Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for a specific hardware firewall model solutions that best accommodate the following concerns [Cisco models are best, because our colo can get good deals on them reconditioned]:

  • There are currently 8 servers in a colo each with a 100MBps input (though their cards are rated for 1Gb), each with their own IP and I would like to suffer as little potential throughput loss as possible
  • VPNs are not really a concern
  • It would be nice if the firewall could handle multiple subnets/IP ranges
  • The servers currently handle anywhere from 500kbps to 2Mbps in terms of total bandwidth input
  • The server handling the most traffic handles about 1/3 of the total traffic
  • The firewall needs to be capable of routing traffic based on IP/domain name to the internally addressed web servers
  • In aggregate, the servers host 70 sites
  • I would like the firewall to be able to handle growth of %20-50 in terms of traffic, # of sites and # of servers.

I am most concerned with the number of inbound and outbound ports that the firewall handles. It will need at least 8 outbound ports and 8 inbound ports (it seems to me) in order to replicate the current setup.

I am also open to suggestions that involve changing the configuration. Perhaps I need to put a switch between the servers and firewall? I have also been told that the colo has options for upgrading the connection speed of their ports to 1Gbps - which may solve the aggregate bandwidth issues.

OK - please let me know if there is any relevant data I an provide.

share|improve this question

closed as not constructive by Magellan, Hauke Laging, Ward, voretaq7 Jun 7 '13 at 3:21

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

For the record, we went with an Astaro and I have been mightily disappointed. In fact - at this juncture, I can't get anyone from the company to repond to my inquiries as to why my REGISTRATION KEY WON'T WORK. – fordareh Jan 3 '11 at 16:43
up vote 2 down vote accepted

Nothing you've listed sounds like it contraindicates most reasonable firewalls available, so you should be able to do just fine with something like a Juniper SSG5 or even an older NetScreen 5GT or NS25. (I'm less familiar with Cisco's line, but you'd probably be looking at an ASA 5505 or 5510, or an older PIX.)

The main factors that kill a firewall are the amount of crypto (which shouldn't be an issue, as you say you don't need VPNs), packets-per-second and concurrent flows (you may want to collect data on these), and CPU load if you're doing DPI.

share|improve this answer
The only thing worth noting is that these won't have 8x 1Gb prots. If your total bandwidth is currently around 2Mb/s I question why you need that though? – Cian Jul 9 '10 at 8:51

I like Astaro. It is easy to configure and deploy. The number of sites doesn't matter, but you should size based on traffic. It has a built in static and dynamic VPN so you can have easy remote access to the colo network.

Astaro also has some products/features specifically meant to help secure web servers.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.