0

Here are my three choices:

  1. Right now I have a cisco ASA that I'm using for a firewall, vlan router, gateway, and ISP failover. There isn't enough control in the ASA for what I need and the license to do it gets very expensive. So upgrading that license is my least favorite option. My cisco also only has 100Mb interfaces, so file transfers between my two vlans would be really slow.

  2. I am thinking about getting a dell poweredge R210 II to handle all of these tasks. Its dells lowest spec rack server. I would just add a 4 port gigabit nic. I would use that to setup routing between my two vlans, a firewall, and the ISP failover all using IPTables.

  3. It's been suggested to me to just include this server into my virtual server which is one big 4u server with an identical physical backup, but it seems like a bad idea to have the domain controller and application servers on the same physical device as the firewall and the DMZ servers.

I would like to go with the second option because it separates out the connectivity server from the rest of my servers. It's also a lot cheaper and I would have full control with IPTables. We have about 200 devices in our network which seems easy to handle on such a low end server. Am I missing something to this or should I go ahead with the separate linux server with IPTables?

Improve this question
6
  • Which Cisco ASA unit are you referring to?
    – ewwhite
    Aug 1, 2012 at 1:25
  • It's the ASA 5505.
    – justausr
    Aug 1, 2012 at 1:29
  • 3
    I'd go with #2 but use PfSense.
    – Keith Stokes
    Aug 1, 2012 at 1:32
  • @KeithStokes, nice, didn't know there was a BSD distro specific to this. I'll look into that as well. Though I'm more comfortable with IPTables just for familiarity sake
    – justausr
    Aug 1, 2012 at 1:34
  • 2
    PFSense works quite well. I and friend run it on low-power hardware at home plus at various branch offices and even on a small network at one of our datacenters.
    – Keith Stokes
    Aug 1, 2012 at 1:36

3 Answers 3

Reset to default
3

The Cisco ASA is quite capable of what you've listed. I tend to use an external load balancer for internet connectivity, though.

What is the shortcoming of the Cisco ASA in this case?

You're missing supportability, and creating a slightly more complex solution by going with a server versus purpose-built hardware. That's really a business decision, though.

Improve this answer
9
  • It can do it, but I would need a new license that would allow more vlans. My current license only allows a DMZ, an internal lan, and an external network. I need a DMZ, two lans, and two external networks. The ASA is also limited to 100Mb on each interface, which I need a gigabit between the two lans.
    – justausr
    Aug 1, 2012 at 1:30
  • 1
    I'de like to use an external load balancer, but that'd be another $1500 minimum. The linux machine definitely has a cost benefit, I'm wondering if there is a reason not to do it basically. Security, longevity, etc
    – justausr
    Aug 1, 2012 at 1:31
  • 2
    Look for an ASA 5510 if you need the GigE ports. Even a used unit is a good deal and would be more solid than going the server route.
    – ewwhite
    Aug 1, 2012 at 1:31
  • 1
    @justausr, If you want to keep your boss out of trouble, then buy an appliance firewall
    – Mike Pennington
    Aug 1, 2012 at 1:53
  • 1
    Linux/bsd machines can be made to be as fault tolerant as cisco devices. You can boot from usb/flash/cdrom to avoid hard disk crashes. You'll get more bang for your buck. But you will have to know what your doing. Cisco is for people that want a solution, not exactly know what it's doing.
    – The Unix Janitor
    Aug 1, 2012 at 8:49
2

Some points to consider...

  1. Anything with a rotating disk (Dell server) is less reliable than something that runs from flash (like a Cisco ASA). You should go for SAS disks if you go this route (i.e. no SATA).
  2. Dell support tends to get fussy unless you put genuine Dell parts in the system (then again, same story with Cisco).
  3. Someone else already mentioned redundant power supplies, which you certainly should get if you went with the Dell server
  4. I would buy real Intel NICs if you decide to go down the server path; I have not had good experiences with Broadcom's drivers (see this question involving deadlocks on Broadcom when I changed MTUs)
  5. Support is a big issue with this plan. Some people would argue that you can get paid linux support through RedHat; however, most people with companies your size aren't so happy with RedHat's level of support.
  6. This linux plan will get really messy if you start to need dynamic IP routing protocols in linux. There are some options (bird / quagga), but you're really getting specialized when you do this.
Improve this answer
6
  • I thought SAS disks rotated too? Did you mean SSD? or is SAS just more reliable.
    – justausr
    Aug 1, 2012 at 1:47
  • SAS disks are more reliable than SATA. I personally think SSDs are too much of a new technology at this point. We have over 40 years of OS optimizations around rotating disks... therefore SSDs do a lot of things under the hood to pretend they are a rotating disk
    – Mike Pennington
    Aug 1, 2012 at 1:50
  • are you suggesting that you run a full routing protocol on a firewall device? Think again. This is terrible security practise. If your firewall need more than static routes, then it's not in the right place.
    – The Unix Janitor
    Aug 1, 2012 at 8:50
  • No it's not always terrible security practice; there are some situations where using BGP is required to announce reachability for B2B VPNs. Furthermore, you are assuming that this device will use all interfaces as firewall interfaces, and not for general L3 routing... Finally, if routing protocols are so terrible on a firewall ask yourself why both Cisco and Juniper support them
    – Mike Pennington
    Aug 1, 2012 at 8:53
  • FYI the ASA does not run BGP.
    – resmon6
    Aug 1, 2012 at 12:25
1

Are you trying to firewall your two subnets from one another? If not, why not just get a switch with L3 capability for the internal subnets and just use the existing firewall for external connectivity. 100M is generally plenty for that kind of thing and there would be no VLAN limitation. Such a switch would likely end up being cheaper than either the FW license or the server and would certainly scale better than either.

Improve this answer
2
  • We move 3 gig files between the two vlans constantly, but there's a physical and logical separation between the two vlans so we keep them separate. We're not firewalling them, but we do need WAN balancing, I figured one appliance that does it all would be cheaper than buying a L3 switch and a firewall and a balancer, PFSense is looking really promising
    – justausr
    Aug 1, 2012 at 13:53
  • A simple L3 switch with ACL's might provide sufficient separation. Like I said, adding that into the mix lets you run as many VLAN's as you'd like with no performance impact while maintaining your existing firewall, et al. No disks, minimal power consumption, little or no OS to patch, etc.
    – rnxrx
    Aug 1, 2012 at 21:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .