Palo Alto Networks and Fortinet have received a clean bill of health for their firewall protections, while the jury is still out on current Cisco defenses.

CyberRatings.org recommended both Palo Alto and Fortinet after new tests confirmed they had patched evasions previously discovered by the security testing firm.

In tests carried out at the start of the month by CyberRatings’ testing partner NSS Labs, researchers found they were able to bypass protection using Layer 4 TCP evasions in both Palo Alto’s PAN-OS (version 11.2.8-c537) and Fortinet’s IPS (v7.01154), as well as evading Layer 3 IP in the Palo Alto operating system.

Both firms reacted quickly, with Palo Alto developing an updated PAN-OS firmware package (PAN-OS 11.2.10-c37) and Fortinet deploying an updated IPS package (v7.01165 (33.00064) to fix the vulnerabilities.

Both updates were then tested using the same test methodology and tools by NSS Labs.

According to the research, Palo Alto’s exploit evasion resistance rose “dramatically” from 0% to 100%, elevating its firewall’s overall security effectiveness from 46.37% to 96.07%.

In Fortinet’s case, exploit evasion resistance increased significantly from 60% to 100%, elevating the overall security effectiveness of its firewall from 79.24% to 99.24%.

CyberRatings urged users to request upgrades of the new builds to avoid a security breach. With those updates, both security giants now join Versa Networks, Juniper Networks, and Check Point in the recommended category.

The original research also placed caution on Cisco’s Firepower 2130 for similar vulnerabilities, garnering a security effectiveness rating of 57.34%. Cisco is reportedly yet to respond to the rating.

In it research, CyberRatings warned of an “uneven” security landscape with common transport and network-layer evasions able to bypass some firewalls, while adding various products showed marked performance degradation when inspecting encrypted traffic.

“Enterprise Firewalls are constantly evolving to combat new attacker techniques and tools, but sometimes that evolution takes a wrong turn,” said Vikram Phatak, CyberRatings' CEO. “A vendor can have a near-perfect detection engine, but if attackers can bypass that engine, it gives them a clear path through your defenses.”

Phatak also praised Palo Alto Networks and Fortinet for “failing gracefully,” highlighting their responsiveness and speed in reacting to the initial findings.