1

What kind of networking equipment would you recommend for a set of hosted Web servers, given these circumstances:

Current Situation

  • There are two web servers in colocation, in a dedicated closet. This closet is reached by exactly one Gigabit cable.
  • The closet has 4U's worth of space, 2U of which are taken by the servers. For now only 1 of those 2 servers is in use - the other one has just been ordered - and there is nothing else in the closet.
  • There are 10 or so static, public IP addresses the two servers can use.

What is Needed

  • Intrusion prevention. (I guess that means a firewall, but it would be OK to have a solution where the FW is combined with something else (remember, there are only 2U free).)
  • Multiplexing the 1 incoming Ethernet connection to the two machines. (I guess that means a switch - but would a router be a better idea?)
  • Fault-tolerance of the network equipment, i.e. what happens if the [router / switch / firewall, depending on the question above] goes down? The goal is to offer several 9's of uptime. (No need to worry about fault tolerance of the servers themselves - that is covered separately).
  • VPN functionality would also be great, though not mandatory.

What network appliance is best suited to this set of requirements?

3
  • 1
    How is this a cloud-based system when it's physical servers? that makes no sense at all. Then you appear to have 2U free and you want to put in resilient hardware even though your servers have no NIC resiliency? again this makes no sense - seems like no actual design has taken place here at all.
    – Chopper3
    Jun 23, 2011 at 13:09
  • @Chopper3 - good point. Removed cloud reference, which is misleading. Jun 23, 2011 at 13:14
  • #1 you need a 2nd ethernet cable. If this is to support 'several 9's of uptime. #2 I like Choppers suggestion below, i'd go further with a pair of 1u blade chassis with redundant power supplies. That'll give you some further expansion options. Which i assume is the reason you've selected 4u's originally. Jun 23, 2011 at 13:29

3 Answers 3

2

Two Cisco ASA 5505 (1u, half wide) on a rack shelf will give you HA, 8 ethernet ports (although 10/100 mbit), VPN and IPS/IDS (with additional license).

I do agree with others here; if you like to get to know things you can as well go with a pair of cheap (did I hear supermicro?) servers, running Linux, pfsense or what ever you would like to learn or already feel comfortable with!

4

Why don't you just put in two cheapo 1U servers running some version of Linux and put a quad-ethernet card in each?

This way your requirements can change and be delivered by whatever combination of software you like. Use PFSense as a router, or pick a particular firewall if you like, maybe some VPN code if you want. Given your really limited space requirements yet quite amorphous requirements getting some basic linux servers in would just give you the freedom to change things up until you get to a size where dedicated hardware makes more sense. Oh and get those server NICs teamed when you can.

2
  • This is a good answer - however, given the lack of any Linux expertise in house, it is not feasible in my specific case. Jun 23, 2011 at 15:11
  • There are Windows equivalents of most/all of this stuff too - same for Solaris/OSX/pretty-much-everything.
    – Chopper3
    Jun 23, 2011 at 15:16
1

I would recommend Watchgard or CheckPoint. They both have FW and IPS(very basic ones) integrated in most of their product.

They also provide VPN end point and in Watchgard product, you have Server load balancing.

Also, remember that most networking device does not take the entire U space. You can put a switch on one side and a firewall on the other...

Finally, most Security/networking vendor now offers UTM (Unified Treat Management) so whatever you choose...Cisco, Juniper, CheckPoint, Watchgard, Sonicwall, Fortinet...you will most probably find a FW that has VPN, IPS and much more features.

1
  • Watchguard is kind of cheap hardware, and some claim on buggy platforms. I have a watchguard myself, and it has the cheapest possible broadcom nics and celeron cpu.
    – 3molo
    Jun 23, 2011 at 13:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .