Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was checking some firewall options and I was uncertain about the difference in performance between an appliance and a solution of "server+software".

I always worked with appliance firewalls but I'd like to know if I can get the same performance using the software option with a robust server.

I need that for an environment with 400+Mbps throughput and 100.000 concurrents sessions but this is just for reference.

share|improve this question
up vote 3 down vote accepted

For the amount of data you'll be pushing, I'd highly recommend getting something like the Cisco ASA 5520. I've used these in the past, and they make a very capable firewall. They can also provide VPN services if you desire. The spec says these can handle up to 450Mbit and 280k sessions.

If you do end up going for a software-based firewall (which is somewhat of a misnomer, as all firewalls are software-based. I digress), I'd highly recommend that you go with something like PFsense. It's BSD-based, so the network and firewall performance and security is as good as it gets for this type of product. I shudder at the thought of using ISA Server to route and inspect 400Mbits...

Edit, after clarification of question

No generic comparison can be made between a server-based solution and an appliance. There are vast differences in the quality of hardware available for each category. You'll find some "appliances" that are just commodity hardware, cheap network cards, running linux with a nice GUI frontend. Put that appliance up against a quad-core server class-machine with lots of RAM, a couple PCIe cards, and PFsense, there's no question that the server will walk all over the "appliance". Conversely, there are some appliances that employ real hardware ASICs for processing packets. Depending on your packet load and the type of filtering you want to do, these can be very high-performance.

In the end I think you're either going to have to try out some of these solutions to see which will work better for you or possibly contact the vendors directly about specific models.

Like I said, I have a fair amount of experience with both the ASA platform and PFSense. Both platforms have strengths and weaknesses, but in your case, I'd imagine that either would be able to deal just fine with the loads you're expecting.

share|improve this answer
No shuddering required. I would suggest that an array of ISA servers would be fully capable of handling this amount of traffic. The idea that an open source product would somehow handle the network load better/more effeciently than ISA, without providing any explanation why you think so, is almost useless information. – Dscoduc Dec 8 '09 at 19:17
I'm sure ISA would be able to handle it to some degree. One would be delusional, though, to think that the ISA platform (regardless of how long it's been around) is a proven routing/firewall platform. *BSD, however, has been proved many many times as being a very capable routing platform. – EEAA Dec 8 '09 at 20:03
I would consider bumping to the 5540 which can handle 650Mbp/s inspected throughput, give you a bit of breathing room for spikes. – Zypher Dec 8 '09 at 20:58
+1 Zypher. Good point. – EEAA Dec 8 '09 at 21:05
Erika, your answer is very good and helps a lot - specially because I was also considering CISCO as an option ;) - but I believe my question is more centered on the performance difference between the appliance against server+software, independently of the brand or model :). I'll edit my question to be more generic and I would like to see your answer after that :D – homemdelata Dec 10 '09 at 12:15

I think you'll find that the checkpoint firewall is an off-the-shelf PC no matter if you buy their appliance or install their software onto your own box.

In fact, most firewalls are going to be a mixture of software and hardware; on one end of the scale is a PC running openbsd/freebsd and PF -- it'll mostly be in software but you may use an ethernet card that has hardware for calculating checksums and IP header offloading and similar stuff.

On the other end of the scale, something like an old extreme networks summit5i can do NAT and flow based load balancing, ACL enforcement and a bunch of other stuff, all in hardware. It won't do stateful packet inspection or IDP type stuff, but it'll do some of what a firewall does, and do it very very quickly.

At the traffic loads you're looking at, any modern server class PC should be fine for simple stateful firewalling and nat. If you want other stuff, look to which vendor provides the features and support you want and don't sweat the details as to if it is done in an asic or in CPU.

share|improve this answer
Hi Chris, what a great answer. but I just edited the question right now because I believe the fact I mentioned teh checkpoint and put that as tag just made it too specific for that but my question would be more generic. Also, I just mentioned my environment for reference and that seems to have confused a little bit. Sorry for that. Can you please try to edit you answer to be more generic? Thank you. – homemdelata Dec 10 '09 at 12:31

I used to use ISA Server, and did not really find a problem with it as long as it is configured well and there are enough resources for it. While with a hardware appliance, they may remove the overhead off the OS, it may also cost more, depending on the setup. However our setup was for a much smaller scale, but to answer your question, we didn't notice a big difference other than overhead on the server. I say, if it is setup on a dedicated machine, you should be fine, just remember there may be more security-wise steps you may need to take into consideration for a software based firewall. Since they are not only able to get pegged via their own software, but also the software it is running on. All in all, the performance will really depend if the machine is dedicated or not and the type of setup you have. I personally do like hardware appliances though.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.