Every time I see a Firewall related thread on one of the *NOG lists I count how many replies Roland will make before posting his State of Danger presentation. We got to 10 this time :-) FYI not having a go here Roland, it's a very insightful, interesting and well put together preso that I have forwarded on many times! I totally agree with the better part of it. However.... While ACL's on stateless devices in the right place (routers/switches etc) are certainly the way to protect against "a 3mb/sec of spoofed SYN-flooding taking down a supposedly 20gb/sec stateful firewall", the truth is that if I spend all day every day chopping wood, I would probably buy an electric saw. But if I only hammer two pieces of wood together a few times a year, im not going to waste my money on a nail gun, I would probably just get a hammer. Similarly if most of the time I just need to protect my relatively simple network by implementing a few separate zones I will get a firewall, im not going to deploy expensive stateless devices that can push a billion pps everywhere and send flow stats to expensive DDoS mitigation hardware *cough* arbor *cough* just so I can protect against an attack that many only happen a few times a year. If you're the type of enterprise that IS seeing those types of attacks on a regular basis, unless they only started in the last few weeks the chances are you already know who the DDoS mitigation players are and how to implement them correctly (if not pre-sales aren't doing their job right!). That's how I see it anyhow. The right tool for the right job... though in most cases you still need the whole toolbox. Regards, Seamus Thoughts are entirely my own -----Original Message----- From: Dobbins, Roland [mailto:rdobbins@arbor.net] Sent: Saturday, 19 April 2014 12:11 PM To: nanog@nanog.org Subject: Re: Requirements for IPv6 Firewalls On Apr 19, 2014, at 9:04 AM, Jeff Kell <jeff-kell@utc.edu> wrote:
It's how we provide access control.
Firewalls <> 'access control'. Firewalls are one (generally, very poor and grossly misused) way of providing access control. They're often wedged in where stateless ACLs in hardware-based routers and/or layer-3 switches would do a much better job, such as in front of servers: <https://app.box.com/s/a3oqqlgwe15j8svojvzl> ----------------------------------------------------------------------- Roland Dobbins <rdobbins@arbor.net> // <http://www.arbornetworks.com> Luck is the residue of opportunity and design. -- John Milton