What is a common corporate internet gateway / proxy / filtering setup?

Question

What are some 'typical' internet gateway setups for corporate firms of say 500-5000 users? e.g.

• Firewall - some hardware device?
• Web Proxy - squid or other proxy software / device?
• Content Filtering / Blocking - Barracuda or Websense or other software?

I'm interested in some examples of what firms are actually using. I may also have my terminology screwy.

Answer 1

In that size of network I would expect to find:

• Redundant edge routers (multihomed with different ISPs on the larger end of your proposed network size)

• Redundant firewalls (either purpose-built hardware devices or commodity server computers running firewall software-- there has been spirited discussion here regarding both)

• Content filtering and web proxying - Using either commercial or open-source offerings (and, again, either purpose-build hardware or commodity server computers, with the same spirited arguments applying)

I think your question already has some of the answers you're looking for. There's nothing "magic" about providing these services for a larger network versus a smaller one, other than being more deliberate about redundancy, capacity planning, and testing.

Here's some details about a couple of environments I've worked in:

I worked a contract in a Fortune 1000 company w/ approximately 4,000 clients serviced by two DS3-based Internet connections. The edge firewalls were Cisco ASA-5520 appliances configured in an Active/Passive configuration. Two Cisco 3600-series routers (don't recall the model) provided the edge connectivity to the ISPs. Most subnets within the company had their Internet access filtered through Websense content filtering devices. I'm not aware of any caching being present, but it's certainly possible that there was some transparent caching going on that I wasn't aware of.

I do some work with a non-profit consortium that provides Internet access and application hosting services to a number of public schools (with well in excess of 5,000 individual clients across their entire Customer base). They have redundant connectivity to upstream Internet service providers and are multihomed with their upstreams. They provide all their filtering using M86 8e6 filtering appliances. Their caching was historically provided by STRATACACHE appliances, but they may've moved away from them recently-- I haven't kept up. Their edge firewall remains Cisco-based and was, last I checked, a Firewall Service Module in a Cisco Catalyst 6509 switch.

Answer 2

I would run from Barracuda - (google barracuda sucks) - of course that was just my experience w/ their anti-spam stuff not their firewall.

PFSense has a FREE and a really great solution.

What is PFSense?

pfSense is a free, open source customized distribution of FreeBSD tailored for use as a firewall and router. In addition to being a powerful, flexible firewalling and routing platform, it includes a long list of related features and a package system allowing further expandability without adding bloat and potential security vulnerabilities to the base distribution. pfSense is a popular project with more than 1 million downloads since its inception, and proven in countless installations ranging from small home networks protecting a PC and an Xbox to large corporations, universities and other organizations protecting thousands of network devices.

We run pfSense at the edge of many of our networks - from some larger corporations we support to even some entire cabinets for clients in the datacenter.

It will support virtually any kind of routing, including BGP, has a great firewall, will work in transparent mode if you wish as well.

Runs in virtual environments as well such as VMWare

Support options are everything from forums, email lists, paid support to even a free IRC community

We are not affiliated in anyway w/ the open source movement PFSense -just use and love it.

• edit to add link to barracuda per request...

A picture of one of our PF systems http://www.hostmedic.com/wp-content/uploads/2010/12/pf1exam.jpg

Answer 3

Another option is Vyatta.

I like Vyatta since it really is pretty close to the feel of a Cisco device - but it runs on x86 hardware.

Their community edition is generally put out 2 times or so a year. We used their community edition and upgraded to the paid version a short time ago for the WISP we have - mainly for the support options.

The ability to rate limit traffic was a huge value for us.

What is www.Vyatta.com

Vyatta is revolutionizing the networking industry by delivering a software-based, open-source, network operating system that is portable to standard x86 hardware as well as common virtualization and cloud computing platforms. By deploying Vyatta, users benefit from a flexible enterprise-class routing and security feature set capable of scaling from DSL to 20Gbps performance at a fraction of the cost of proprietary solutions. Thousands of physical and virtual infrastructures around the world, from small enterprise to Fortune 500, are connected and protected by Vyatta software and appliances.

Vyatta also will run in a virtual environment - according to Tolly reports it has some really good scores as well.

Load balancing and heartbeat for allowing 2+ routers however will require the paid version ;-(