RE: High Performance Firewall solution?

["Stout, William" <StoutW () pios com>]

> ----- Original Message -----
> From: Aaron D. Turner [SMTP:aturner () vicinity com]
> Subject:      RE: High Performance Firewall solution?
>
> Bennet isn't talking about having a IP tunnel server behind the router in
> this statement which you quote. 

I snuck that in.  ;)
 
> Actually something along the lines of what you're talking about is sorta
> what I originally had in mind without the extra cost of big Cisco routers
> and their subsequent cost in $$$ and latency.
... 
> Think of it this way:  All http traffic goes through the WSD to the web
> farm (everything else is blocked).  All other traffic is forced to go
> through the firewall. 

O.K., forget packet filters.  Go the parallel proxy route.

Your original scheme:

              |                  |
              |--RND WSD Fe/Pro--|--Web Server Farm
Internet -----|                  | running Solaris
(100Mbps)     |                  |
              |--Firewall--------|
              |                  |
              |                  |
         Public VLAN         Private VLAN (192.168.xxx.xxx)

A suggestion:

              |  (HTTP/HTTPS only)
              |--RND WSD Fe/Pro--+--Web Server Farm
Internet -----R1                  running Solaris
(100Mbps)     |                       |  \
              |                       |   -two interfaces/websvr
              |--Firewall---+----R2---+
              |             |    |\
              |       Tunnel Svr |  -R2 filters T.S. traffic,
             DMZ                 |   access to/from webservers/fw
              |                  |
         Public VLAN         Private VLAN (192.168.xxx.xxx)

A different parallel configuration I've done:


              (HTTP, Telnet, FTP)
              |--Firewall----|
              |     |        |
Internet -----R    Disks     R--+--Internal LAN
(100Mbps)     |     |        |  |
              |--Firewall----|  T.S.
              (SMTP, NNTP, NTP)

The firewalls were clustered Alpha/DUNIX, manually load balanced, and
configured to (purposefully manually) failover services and secondary IP
addresses from one to another.  True 64-bit systems do well with
encryption...

Bill Stout - stoutb () sjinternet com
______________________________________________________________________
| San Jose Internet (My new startup <g>)         http://www.sjinternet.com/