Firewall Appliance Suggestions
Howdy, I am looking for something a little unique in a bit of a tough situation with some sticky requirements. First off, my requirements are a little weird and I can't bend them a whole lot due to stipulations being put on me. I am in need a firewall appliance which can be run on VMware vSphere, with IPSEC support for multiple Phase 2 negotiations within a single Phase 1. I am also in need of something that can support VLAN interfaces on the LAN side, and ideally something with multi zoning so I can keep LAN side networks separate from each without ridiculous firewall rules. Meaning build a zone for "Customer network 1" and it displays separately (ease of management and firewall config hopefully). I need a minimum of 10 "zones" on LAN side (/29 or /30), and NAT support for LAN to WAN (to dedicate all outbound connections to a single IP from a specific zone), ideally something extremely scalable (100-200 zones). And here is the super fun part! I need something that is going to be web managed primarily as minions will be doing most of the day to day maintenance, or very simple CLI config. Willing to pay for something if need be, but looking for something that can easily handly 50-100mbit of throughput. Any Ideas? Thanks! Blake Pfankuch
CheckPoint -Hammer- "I was a normal American nerd" -Jack Herer On 06/30/2011 10:50 AM, Blake T. Pfankuch wrote:
Howdy, I am looking for something a little unique in a bit of a tough situation with some sticky requirements. First off, my requirements are a little weird and I can't bend them a whole lot due to stipulations being put on me. I am in need a firewall appliance which can be run on VMware vSphere, with IPSEC support for multiple Phase 2 negotiations within a single Phase 1. I am also in need of something that can support VLAN interfaces on the LAN side, and ideally something with multi zoning so I can keep LAN side networks separate from each without ridiculous firewall rules. Meaning build a zone for "Customer network 1" and it displays separately (ease of management and firewall config hopefully). I need a minimum of 10 "zones" on LAN side (/29 or /30), and NAT support for LAN to WAN (to dedicate all outbound connections to a single IP from a specific zone), ideally something extremely scalable (100-200 zones). And here is the super fun part! I need something that is going to be web managed primarily as minions will be doing most of the day to day maintenance, or very simple CLI config. Willing to pay for something if need be, but looking for something that can easily handly 50-100mbit of throughput.
Any Ideas?
Thanks!
Blake Pfankuch
For those of you who responded quickly and usefully, do you have any experience with the CheckPoint/Juniper/Fortinet in an environment with multiple protected subnets running on VMware? Simple enough for a NOC monkey to make changes to without breaking assuming he has half a brain and a process in front of him to follow? -----Original Message----- From: -Hammer- [mailto:bhmccie@gmail.com] Sent: Thursday, June 30, 2011 9:57 AM To: nanog@nanog.org Subject: Re: Firewall Appliance Suggestions CheckPoint -Hammer- "I was a normal American nerd" -Jack Herer On 06/30/2011 10:50 AM, Blake T. Pfankuch wrote:
Howdy, I am looking for something a little unique in a bit of a tough situation with some sticky requirements. First off, my requirements are a little weird and I can't bend them a whole lot due to stipulations being put on me. I am in need a firewall appliance which can be run on VMware vSphere, with IPSEC support for multiple Phase 2 negotiations within a single Phase 1. I am also in need of something that can support VLAN interfaces on the LAN side, and ideally something with multi zoning so I can keep LAN side networks separate from each without ridiculous firewall rules. Meaning build a zone for "Customer network 1" and it displays separately (ease of management and firewall config hopefully). I need a minimum of 10 "zones" on LAN side (/29 or /30), and NAT support for LAN to WAN (to dedicate all outbound connections to a single IP from a specific zone), ideally something extremely scalable (100-200 zones). And here is the super fun part! I need something that is going to be web managed primarily as minions will be doing most of the day to day maintenance, or very simple CLI config. Willing to pay for something if need be, but looking for something that can easily handly 50-100mbit of throughput.
Any Ideas?
Thanks!
Blake Pfankuch
I do. Your NOC Monkey reference is your biggest hurdle. What you are asking for is a bit beyond "traditional" so finding something with a pretty interface for a monkey may be tough. CheckPoint will require a fat client. If that is an issue.... -Hammer- "I was a normal American nerd" -Jack Herer On 06/30/2011 11:43 AM, Blake T. Pfankuch wrote:
For those of you who responded quickly and usefully, do you have any experience with the CheckPoint/Juniper/Fortinet in an environment with multiple protected subnets running on VMware? Simple enough for a NOC monkey to make changes to without breaking assuming he has half a brain and a process in front of him to follow?
