RE: FW-1 Failover

[John McDonald <Johnm () Networkguys com>]

Well, to validate my answer we have an install base of 32 Stonebeats,
over 50 nokia's and several Rainwalls(in large companies). We are *VERY*
familiar with all three.

Stonebeat: Stone beat has  a great product. It's been out on the market
the longest. The downfalls which I see today with Stonebeat is that it
lacks true load balancing functionality. Sure it has load sharing, but
in an environment where you running multiple firewalls(3+) you end up
with a very uneven data steam to each of the multiple firewalls. Now,
Stonebeat plans to have an update to fix this, in fact here next release
will be FULLY load sharing complaint(which Rainwall is today) and, if it
works as they say, this will all be a moot point. That update will be
released in August or September. Additionally, Stonebeat MUST perform
high availability across similar platforms(NT_NT, Solaris_Solaris) it
cannot perform it's life's duty across different platforms(NT_Solaris).

Nokia: Nokia is another great solution, depending of course on the exact
application. What are you going to be using it for? Just load balancing?
Well, once again there are a few questions to be asked. Will you be
running multiple interfaces off the box to facilitate a separation, by
access rights, in divisions, departments, or office branches. If so, how
many? Are you planing on doing BGP? If so, in what manner? The Nokia
boxes are fine if you have an exact application for them. They are a
VERY high performance routing platforms on which you can install ported
code specifically for the Nokia(IPSO) rendition of the BSD OS. Now,
another question. How fast does the PC on your desk become outdated? Two
years is a pretty good time frame. Well, hell lets say four years. What
will happen four years down the road when you have a 400Mhz box sitting
their performing your firewalling  and you have a 100Mbs pipe coming
into your Bank? Trust me, 100Mbs is not too far off. And guess what the
PC sitting on you desk will be........a 1.xGhz processor with probably
at least 256 of RAM! Now you have a REALLY outdated box doing what???
Load balancing?? Another issue to think about is......remember Solstice
from Sun? What ever happened to Solstice. Guess what? Check Point ousted
that relationship! Luckily the Check Point still runs on Solaris. What
will happen if they decide to pull the same trick with Nokia?
Unfortunately for us they don't have a firewall the runs on BSD..and
they never will. 

So....the alternatives, unless you have a specific need for the Nokia
box, are Stonebeat, see above, and Rainwall, which has the worlds fist
true load balancing(across ANY platform, and ANY number of machines).
And let me tell you from experience, it works GREAT. Very easy to
install and very bug free. The guys who engineered Rainwall also brought
it market. It could have been on the market a year ago but they refused
to bring it to market until it was  right. And IT IS!

Let me know if you have any other questions.

John D. McDonald 

Phone: 510.713.8880 ext. 306 
Fax:      510.713.3456 
E-mail: JohnM () NetworkGuys com
Web:    www.NetworkGuys.com

Elite Security Consulting 
              &
 Auditing Services

                -----Original Message-----
                From:   Lee, Gary [mailto:gmlee () mail bokf com]
                Sent:   Thursday, June 24, 1999 5:16 AM
                To:     John McDonald
                Subject:        RE: FW-1 Failover

                eSafe Protect Gateway (tm) has scanned this mail for 
                viruses, vandals and suspicious attachments and has
found it 
                to be CLEAN.


                John - how would you compare this product vs the Nokia
boxes (e.g., IP440)
                and Stonebeat?
                 
                Thanks.
                 

                Gary Lee
                Bank of Oklahoma
                Phone: 918/588-6262
                Fax: 918/588-8690
                E-mail (gmlee () mail bokf com)


                 

                -----Original Message-----
                From: John McDonald [mailto:Johnm () Networkguys com]
                Sent: Tuesday, June 22, 1999 1:43 PM
                To: Kelvin Garrahan
                Cc: 'firewall-wizards () nfr net'
                Subject: RE: FW-1 Failover



                I suggest Rainwall from Rainfinity.
<http://www.rainfinity.com>
                www.rainfinity.com  EXCELLENT product and we've have had
multiple successful
                installs with large DMZ's and multiple interfaces. Very
reliable and it's
                the only firewall fail-over software in the world that
allows for TRUE load
                balancing!

                John D. McDonald 

                Phone: 510.713.8880 ext. 306 
                Fax:      510.713.3456 
                E-mail: JohnM () NetworkGuys com 
                Web:    www.NetworkGuys.com 

                Elite Security Consulting 
                              & 
                 Auditing Services 

                        BM__MailData-----Original Message----- 
                From:   Kelvin Garrahan [
mailto:Kelvin.Garrahan () digital com
                <mailto:Kelvin.Garrahan () digital com> ] 
                Sent:   Tuesday, June 22, 1999 4:13 AM 
                To:     
                Subject:        FW-1 Failover 

                        eSafe Protect Gateway (tm) has scanned this mail
for 
                viruses, vandals and suspicious attachments and has
found it 
                to be CLEAN. 


                        Hi all, 

                        I am thinking of using FW-1 for a internal
Firewall which will
                segregate 
                four networks of different security levels. The
configuration is to be on 
                NT, with four Ethernet cards. The choice of platform is
customer driven, my 
                original plans where to use Cisco's PIX. The main
problem I have is 
                providing failover for the FW-1. With PIX this is not a
problem. I know FW-1

                supports failover/load sharing, but will this work with
four interfaces? 

                        Has anyone any experience with creating
resilience for multiple DMZ
                FW-1 
                configurations? 

                        Regards 

                        Kel. 

                        Kelvin Garrahan 
                Internet Technologies Consultant. 
                Network Services, 
                Park House, 
                N.C.R., 
                Dublin 7. 
                > kelvin.garrahan () compaq com 
                > 
                >