All,
We are currently running a FW-1 installation for a
reasonably high-volume site. Configuration:
*** Redundant IP650 with 256M RAM
*** Peak connection table size around
50K
*** 100Mbps Ethernet connectivity
We are currently discussion what the next step is
in scaling our firewall infrastructure. Basically, we want to be able to support
firewall traffic in the 100 - 400Mbps range. We can see the following
options:
1) Buy additional IP650 firewalls and load balance
using Foundry ServerIron or equivalent. For example, 4 x IP650 with 100M
interfaces and 4 x Foundry ServerIron with 100M and GBE interfaces should be
able to support > 200Mbps in normal operation. (And less if one or more of
the firewalls fail.)
2) Replace IP650 with firewalls that can handle
gigabit Ethernet (GBE).
3) Wait until Nokia releases something bigger
and better.
Questions:
*** Would be extremely interested in hearing how
other people cope with > 100Mbps firewall loads. How do you achieve
this? Bigger boxes or more boxes with load-balancing? (The ol' vertical vs.
horizontal scaling question I guess.)
*** Is anyone out there using GBE interfaces
on their firewalls? How much performance do you manage to squeeze out of FW-1
and on what platform/config?
*** Any news on Nokia releasing bigger boxes?
I have heard that GBE NICs may be available soon and that there is a IP7xx box
in the pipeline. However, Nokia seems to be very tight lipped.
Many thanks!
--oo
