Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm moving a couple of servers to a colo and was wondering what you would recommend for a hardware firewall to sit in front of them? Is it fine to just get the cheapest Cisco/Fortigate/Juniper/whatever firewall? I don't need anything fancy, pretty much just port forwarding.

share|improve this question
related question:… – jishi Feb 10 '11 at 14:17
up vote 1 down vote accepted

I would not get the cheapest firewall. You need to look at your requirements such as throughput, active connections, security, vpn requirements and more. If it needs to be cheap I would recommend setting up a separate linux box as the firewall using iptables. If there is budget for a firewall but you need something small consider the cisco asa 5505(smaller than 1U), or if you need something with more requirements consider the 5510 or 5520 which are rack mountable. The cisco firewalls have a gui interface and after initial setup can be relatively easy to manage.

share|improve this answer
Thanks, I have been looking at the ASA5505, just wondering if I was heading down the right path. – Jon Tackabury Feb 9 '11 at 22:23
The 5505 is a nice product, and may be enough. However, since it's a desktop form factor, you'll want to buy a rack mount kit. – Scott Pack Feb 10 '11 at 4:45

Here's an example for some criteria you'll want to consider when selecting a firewall in the scenario you described:

  1. Feature set - Make sure it'll perform your immediate and potential future purposes.
  2. Performance - Co-location generally provides good network connectivity and throughput. Make sure the device you pick will handle the anticipated loads you'll be capable of.
  3. Form factor - You're paying to put equipment here, the smaller the equipment, the more you can pack in.
  4. Management - Some devices offer features that make remote management easier, and give you tools in the event you find yourself unable to access it.

I imagine the brand names you've mentioned would have models capable of what you're asking. Most likely it would come down to performance and management of the equipment.

share|improve this answer

You are probably looking at "wasting" at least 1U of rack space for this firewall.

I would not buy a consumer-grade cheapie firewall.

The Juniper Netscreen SSG5 would probably meet your needs, but it is a paperback size format and doesn't come with rack arms (that I recall). The first "rackable" SSG is the SSG140, but that's not quite so cheap -- definitely overkill for your application here.

If you can figure out a way to mount it neatly, the SSG5 would almost certainly be sufficient.

share|improve this answer
I believe the SSG5 and SSG20 both have 1u rackmount kits available. – Doug Luxem Feb 10 '11 at 14:59

Alternatively - get a Mikrotik RB1100 and see how far it lasts (50mbit for smallish packets was on the table by someone running game servers).

It is CHEAP and has a TON of features in RouterOS. Uses very little power, too.

Then later you can upgrade to something more powerfull if needed. Again, the RB1100 is CHEAP to start with.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.