[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [FW-1] Using Cisco IOS firewall feature set
> I am looking at complimenting our FW-1's with switches installed with > the Cisco IOS firewall feature set. > > I would like to implement this on 6500 switches also using layer 3 > switching so inspection can be done on switches and not on fw nic. > We primarily would like to reduce unessesary internal to internal > traffic. > > Does anyone used the IOS firewall in production and can give advice? I have used both standard access lists and IOS Firewall in production. IOS Firewall is a lot like PIX-lite. If you need a smaller firewall for a limited set of reasons, then it may be perfect. When I have CheckPoint in an environment, I tend to let the firewall act like a firewall and I reserve access lists and IOS firewall for things like anti-spoofing, blocking attacks on the router or switch directly, and limited other uses. It makes troubleshooting problems a lot easier when you do not need to figure out what system is a causing a problem, your router, your switch or your firewall. > Are there any peformance comparisons? It would not be fair to compare performance because the capabilities of IOS Firewall and PIX or CheckPoint are very different. -Don ================================================= To set vacation, Out Of Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] =================================================
|