Web server hardware firewall recommendations

Question

I'm looking for a specific hardware firewall model solutions that best accommodate the following concerns [Cisco models are best, because our colo can get good deals on them reconditioned]:

• There are currently 8 servers in a colo each with a 100MBps input (though their cards are rated for 1Gb), each with their own IP and I would like to suffer as little potential throughput loss as possible
• VPNs are not really a concern
• It would be nice if the firewall could handle multiple subnets/IP ranges
• The servers currently handle anywhere from 500kbps to 2Mbps in terms of total bandwidth input
• The server handling the most traffic handles about 1/3 of the total traffic
• The firewall needs to be capable of routing traffic based on IP/domain name to the internally addressed web servers
• In aggregate, the servers host 70 sites
• I would like the firewall to be able to handle growth of %20-50 in terms of traffic, # of sites and # of servers.

I am most concerned with the number of inbound and outbound ports that the firewall handles. It will need at least 8 outbound ports and 8 inbound ports (it seems to me) in order to replicate the current setup.

I am also open to suggestions that involve changing the configuration. Perhaps I need to put a switch between the servers and firewall? I have also been told that the colo has options for upgrading the connection speed of their ports to 1Gbps - which may solve the aggregate bandwidth issues.

OK - please let me know if there is any relevant data I an provide.

Answer 1

Nothing you've listed sounds like it contraindicates most reasonable firewalls available, so you should be able to do just fine with something like a Juniper SSG5 or even an older NetScreen 5GT or NS25. (I'm less familiar with Cisco's line, but you'd probably be looking at an ASA 5505 or 5510, or an older PIX.)

The main factors that kill a firewall are the amount of crypto (which shouldn't be an issue, as you say you don't need VPNs), packets-per-second and concurrent flows (you may want to collect data on these), and CPU load if you're doing DPI.

Answer 2

I like Astaro. It is easy to configure and deploy. The number of sites doesn't matter, but you should size based on traffic. It has a built in static and dynamic VPN so you can have easy remote access to the colo network.

Astaro also has some products/features specifically meant to help secure web servers.