Does MS Forefront TMG cache authentication

Aceth, Thanks for checking out my post on RetroHack. To the best of my knowledge, there is no UPnP support on any 'enterprise' class firewall product, be it TMG, a Cisco ASA, a Juniper SG, or any other. The market seems to consider UPnP a home service, and no one would put a game console in at work. I guess they have never worked at a startup/dotcom/otherwise completely cool shop, or tried to run their own stuff at home. I really hope someone else pops in with an answer, but the whole reason I had to do all that on my TMG, and then posted how to do it was because lacking UPnP, that was the only way to get it to work. I'll keep an eye out here and elsewhere in case something pops up. Best of luck. Ed

There's no comparison because they're really two totally seperate products that are aimed at two different markets. Kind of how you'll probably never see a comparison of a Ferrari 599 against a Bugatti Veryon. Both crazy fast expensive cars, but aimed at two different markets.

I've used both. In fact our internal office uses TMG, and our remote site uses PFSense, and it really comes down to what you're after in a firewall appliance and your ability to maintain.

I find PFSense a breeze to maintain. Setting up failover links, IPSec tunnels, VPNs, etc very very simple. All of this is much more complicated in TMG, but that's because TMG is very tightly integrated into your Active Directory environment.

TMG can also do host-based HTTP routing, whereas PFSense can't, so you can use one IP address across multiple internal web servers without needing a specific reverse proxy.

One of the best things about TMG is that you can effectively turn off just one person's internet access by disabling their AD account in the firewall. No need to set up any Squid authentication with RADIUS against your AD and then setting up ACLs.

I'd say the TMG is more difficult to learn then PFSense if you're starting from a blank plate.