Hi,
Forjette, Joe wrote:
Fredrik,
There are 2 different topics at odds here. One is that of open vs.
closed firewall software. The other is whether "dedicated" hardware can
compete with more standard "PC based" architectures. Part of your
message attempts to answer the original question by implying that
proprietary firewall software == dedicated hardware, and that dedicated
hardware (therefore closed software) is better.
Sorry Joe, if I'm being unclear in what I'm trying to say. I believe
that open source solutions can achieve a more secure total. The reason I
would switch to proprietary software would be only if I needed the power
of dedicated hardware to achieve a certain throughput.
My response to this is that there obviously are proprietary firewalls
that do run on non-dedicated hardware platforms, Checkpoint being one.
Also, there are hardware appliances that are not dedicated platforms but
that can easily match or exceed the performance of the best dedicated
hardware solutions out there. The Crossbeam X80 for example can achieve
a combined total throughput of 80Gbps, but it is at it's a core linux
platform that can support a variety of linux applications, both open and
proprietary. Bladefusion also offers a similar product.
The X80 whitepaper says it can achieve up to 8Gbps throughput, which is
impressive. It says it's running Linux as the "core" which means what,
as a controller? Is this a hybrid dedicated/standard arch? Are you
saying a 1GHz pIII is going to process 8Gbps of data? Sounds like you're
offloading the intensive parts on dedicated hardware?
To your point of ease of configuration for setting up VPNs, etc, I
agree, proprietary solutions are clearly easier to manage than open
solutions. But that does not mean you need to use a dedicated hardware
platform such as a PIX or Netscreen to achieve this ease of
configuration. My comments regarding GUIs were on configuring the
platform, the application's GUI (such as checkpoint smartconsole)
handles the rest. In this way you can leverage the power and flexibility
afforded by using a standard linux platform to run your firewall without
the overhead of needing to be unix savvy.
Regards,
Fredrik
