Firewall for Network Security. . . Do you use it? Host or Network?

There are several regulations, edicts, or industry practices that require firewalls between certain types of servers. For the client I develop for at the company I work, there are firewalls between front end, middle wear and database servers. Not to mention there are firewalls separating each client and on the core switch coming into our data-center. For PCI compliance we don't even store credit card information. We've outsourced it to a company that specializes in processing and storing credit card data.

I have a hardware firewall and would never think of not having one

NMCI told me that my network settings are "too paranoid" to work with their laptops. F*** 'em if they can't take a joke!

Here is the bigger question.....is your firewall configured for "deny-all except for"?

We use sonci wall products that have served us very well, the only draw back Dell(hell) now owns them.

Having at least one, centrally located firewall, is a sound practice. A common architecture would be your entry point, then your IDS, your firewall, then your DMZ cluster, etc.
We all know that no one system, device, or technique is going to safeguard your system. A Defense in Depth approach (layered security) is the most sound and practical approach to safeguarding IT systems.

I am currently using two Firewalls but it is for my home network SGT (Join to see)

It has been a while since i visited this thread - reading over the responses there are a variety of solutions and ideas. However it is important to remember that firewalls are only one portion of a secure network design.
Firewalls can provide protection against some forms of unauthorized access to network and computing resources but they are in no way a complete security solution.

There are numerous attack vectors that need to be considered, some of which can be mitigated by IDS and/or IPS, others require application level protections and there are also malware detection and removal - including inbound and outbound email scanning.

Single point firewall solutions offer limited defenses, however most well configured (and regularly patched) SOHO 'routers' will provide the basic protections for a typical home environment. Note however none of the typical consumer (and few 'prosumer') routers provide much, if any protection against DOS attacks. Simple DOS attack will often crash a SOHO router and if that router is also the wireless access point (as many are) the entire network crashes.

Professionally, I do not recommend, nor would allow to be deployed any solution that is based on a single point firewall - it should be a layered DMZ configuration. Similarly wireless access points should be separate from a firewall-router.

It should be noted that typical SOHO router-wireless access point devices do not have either the memory or processing power to handle routing, DHCP, DNS relay, wireless management and security. Particularly once you get above more than 10 or 15 client devices. Even leaving out the design needs to ensure quality signal, a single central wireless access point is not a good design.

DNS and DHCP are also things that should be considered. A good secure DHCP plan should set aside a relatively small pool for unregistered devices, and a larger 'reserved' pool for known clients - the known clients are given DHCP reserved addresses. Certain devices should have fixed static address - network devices for example, printers, etc. If possible I recommend 802.1x authentication for clients connecting to switch ports (unmanaged switches are not particularly recommended here).

I generally do not recommend using the ISP provided DNS - a public DNS like Google (8.8.8.8 / 8.8.4.4) is a better choice - you can easily set your DHCP to provide those. Similarly, if you are running any sort of home VPN, getting a DynDNS service (or similar product) and using your OWN registered domain is a good best practice.

Regards!

For my personal home network I use a Ubiquiti EdgeRouter Pro as a border gateway. Most of my internal network is Ubiquiti product. I have 2 (soon to be 3) EdgeRouter POE in homes of family for point to point vpn, giving them access to a NAS with 11 TB of family archives (photos, documents, some video)

The real question is not if someone uses a firewall - the question is what version and how is it configured. A SOHO firewall router with known unpatched vulnerabilities or one that is poorly configured is just bad if not worse than no firewall at all (probably worse since the the user has a false sense of security)

Also firewalls are not the be all,end all of security. Solid best practices, good passwords frequently changed, as well as intrusion detection and deep packet inspection are all parts of a good security implementation.

Some things to think about (there are alot more)

Are you enforcing end-point security for desktop clients with robust authentication schemes?
Do you practice AAA - Authentication, Authorization and Accounting?
Are you using role based security - locking down administrative privilege and access?
Secure backups of data ?
End user training around best practices?
Application security - do you know what the traffic flow pattern is for all your applications?
Audit policies , penetration testing?