting the design teams.

In the design team, everything is based on things that already exists and Tufin helps us make changes safely.

I'd like to say SDN needs to be improved. This is the key and where the revolution in technology is going. This is something you need to be aware of as the legacy devices are not compatible with the SDN devices.

As far as I know, it’s OK.

It's been able to scale for our needs. What we have is OK.

Great. I’m not in a direct relationship with them, so it’s indirect but it's OK I think.

We didn't look at any other solutions.

I think we’re not using it for all the devices we intend to use it for, but somewhere in the middle. It works, it's as simple as that because we noticed the difference after we got it working, and we immediately saw the advantages of having it.

The most valuable feature for us is the configuration control. This helps us to comply with company policy.

We can very quickly understand the admin configuration made by the administrator.

Also, year to year the policies always grow and every day we need to check and remove rules, policies, and objects that we already have. So another very helpful feature that we use is that we take from the policies unused objects that have not been used in a long time.

We need to include more products from different vendors, but we need a universal solution to make our installations different. For example, with the web application firewalls, we need to control them. With the ideas system, we need to control them too, and if we talk about ideas and we have the solution from different vendors who have their own names for the same security checks and customer, we as an integrator need to get a deeper understanding of the difference between the different configurations.

There's also another issue. I have a very big customer, but they have some offices where they placed a check point at the wrong end. They have multiple branches, and for different branches they have a management server, but each branch needs a solution like Tufin because if you talk about every branch, it's like another big company with their own branches. We don't have the option to place Tufin at certain branches because we don't have administration rights at the branch. We need another way to use Tufin without the administration rights.

We've had no issues with deploying it.

Two years ago we had some problems with stability, but now it's resolved. Since then, we've had no issues with instability.

It's scaleable for our needs. We've had no issues with scalability.

I think technical support has worked well for us.

We use it mainly for rule base analysis. We do a lot of customs and they always have complex custom rule bases, so we need to be able to go through the rule base and also to optimize the rules.

We don't use it on a day to day basis. Obviously we're running it all the time but we only need to look at it once a month when we do a review. It's not something that we use all of the time. When we do perform a review, it gets passed across to the lead engineers for that particular account to look at the rule bases and agree on what we're going to do with it and then they sort it out.

One of the things that I think they're all missing is something that Indeni does where they mount the boxes proactively for us.

We've been using it for around four, maybe five years.

We have had no performance issues.

We did have an issue with load on the original machine but that was actually our fault. We've put it onto new servers now and haven't had a problem.

They're very, very good.

There's obviously some complexity to it because you've got to open up rules for the rule bases in order to talk to firewalls, but it was easy.

We also looked at FireMon. One of our presidents chose Tufin. I don't know which project it was chosen for, but I knew once it was chosen, because we deal with the development and it was decided we would only have one standard solution.

If you follow the instructions you're good.

The module we have used the most is SecureTrack. Our technicians use that for firewall audits and analysis. We use other drivers due to PCI regulations, so we have to have proper reporting compliance, change management, and network changes. Also in our road map is to implement secure change.

Based on the work our technician has done on it, I think it serves the purpose we brought it in for. The only issue we have had is that we have been working a long time, from the build and configuration, and we still have one issue that our Palo Alto devices are still not reporting correctly to Tufin and that needs to be resolved. I believe it’s a software compatibility issue, so it might require an update on our side. That’s still an outstanding issue. We have a known issue integrating Palo Alto, but if they have a roadmap with other customers we would love to know.

We've used it for almost a year.

Performance is good and any queries we run are smooth and straightforward. But we haven’t loaded too much on yet. There’s a lot of build still to come. For the basic purpose of what we are using it for, it’s pretty good.

They are knowledgeable and available. I've had no issues with professional services.

Exactly because we had no firewall analyzer or a compliance and reporting tool, we brought it in. We have business requirements like PCI, and we are yet to use it for reporting or secure change.

We just put it in to the rack, consoled in, and did the basic set up.

We did it ourselves. Just looked at the PDF.

When I did the self-service for licensing, I encountered some issues. Perhaps it’s because I didn’t know how many we had purchased before I had arrived, as it was sold through a WebEx.