-----Original Message----- From: -Hammer- [mailto:bhmccie@gmail.com] Sent: Thursday, June 30, 2011 9:57 AM To: nanog@nanog.org Subject: Re: Firewall Appliance Suggestions
CheckPoint
-Hammer-
"I was a normal American nerd" -Jack Herer
On 06/30/2011 10:50 AM, Blake T. Pfankuch wrote:
Howdy, I am looking for something a little unique in a bit of a tough situation with some sticky requirements. First off, my requirements are a little weird and I can't bend them a whole lot due to stipulations being put on me. I am in need a firewall appliance which can be run on VMware vSphere, with IPSEC support for multiple Phase 2 negotiations within a single Phase 1. I am also in need of something that can support VLAN interfaces on the LAN side, and ideally something with multi zoning so I can keep LAN side networks separate from each without ridiculous firewall rules. Meaning build a zone for "Customer network 1" and it displays separately (ease of management and firewall config hopefully). I need a minimum of 10 "zones" on LAN side (/29 or /30), and NAT support for LAN to WAN (to dedicate all outbound connections to a single IP from a specific zone), ideally something extremely scalable (100-200 zones). And here is the super fun part! I need something that is going to be web managed primarily as minions will be doing most of the day to day maintenance, or very simple CLI config. Willing to pay for something if need be, but looking for something that can easily handly 50-100mbit of throughput.
Any Ideas?
Thanks!
Blake Pfankuch
I use JuNOS Juniper for just this and it works well. However, I have not used the GUI for configuring it, but the command line is very usable. However, if you have a NOC Monkey, I would be tempted to create your own front end for configuring stuff and have an XML interface to the real boxes.. -- Leigh ________________________________________ From: Blake T. Pfankuch [blake@pfankuch.me] Sent: 30 June 2011 17:45 To: -Hammer-; Claudio Salmin; nanog@nanog.org; William Cooper Subject: RE: Firewall Appliance Suggestions For those of you who responded quickly and usefully, do you have any experience with the CheckPoint/Juniper/Fortinet in an environment with multiple protected subnets running on VMware? Simple enough for a NOC monkey to make changes to without breaking assuming he has half a brain and a process in front of him to follow? -----Original Message----- From: -Hammer- [mailto:bhmccie@gmail.com] Sent: Thursday, June 30, 2011 9:57 AM To: nanog@nanog.org Subject: Re: Firewall Appliance Suggestions CheckPoint -Hammer- "I was a normal American nerd" -Jack Herer On 06/30/2011 10:50 AM, Blake T. Pfankuch wrote:
Howdy, I am looking for something a little unique in a bit of a tough situation with some sticky requirements. First off, my requirements are a little weird and I can't bend them a whole lot due to stipulations being put on me. I am in need a firewall appliance which can be run on VMware vSphere, with IPSEC support for multiple Phase 2 negotiations within a single Phase 1. I am also in need of something that can support VLAN interfaces on the LAN side, and ideally something with multi zoning so I can keep LAN side networks separate from each without ridiculous firewall rules. Meaning build a zone for "Customer network 1" and it displays separately (ease of management and firewall config hopefully). I need a minimum of 10 "zones" on LAN side (/29 or /30), and NAT support for LAN to WAN (to dedicate all outbound connections to a single IP from a specific zone), ideally something extremely scalable (100-200 zones). And here is the super fun part! I need something that is going to be web managed primarily as minions will be doing most of the day to day maintenance, or very simple CLI config. Willing to pay for something if need be, but looking for something that can easily handly 50-100mbit of throughput.
Any Ideas?
Thanks!
Blake Pfankuch
______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________
Linux + iptables + fwbuilder On Thu, Jun 30, 2011 at 8:50 AM, Blake T. Pfankuch <blake@pfankuch.me> wrote:
Howdy, I am looking for something a little unique in a bit of a tough situation with some sticky requirements. First off, my requirements are a little weird and I can't bend them a whole lot due to stipulations being put on me. I am in need a firewall appliance which can be run on VMware vSphere, with IPSEC support for multiple Phase 2 negotiations within a single Phase 1. I am also in need of something that can support VLAN interfaces on the LAN side, and ideally something with multi zoning so I can keep LAN side networks separate from each without ridiculous firewall rules. Meaning build a zone for "Customer network 1" and it displays separately (ease of management and firewall config hopefully). I need a minimum of 10 "zones" on LAN side (/29 or /30), and NAT support for LAN to WAN (to dedicate all outbound connections to a single IP from a specific zone), ideally something extremely scalable (100-200 zones). And here is the super fun part! I need something that is going to be web managed primarily as minions will be doing most of the day to day maintenance, or very simple CLI config. Willing to pay for something if need be, but looking for something that can easily handly 50-100mbit of throughput.
