I'm in the process of figuring out what types of devices I'll want to use at a new colo install. We have some experience configuring Cisco routers but our knowledge is much deeper on the Linux sysadmin side. (Contracting a CCNA is an option but I'm concerned if they'll be available when we really need them.) Therefore instead of using a Cisco/Juniper router I'm tempted to use a Linux box running Shorewall. This would also allow us to leverage our existing configuration management and compliance infrastructure. Most of it will be setup will be fairly simple NAT. No BGP, OSFP, RIP or other real routing protocols.
Here's the imagined setup:
- 100Mbit throughput max on the circuit. Our standard peak throughput more like 10Mbit.
- 20-30 hosts behind this
- Mostly HTTPS traffic. Some HTTP, SMTP and SSH
- /24 IP block
My main concern is ease of implementation and maintenance. Cost isn't the primary concern, but I would prefer not to go over $2500 for a new device (I've had bad luck with refurb gear). Our current network gear will stay where it is. Whatever we use will be new purchases.
On the Cisco side I was looking at something like a 2901. If I were to go with the Linux solution, what would I be giving up? Can a modern Xeon-based Linux/Shorewall box handle 100Mbit of NAT with ~300 rules? Would the Cisco device handle a DDoS attack considerably better?