Pretty good, very supportive, understanding and recognizing we need to move in a phased manner. They are definitely in it for the long term. Support and professional services, we will require going in to the future.

Our primary use case for this solution is firewall remediation.

I didn't get very far with it because I didn't used Tufin in production, only during the evaluation phase.

I tested it for the change orchestration. That is what my evaluation recently was specifically for. While the product was a little slow, it did look full-featured. 

The firewall remediation and compliance pieces are the most valuable features. 

I couldn't get it to work in the lab, even with help, on multiple occasions, from one of Tufin's engineers. It was set up in my private lab per all their instructions, and I gave them control of the system. However, they were unable to make it install the policies to Check Point in an automated fashion. So, I unfortunately gave up on the proof of concept at that point.

In terms of stability, the version I tested in the lab was okay.

I don't know about the scalability, as I never got it out a very small VM.

Their technical support was okay. I needed more help getting the product to work in the lab. 

We did not have an automated provisioning solution. At that time, all firewall changes were being implemented manually by administrators.

The initial setup was straightforward. 

I was working directly with Tufin's sales team and SEs.

We looked at AlgoSec and Tufin. However, we did not chose Tufin because of the issues.

Check the product out for yourself.

I wasn't using it for visibility into my firewall infrastructure, because I have other avenues.

I wasn't using the compliance portion when I was testing it, only the orchestration.

I want to look at Tufin for remediation and compliance in the future.

The primary use case is firewall management, consolidation, and optimization.

Our company has a grid, and there are different blocks of public domains and internal domains. It checks all that on our security grid. That has been customized by our administrator.

Tufin allows our say junior guys to learn how to view policies. It gives them a tool that will help them consolidate and optimize.

We use SecureChange. SecureChange is most valuable to me because I have customers out there that know the process now. 

It provides good visibility because we have a lot of gateways globally, so it consolidates them nicely.

It could be a little more intuitive. I haven't used it a lot, but it gives me the info I need, I just have to find it.

The stability is fine.

I have not had to use the technical support. Maybe I should.

I was not involved in the initial setup.

This solution helps us reduce the time it takes us to make changes. We're probably saving time by 25%.

It is a really good product. It does exactly what you want it to do.

Get the training. I didn't get the training. I assume they provide training.

I like how it's able to optimize your policy, look at the objects, and other similar functions. We only have Check Point integrated with Tufin SecureTrack, so that's a key benefit of using it. We can check policies against past policies. It does a kind of compliance check or risk analysis if there are unused policies or unused objects. It highlights them and it gives you a good view of what doesn't need to be there.

It would be better if Tufin could integrate with the Cisco routers, FireEye, and other devices like that, so you can do the routing changes and so on straight from SecureChange. That would be good.

I haven't looked at their latest versions or releases, what's new, and what's not. We're still running a version that's at least a year old, so I still have to look at it. If they have added integration with Cisco routers already, that's good, but we don't have that in the version that we have. It doesn't support Cisco routers at all.

It's been stable in our multi-domain environment. We have more than 20 or 30 policies.

When we were looking at products that can do this, I think we only looked at Tufin. Its integration with Check Point is what led us to Tufin. That was the main reason why we looked at it.

I hope that Tufin just keeps doing what they’ve been doing. We look forward for future enhancements.

At the moment, it's that it takes the changes made during the day and runs a report during the night so that we can go back and if there was an issue, see if it had something to do with changes that we made in the firewall.

Day to day, if you have a problem you can go back and see if it could be something that is related to a change that you made, because the time of the change is the same as the time the problem appeared. Then we can roll back.

It's not only the firewall rulebase we are interested in, but also application control and URL filtering and they don't do this at the moment. Once they can handle this, then they will get a better rating.

We've been using it for three or four years.

It's absolutely stable.

We are large, but we have no problem with scalability. We have less than ten firewalls and it handles the traffic well.

We're not in touch with Tufin, and haven't had to contact our partner much either.

It was easy. More or less, it's just plug n play.

Our partner/reseller installed it for us.

We also looked at AlgoSec, but I don't know why Tufin was chosen as this was decided by senior management.

Once the application control is in the system, it is a great product.