Any Ideas?
Thanks!
Blake Pfankuch
On 6/30/2011 12:20 PM, Suresh Rajagopalan wrote:
Linux + iptables + fwbuilder
On Thu, Jun 30, 2011 at 8:50 AM, Blake T. Pfankuch<blake@pfankuch.me> wrote:
Howdy, I am looking for something a little unique in a bit of a tough situation with some sticky requirements. First off, my requirements are a little weird and I can't bend them a whole lot due to stipulations being put on me. I am in need a firewall appliance which can be run on VMware vSphere, with IPSEC support for multiple Phase 2 negotiations within a single Phase 1. I am also in need of something that can support VLAN interfaces on the LAN side, and ideally something with multi zoning so I can keep LAN side networks separate from each without ridiculous firewall rules. Meaning build a zone for "Customer network 1" and it displays separately (ease of management and firewall config hopefully). I need a minimum of 10 "zones" on LAN side (/29 or /30), and NAT support for LAN to WAN (to dedicate all outbound connections to a single IP from a specific zone), ideally something extremely scalable (100-200 zones). And here is the super fun part! I need something that is going to be web managed primarily as minions will be doing most of the day to day maintenance, or very simple CLI config. Willing to pay for something if need be, but looking for something that can easily handly 50-100mbit of throughput.
Any Ideas?
Thanks!
Blake Pfankuch
Vyatta. They have an appliance on their website.
--Curtis
Linux + iptables + fwbuilder
On Thu, Jun 30, 2011 at 8:50 AM, Blake T. Pfankuch<blake@pfankuch.me> wrote:
Howdy, I am looking for something a little unique in a bit of a tough situation with some sticky requirements. First off, my requirements are a little weird and I can't bend them a whole lot due to stipulations being put on me. I am in need a firewall appliance which can be run on VMware vSphere, with IPSEC support for multiple Phase 2 negotiations within a single Phase 1. I am also in need of something that can support VLAN interfaces on the LAN side, and ideally something with multi zoning so I can keep LAN side networks separate from each without ridiculous firewall rules. Meaning build a zone for "Customer network 1" and it displays separately (ease of management and firewall config hopefully). I need a minimum of 10 "zones" on LAN side (/29 or /30), and NAT support for LAN to WAN (to dedicate all outbound connections to a single IP from a specific zone), ideally something extremely scalable (100-200 zones). And here is the super fun part! I need something that is going to be web managed primarily as minions will be doing most of the day to day maintenance, or very simple CLI config. Willing to pay for something if need be, but looking for something
Hi Blake Try www.netasq.com Regards, Jean CLERY -----Message d'origine----- De : Curtis Maurand [mailto:cmaurand@xyonet.com] Envoyé : lundi 4 juillet 2011 23:41 À : nanog@nanog.org Objet : Re: Firewall Appliance Suggestions On 6/30/2011 12:20 PM, Suresh Rajagopalan wrote: that can easily handly 50-100mbit of throughput.
Any Ideas?
Thanks!
Blake Pfankuch
Vyatta. They have an appliance on their website.
--Curtis
On Thu, Jun 30, 2011 at 8:50 AM, Blake T. Pfankuch <blake@pfankuch.me> wrote:
Howdy, I am looking for something a little unique in a bit of a tough situation with some sticky requirements. First off, my requirements are a little weird and I can't bend them a whole lot due to stipulations being put on me. I am in need a firewall appliance which can be run on VMware vSphere, with IPSEC support for multiple Phase 2 negotiations within a single Phase 1. I am also in need of something that can support VLAN interfaces on the LAN side, and ideally something with multi zoning so I can keep LAN side networks separate from each without ridiculous firewall rules. Meaning build a zone for "Customer network 1" and it displays separately (ease of management and firewall config hopefully). I need a minimum of 10 "zones" on LAN side (/29 or /30), and NAT support for LAN to WAN (to dedicate all outbound connections to a single IP from a specific zone), ideally something extremely scalable (100-200 zones). And here is the super fun part! I need something that is going to be web managed primarily as minions will be doing most of the day to day maintenance, or very simple CLI config. Willing to pay for something if need be, but looking for something that can easily handly 50-100mbit of throughput.
