Fredrik,
There are 2 different topics at odds here. One is that of open vs.
closed firewall software. The other is whether "dedicated" hardware can
compete with more standard "PC based" architectures. Part of your
message attempts to answer the original question by implying that
proprietary firewall software == dedicated hardware, and that dedicated
hardware (therefore closed software) is better.
My response to this is that there obviously are proprietary firewalls
that do run on non-dedicated hardware platforms, Checkpoint being one.
Also, there are hardware appliances that are not dedicated platforms but
that can easily match or exceed the performance of the best dedicated
hardware solutions out there. The Crossbeam X80 for example can achieve
a combined total throughput of 80Gbps, but it is at it's a core linux
platform that can support a variety of linux applications, both open and
proprietary. Bladefusion also offers a similar product.
To your point of ease of configuration for setting up VPNs, etc, I
agree, proprietary solutions are clearly easier to manage than open
solutions. But that does not mean you need to use a dedicated hardware
platform such as a PIX or Netscreen to achieve this ease of
configuration. My comments regarding GUIs were on configuring the
platform, the application's GUI (such as checkpoint smartconsole)
handles the rest. In this way you can leverage the power and flexibility
afforded by using a standard linux platform to run your firewall without
the overhead of needing to be unix savvy.
cheers,
joe
-----Original Message-----
From: Fredrik Widlund [mailto:fredrik.widlund@qbrick.com]
Sent: Tuesday, June 14, 2005 12:09 PM
To: Forjette, Joe
Cc: Joseph (Joe) Lynn; James Riden; firewalls@securityfocus.com
Subject: Re: Open Source vs Proprietary
Forjette, Joe wrote:
Dedicated hardware will give you more throughput.
This is quite a broad claim that may have been true a few years ago or
for off the shelf PCs, but today with the availability of 16 lane PCI
Express buses and custom chassis backplanes capable of pushing >80Gbps,
I don't believe that this statement still stands.
It's a broad claim, sure, but please tell me where I can get hardware to
achieve 10Gbps throughput for my *bsd pf.
Anyone running a i386 firewall (pf for example) on a fully loaded Gbps?
Is it stable? No increased latency (more than normal) etc.? Would be
nice but I haven't had the guts to try it yet.
Application layer NIDS on fully loaded Gbps? No way.
To your other point, there are vendors that are developing appliances
with pre-hardened *nix OSs that support both open source and proprietary
firewall/ips/ids/routing solutions. Some even provide cisco-like CLI
interfaces and GUIs with which to tweak the few OS internals that do
need configuring virtually eliminating the need to access a unix prompt
and consuming the knowledge and time resources you fear losing.
Still interfaces like that are likely to reduce functionality. Say you
want a 16 segment VLAN firewall trunked to a Gbps switch, CARP
redundancy, Many IPsec assocs, Kerberos V over OpenSSH, add OpenVPN,
then move it all over to IPv6. The vendor that's going to keep up to
speed with making plug and play GUIs for something like that just
doesn't exist.
Regards,
Fredrik Widlund
