Coming to me in the form of Sonicwall's Cloud Secure Edge (at a monthly, per-user cost), I understand the basics of what they say it's going to do, but I also have been doing this long enough to understand when someone's using a lot of buzzwords and scare tactics to hype a much simpler concept that I feel I am not as much up on. I would welcome any and all comments from those of you with any experience in implementing/utilizing/understanding SSE. Thanks in advance!
SysAdmins and Engineers of Lemmy, what's your take on Secure Service Edge?
9 months ago by TheOneAndOnly to c/sysadmin
TheOneAndOnly 2 points 9 months ago
Right...but is it somehow "more secure" than just a simple SSL VPN client? Granted, I have to put in a password, so anyone who compromises that password now can setup the same, so a password-less solution is inherently "more secure" in that regard...but aside from that...?
Brkdncr 4 points 9 months ago
It’s probably IPsec, not ssl.
Enterprise grade firewalls should be cert, MFA or SAML. I wouldn’t expect a simple username/password in use today.
It’s not more or less secure than the same setup on an in-house firewall.
Passerby6497 2 points 9 months ago
Don't use sonic walls, and also I don't have any configured, so I can't help you with any specifics other than other vendors.
Just guessing, they might be doing some kind of network level exploit detection along with the VPN. My network team has that setup on our firewall (multi-zone, including VPN), and I've been called in on more than a few security calls triggered by network EDR. If they have people you can use in that kind of a scenario, it would probably be worth it (my CISO is always trying to get customers to buy into the service BEFORE we have to get on a call rather than after).
TheOneAndOnly 1 point 9 months ago
I appreciate the response. That makes sense, but I think I still have a lot of homework to do!
False 5 points 9 months ago
Hadn't heard of it, reading up on it I think my employer (a very large company) has already implemented a form of it effectively. For us it's taken the form of a trusted auth service for all of our internal websites/services with everything now being directly Internet facing. This means that you can access (almost) everything without a VPN from anywhere, and it removes the idea of "internal" traffic being trustworthy. It's mostly been pretty nice from a user perspective.
It also sounds like a buzzword that a lot of companies are trying to use to sell you bundles of saas products.
TheOneAndOnly 3 points 9 months ago
Thank you! The whole thing feels like another "the cloud", or "AI" push, and I instantly distrust anything that leverages fear as a sales tool. From what I'm seeing, it feels like there's potential for improving the user experience, so I'm glad to hear that aligns with your perspective!
possiblylinux127 4 points 9 months ago
Avoid Sonicwall
TheOneAndOnly 2 points 9 months ago
Yeah? Is that experience talking?
thermal_shock 1 point 9 months ago
Yes. Even setting DHCP scopes and opening/forwarding ports is a pain in the ass compared to others like meraki. Should just be a click, not 14 steps.
TheOneAndOnly 1 point 9 months ago
I haven't used a Meraki in about 4 years, but the last one I had to administer was kind of a pain in the ass. Maybe it's just experience?
TheOneAndOnly 2 points 9 months ago
Where I'm trying to get is, zero-trust being a good framework, does it make sense to go with SW's proposal, or can I do it myself for less/no cost with other solutions out there? It seems like MS has an offering under "Global Secure Access" that might be bundled in with Office365 premium, so I've started focusing there...
TheOneAndOnly 1 point 9 months ago
Yeah, I get that. The disruption to everyone's workday switching to FOSS services would be immediate and (figuratively) violent...but I've had some conversations down that road...
TheOneAndOnly 1 point 9 months ago
Dell dropped SonicWall in 2016. SonicWall is owned by private equity now.
thermal_shock 0 points 9 months ago
Yeah, we switched all our clients to meraki and some on ubiquiti, depending on their budget and user counts. I personally use ubiquiti gateways/switches/waps at home and love it.
MehBlah 1 point 9 months ago
I use ubiquity AP's at the house but I run pfsense for my router. The unifi gateways I've dealt with were buggy. Of course its been at least five years since I've touched one of those and they may be more stable now.
False 2 points 9 months ago
My employer is not using Sonicwalls solution, but a home grown proprietary solution.
But please don't take that as evidence in favor of doing it yourself - their capability in this area is atypical.
TheOneAndOnly 2 points 9 months ago
My customer is a mid-large size environment with not a lot of tech-savvy folk who are always frustrated with additional security, so anything that would decrease the number of MFA pushes passwords they have to remember would be a win. For that matter, decreasing the number of hours spent admin-ing those things is also desireable. Currently, we're just using simple SSL VPN to access on-prem file/print services.
sysadmin
@lemmy.world
15491
340
42
A community dedicated to the profession of IT Systems Administration
No generic Lemmy issue posts please! Posts about Lemmy belong in one of these communities:
!lemmy@lemmy.ml
!lemmyworld@lemmy.world
!lemmy_support@lemmy.ml
!support@lemmy.world
go to feed...
sysadmin
@lemmy.world
15491
340
42
A community dedicated to the profession of IT Systems Administration
No generic Lemmy issue posts please! Posts about Lemmy belong in one of these communities:
!lemmy@lemmy.ml
!lemmyworld@lemmy.world
!lemmy_support@lemmy.ml
!support@lemmy.world
go to feed...
It’s a hosted vpn.
save