Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to purchase something to replace our Vyatta router that is running in a virtual machine on Hyper V (having the whole network go down when the host has to reboot is not convenient and I am getting the sense that this configuration may not be stable).

Most posts on this topic suggest using Linux/OpenBSD/FreeBSD/etc with some recommendations to use appliances from vendors for specific purposes like firewall and VPN.

We are a windows shop and it has been a stretch for us to make use of Vyatta but since it was free and straightforward to use we decided to use it. Now we need something that is easier for our team to (re)deploy and manage. I would rather purchase something windows based or an appliance that can do all of the following things:

  • DHCP server (reservations, specified gateway, dns, etc)
  • Static Routes that route traffic across three interfaces
  • Easily Reproducible (Powershell script, Puppet, Chef, etc)
  • Intuitive interface (Decent web interface would be fine but I don't want them to have to go to CLI)

Does any one have any recommendations on what I should be looking at that might meet our needs?

share|improve this question
1  
Your requirements are a bit contradictory. You want something that is easily reproducible via scripting and automation engines but don't want a CLI. That's the beauty and power of a CLI. However almost any gateway including Vyatta allows you to backup and restore a configuration...so I'm not sure why you're running towards Windows for this particular thing. Windows is the last thing I want protecting my networks. –  3dinfluence Jun 5 '10 at 2:00
    
I love CLI and completely support it's use and use it liberally myself but I want to empower the developers on my team so that they can service their own requests for DHCP reservations and other simple tasks without having to learn linux/unix/BSD style CLI. The additonal risk that we take on that someone might mess something up via CLI and cause the dev team downtime is also unacceptable. It is worth the cost of windows licensing to make this easy for them I just need to know where the right place to spend the money is. –  Chris Magnuson Aug 5 '10 at 12:47
add comment

3 Answers

up vote 1 down vote accepted

If you want to run on PC hardware, you might look at pfSense or m0n0wall. Actually, if you're accustomed to Vyatta and it has otherwise worked out well for you, you could just buy dedicated PC hardware to run it and avoid the problems you're experiencing with the virtual setup.

I agree with the commenter who said your requirements seem contradictory - it seems unusual that you have a configuration that requires three distinct networks and static routing but there's no network admin around who's comfortable with a CLI and with their own preferences about hardware.

On the other hand, Vyatta in a Windows-hosted virtual machine is a pretty unusual router setup, too, so you're already operating in a relatively idiosyncratic environment. No offense intended, it sounds like it (sort of) gets the job done, which is what counts.

Are you sure you need three distinct networks? That requirement takes you out of the $200 SOHO router category and forces you to choose between running PC hardware with multiple network cards (with the corresponding MTBF, heat, space, and power usage issues), and "serious" routers which are expensive and don't have pretty GUI interfaces that "just work" as soon as you plug them in.

share|improve this answer
    
The point of the question is to find a software solution that does not require a network admin to be involved in simple tasks like setting up DHCP reservations. Because of our requirements we have to route traffic between three different subnets 10.200.0.0/23, 192.168.0.0/24, and 192.168.1.0/24 which at least in my understanding requires me to have an interface with an IP on each of those subnets. –  Chris Magnuson Aug 5 '10 at 12:56
    
Yours is the closest answer to coming straight out and saying that what I want doesn't really exist so I am accepting it. We did end up implementing Vyatta on an older server with some additional nics to avoid the "rebooting causes the network to go down" issue and I just had to invest extra time in training someone to do the operations they needed to through the CLI. –  Chris Magnuson Feb 17 '11 at 3:12
add comment

The same thing I posted to someone in a similar situation the other day:

Quoting a NetOp, "nobody ever got fired for buying Cisco equipment"; because it works, it's widely supported, and an ASA5505 isn't that expensive (even for a small business).

You also have the option of setting up a whole Windows server with Forefront Threat Management Gateway (the successor to ISA Server) if you want an all Windows and very robust Firewall. It's quite complicate however, and will be more costly than a Cisco ASA5505 (or similar).

share|improve this answer
add comment

It's not Windows, but the firewall/gateway appliances from Astaro are pretty solid and easy to use. They sell a branded hardware with everything already installed. You just use their web-based interface to configure everything. They're designed to run as a gateway from a corporate network out to the Internet and include all sorts of features around that (including DHCP and spam filtering), but they've also found a nice home as front-end firewalls at our data center for the last few years. Internally it runs on a Linux platform, but with the web interface controlling everything I've never needed to SSH in to do anything.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.