Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are some "typical" internet gateway setups for corporate firms of say 500-5000 users? e.g.

  • Firewall - some hardware device?
  • Web Proxy - squid or other proxy software / device?
  • Content Filtering / Blocking - Barracuda or Websense or other software?

I'm interested in some examples of what firms are actually using. I may also have my terminology screwy.

share|improve this question
up vote 3 down vote accepted

In that size of network I would expect to find:

  • Redundant edge routers (multihomed with different ISPs on the larger end of your proposed network size)

  • Redundant firewalls (either purpose-built hardware devices or commodity server computers running firewall software-- there has been spirited discussion here regarding both)

  • Content filtering and web proxying - Using either commercial or open-source offerings (and, again, either purpose-build hardware or commodity server computers, with the same spirited arguments applying)

I think your question already has some of the answers you're looking for. There's nothing "magic" about providing these services for a larger network versus a smaller one, other than being more deliberate about redundancy, capacity planning, and testing.

Here's some details about a couple of environments I've worked in:

I worked a contract in a Fortune 1000 company w/ approximately 4,000 clients serviced by two DS3-based Internet connections. The edge firewalls were Cisco ASA-5520 appliances configured in an Active/Passive configuration. Two Cisco 3600-series routers (don't recall the model) provided the edge connectivity to the ISPs. Most subnets within the company had their Internet access filtered through Websense content filtering devices. I'm not aware of any caching being present, but it's certainly possible that there was some transparent caching going on that I wasn't aware of.

I do some work with a non-profit consortium that provides Internet access and application hosting services to a number of public schools (with well in excess of 5,000 individual clients across their entire Customer base). They have redundant connectivity to upstream Internet service providers and are multihomed with their upstreams. They provide all their filtering using M86 8e6 filtering appliances. Their caching was historically provided by STRATACACHE appliances, but they may've moved away from them recently-- I haven't kept up. Their edge firewall remains Cisco-based and was, last I checked, a Firewall Service Module in a Cisco Catalyst 6509 switch.

share|improve this answer

I would run from Barracuda - (google barracuda sucks) - of course that was just my experience w/ their anti-spam stuff not their firewall.

PFSense has a FREE and a really great solution.

What is PFSense?

pfSense is a free, open source customized distribution of FreeBSD tailored for use as a firewall and router. In addition to being a powerful, flexible firewalling and routing platform, it includes a long list of related features and a package system allowing further expandability without adding bloat and potential security vulnerabilities to the base distribution. pfSense is a popular project with more than 1 million downloads since its inception, and proven in countless installations ranging from small home networks protecting a PC and an Xbox to large corporations, universities and other organizations protecting thousands of network devices.

We run pfSense at the edge of many of our networks - from some larger corporations we support to even some entire cabinets for clients in the datacenter.

It will support virtually any kind of routing, including BGP, has a great firewall, will work in transparent mode if you wish as well.

Runs in virtual environments as well such as VMWare

Support options are everything from forums, email lists, paid support to even a free IRC community

We are not affiliated in anyway w/ the open source movement PFSense -just use and love it.

  • edit to add link to barracuda per request...

A picture of one of our PF systems

share|improve this answer
If you're going to put yourself out there and say that <product_X> sucks, then you ought to be prepared to give some reasons as to why that is the case. I have a large amount of experience w/ Barracuda's anti-spam products and while not perfect, actually do a pretty dang good job IMHO. – EEAA Dec 2 '10 at 5:09
By the way, I do agree with your PFSense endorsement. Great product. – EEAA Dec 2 '10 at 5:15
Hrm, what do you know...another copy/paste job. – EEAA Dec 2 '10 at 5:34
just so the questioner knows though, there are a bunch of router firewall linux distros that are just like pfSense... one of the oldest ones is called Smoothwall. also m0n0wall, Untangle, and IPCop. pfSense is trendy right now but not necessarily the best one. – djangofan Dec 2 '10 at 5:50
ErikA - do a google search and you will find my blog posting is #1 for Barracuda sucks. After reading what happened you tell me if we got the best service. As for copy/paste Call Chris Buechler @ PFSense and ask him if he knows me... I have hired him personally on many jobs for pfSense and BSD Perimeter. I often will copy the source but link to it - makes sense to put it in their words vs my own if they said it better - BUT follow the simple links in the posts ;-) In regards to Untangle - good product but java is slow especially for 5000 users .... – Glenn Kelley Dec 2 '10 at 8:38

Another option is Vyatta.

I like Vyatta since it really is pretty close to the feel of a Cisco device - but it runs on x86 hardware.

Their community edition is generally put out 2 times or so a year. We used their community edition and upgraded to the paid version a short time ago for the WISP we have - mainly for the support options.

The ability to rate limit traffic was a huge value for us.

What is

Vyatta is revolutionizing the networking industry by delivering a software-based, open-source, network operating system that is portable to standard x86 hardware as well as common virtualization and cloud computing platforms. By deploying Vyatta, users benefit from a flexible enterprise-class routing and security feature set capable of scaling from DSL to 20Gbps performance at a fraction of the cost of proprietary solutions. Thousands of physical and virtual infrastructures around the world, from small enterprise to Fortune 500, are connected and protected by Vyatta software and appliances.

Vyatta also will run in a virtual environment - according to Tolly reports it has some really good scores as well.

Load balancing and heartbeat for allowing 2+ routers however will require the paid version ;-(

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.