<br><div class="gmail_quote">On Tue, Jan 25, 2011 at 12:46 AM, Hetz Ben Hamo <span dir="ltr"><<a href="mailto:hetzbh@gmail.com">hetzbh@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div dir="rtl"><div dir="ltr">Hi Michael, <br><br><div class="gmail_quote"><div class="im"><blockquote class="gmail_quote" style="margin:0 .8ex;border-left:1px #ccc solid;border-right:1px #ccc solid;padding-left:1ex;padding-right:1ex">
<div>
1. If you ever plan on hitting 2 Gbit on a Cisco, you'll need some heavy-duty firewalls ( <a href="http://www.cisco.com/en/US/products/ps6120/prod_models_comparison.html" target="_blank">http://www.cisco.com/en/US/products/ps6120/prod_models_comparison.html</a> ) running you > $20,000<br>
</div></blockquote><div><br></div></div><div>4 Gbit, not 2 :)</div><div class="im"><div></div></div></div></div></div></blockquote><div>Sorry - Assumed those were 2 links for failover. </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div dir="rtl"><div dir="ltr"><div class="gmail_quote"><div class="im"><div> </div><blockquote class="gmail_quote" style="margin:0 .8ex;border-left:1px #ccc solid;border-right:1px #ccc solid;padding-left:1ex;padding-right:1ex">
<div>
2. On the other hand, I don't know how much you're paying for 2 2Gbit links, so "heavy-duty" firewalls might be just a drop in the bucket...</div></blockquote><div><br></div></div><div>$20k a drop in a bucket? how much you really think the cost of 2X2Gbit cost? not that much ;)</div>
<div class="im">
<div></div></div></div></div></div></blockquote><div>2X2Gbit _reliable_ symmetric bandwidth from a Tier IV datacenter? That would cover the $20k within 2-3 months - at least in my experience. I would sooner get the datacenter to give me 2 separate IP downlinks , each with the required bandwidth, from their routing mesh (covering the same IP space) and have them manage the failover for me (at least on the uplink side. Some switching magic required here, again, by the dacenter). You'll end up with the redundancy of the datacenter (who probably have multiple carriers through opposite ends of the building) and paying for just one link instead of two. Again, don't reinvent the wheel. </div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div dir="rtl"><div dir="ltr"><div class="gmail_quote"><div class="im"><div> </div><blockquote class="gmail_quote" style="margin:0 .8ex;border-left:1px #ccc solid;border-right:1px #ccc solid;padding-left:1ex;padding-right:1ex">
<div>3. I would recommend an appropriately scaled firewall appliance</div>
</blockquote><div><br></div></div><div>There used to be a time where you could buy a firewall, do some updated periodically and be done with it. Today it's more about contracts. You buy the boxes, you pay a contractor to do the job for you (if you don't know how to do this), and then there's this yearly update service which costs you an arm and a leg and if something goes wrong with the vendor, you're left with an expensive brick. See my post <a href="http://benhamo.org/wp/?p=2256" target="_blank">here</a> for example.</div>
</div></div></div></blockquote><div>I work mostly with Cisco - It's pretty intuitive and upgrades are pretty painless. While Cisco might not be as reliable (as far as "vendor" support) as Linux, I have faith that Cisco will be around for at least the life of my firewalls. Yes, again, you would want support contracts for the Cisco's, but:</div>
<div>1. You might want to get RedHat/your-favorite-distribution support for software stability of such a critical piece of your network</div><div>2. You would definitely need hardware support anyway on your Linux servers</div>
<div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div dir="rtl"><div dir="ltr"><div class="gmail_quote"><div class="im"><blockquote class="gmail_quote" style="margin:0 .8ex;border-left:1px #ccc solid;border-right:1px #ccc solid;padding-left:1ex;padding-right:1ex">
<div>4. If you plan to go with Linux, make sure IPtables can actually handle that much bandwidth. </div></blockquote><div><br></div></div><div>I will check that. I'll also check pfsense.</div><div class="im"><div> </div>
</div></div></div></div></blockquote><div>As we're already talking about closed-source Cisco FW's in this thread, please don't lynch me for suggesting:</div><div>Solaris 11. </div><div><div><evangelism></div>
</div><div>1. Especially the new "flows" feature which will dedicate kernel resource to specific "flows" - <a href="http://blogs.sun.com/JeffV/entry/virtual_networks">http://blogs.sun.com/JeffV/entry/virtual_networks</a></div>
<div>2. IPFilter was added in Solaris 10, and expanded in Solaris 11: <a href="http://www.homepage.montana.edu/~unixuser/031705/create_solaris_ipf.html">http://www.homepage.montana.edu/~unixuser/031705/create_solaris_ipf.html</a></div>
<div>3. Solaris comes with a built-in L3/L4 load balancer, should you need it:</div><div><a href="http://www.oracle.com/technetwork/articles/servers-storage-admin/solaris11enetwork-186212.pdf">http://www.oracle.com/technetwork/articles/servers-storage-admin/solaris11enetwork-186212.pdf</a></div>
<div>4. And finally, on the correct hardware - 10Gbit interfaces support _controlled the CPU itself_.</div><div></evangelism></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div dir="rtl"><div dir="ltr"><div class="gmail_quote"><div class="im"><div><span style="font-family:arial, sans-serif;font-size:13px;border-collapse:collapse"><div>>Also - </div>>Many firewall appliances come with Active/Active and Active/Passive configurations. If you roll-your-own linux firewall, you'll need to mess with </span></div>
<div><span style="font-family:arial, sans-serif;font-size:13px;border-collapse:collapse">>HSRP, VRRP, syncing configurations, syncing open connections, monitoring your connections, and a myriad of other things which a company </span></div>
<div><span style="font-family:arial, sans-serif;font-size:13px;border-collapse:collapse">>who specializes in this sort of thing has already solved. </span></div><div><span style="font-family:arial, sans-serif;font-size:13px;border-collapse:collapse"><br>
</span></div></div><div><span style="font-family:arial, sans-serif;font-size:13px;border-collapse:collapse">True, but when the cisco/other boxed solution costs $20K, it might be a better idea to look for alternatives, maybe a distribution which has this or a solution that is based on Linux and has this solution covered. 2 HP G6 servers with dual Xeon costs about $6k which can handle this traffic easily, and if I add a contractor+solution costs, I could go about $10k, that 50% from Cisco offer..</span></div>
</div></div></div></blockquote><div><br></div><div>Correct - The Open-Source solution is generally going to be less expensive. But unless you get enterprise support (which you did not include in your estimate), YOU will be providing the enterprise support. Make sure that assuring 99.999% uptime to your customers is something you are able to provide (if required/possible) and work out how much of *your* resources will be taken up writing all those failover scripts, testing them Ad Nauseum on your identical LAB environment, etc.</div>
<div> </div><div>I'm not saying not to go with Linux - just offering alternatives. Good luck!</div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div dir="rtl"><div dir="ltr"><div class="gmail_quote"><div> </div></div></div></div></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div dir="rtl"><div dir="ltr">
<div class="gmail_quote"><div><span style="font-family:arial, sans-serif;font-size:13px;border-collapse:collapse"></span></div><div><span style="font-family:arial, sans-serif;font-size:13px;border-collapse:collapse">Hetz</span></div>
<div><span style="font-family:arial, sans-serif;font-size:13px;border-collapse:collapse"><br></span></div></div></div></div></blockquote><div>-Mike </div></div>