Any Ideas?
Thanks!
Blake Pfankuch
I just moved most of my network over to Juniper SRX firewalls. They are pretty easy, but having a half-brained NOC guy make firewall changes is a bad idea either way. -- Brent Jones brent@servuhome.net
----- Original Message ----- From: Brent Jones [mailto:brent@servuhome.net] Sent: Thursday, June 30, 2011 01:46 PM To: Blake T. Pfankuch <blake@pfankuch.me> Cc: NANOG (nanog@nanog.org) <nanog@nanog.org> Subject: Re: Firewall Appliance Suggestions On Thu, Jun 30, 2011 at 8:50 AM, Blake T. Pfankuch <blake@pfankuch.me> wrote:
Howdy, I am looking for something a little unique in a bit of a tough situation with some sticky requirements. First off, my requirements are a little weird and I can't bend them a whole lot due to stipulations being put on me. I am in need a firewall appliance which can be run on VMware vSphere, with IPSEC support for multiple Phase 2 negotiations within a single Phase 1. I am also in need of something that can support VLAN interfaces on the LAN side, and ideally something with multi zoning so I can keep LAN side networks separate from each without ridiculous firewall rules. Meaning build a zone for "Customer network 1" and it displays separately (ease of management and firewall config hopefully). I need a minimum of 10 "zones" on LAN side (/29 or /30), and NAT support for LAN to WAN (to dedicate all outbound connections to a single IP from a specific zone), ideally something extremely scalable (100-200 zones). And here is the super fun part! I need something that is going to be web managed primarily as minions will be doing most of the day to day maintenance, or very simple CLI config. Willing to pay for something if need be, but looking for something that can easily handly 50-100mbit of throughput.
Any Ideas?
Thanks!
Blake Pfankuch
I just moved most of my network over to Juniper SRX firewalls. They are pretty easy, but having a half-brained NOC guy make firewall changes is a bad idea either way. -- Brent Jones brent@servuhome.net
You can run pfsense in a VM, and the GUI is rather easy. VLANs are configured as separate interfaces. So once you configure which VLANs are which, your NOC monkey can simply go to the firewall and edit each VLANs separate firewall rules. The multiple Phase 2 in a single Phase 1 was added to version 1.3, which never was released as a stable as all development went to version 2.0. So you will have to run 2.0RC3, but hear me out. I've been using 2.0 on production networks and use quite a few of the features since November of last year, at which time it was still a snapshot release. I have consistently been updating a VM, a few home built machines, and our embedded devices in remote offices nearly every week since then. It has never broken anything, ever. I only put it into production once the bugs became minimal enough that they wouldn't bother me. Currently there is only one bug not addressed, and it isn't hard to avoid. http://redmine.pfsense.org/projects/pfsense/issues?query_id=10 Also, its free, so not hard to try out. Heres the RC3 announcement with download links. http://blog.pfsense.org/?p=589 On 06/30/2011 10:50 AM, Blake T. Pfankuch wrote:
Howdy, I am looking for something a little unique in a bit of a tough situation with some sticky requirements. First off, my requirements are a little weird and I can't bend them a whole lot due to stipulations being put on me. I am in need a firewall appliance which can be run on VMware vSphere, with IPSEC support for multiple Phase 2 negotiations within a single Phase 1. I am also in need of something that can support VLAN interfaces on the LAN side, and ideally something with multi zoning so I can keep LAN side networks separate from each without ridiculous firewall rules. Meaning build a zone for "Customer network 1" and it displays separately (ease of management and firewall config hopefully). I need a minimum of 10 "zones" on LAN side (/29 or /30), and NAT support for LAN to WAN (to dedicate all outbound connections to a single IP from a specific zone), ideally something extremely scalable (100-200 zones). And here is the super fun part! I need something that is going to be web managed primarily as minions will be doing most of the day to day maintenance, or very simple CLI config. Willing to pay for something if need be, but looking for something that can easily handly 50-100mbit of throughput.
Any Ideas?
Thanks!
Blake Pfankuch
participants (10)
-
-Hammer- -
Blake T. Pfankuch -
Brent Jones -
Chris Lowe -
Curtis Maurand -
George Bonser -
Jean CLERY -
Leigh Porter -
Rhys Rhaven -
Suresh Rajagopalan