Re: Firewall Throughput

[Patrick Darden <darden () armc org>]

I agree.  Even if you were to focus on performance as the primary concern,
you still have to know more about the security context.  Here are some
other questions that will affect performance:

        number of networks
        number of ints
        complexity of firewall rulesets
        complexity of zones of control, 
        (i.e. number of logical domains and rulesets)
        number of services offered externally
        number of services offered internally
        VPN stuff: # connections, bandwidth, type of encryption
        upgrade path--bigger box or more boxes

Other factors that should be as important to you as performance are:

        human skill set         Security all revolves around the admin
                                --training, certifications, etc.
                                --previous experience with Cisco or CP...

        high availability       Can you afford for it to go down
                                even for monthly upgrades/updates?
                                --checkpoint offers ha via the nokia boxes
                                --not sure about the pix

        capability              Will it do what you want/need?
                                --interoperability (e.g. ipsec)
                                --content scanning (e.g. cvp for
                                  antivirus, packet scanning to see if it 
                                  truly is ftp or http or whatever)

        future                  2-3 year obsolescence cycle is standard
                                --expansion of traffic/bandwidth
                                --does the vendor update frequently to 
                                  reflect current trends, capabilities?

        management              ease of use, multiple firewalls?
                                --logging, charts, graphs, reports
                                --user account handling, adding, deleting
                                --updating rulsets
                                --adding zones of control



I believe network magazine has some firewall roundups that might help you
out.  Performance is a big part of their tests, and they get into details.


G'luck,
--Patrick


On Wed, 6 Sep 2000, Rick Murphy wrote:

> At 10:25 AM 9/5/2000 -0500, Benson Hill wrote:
> > Of course, both companies claim their solution is the best.
> > Cisco says they are faster, CheckPoint says that's true only
> > for certain types of traffic.
> >
> > Does anyone have any reliable information comparing the
> > throughput of the two products?
>
> Before you can get a good answer to that question, you'll need to refine 
> the question. Define "throughput" - number of connections per second, bytes 
> per second, etc.. What protocols are you planning to measure? Do you want 
> to use filtering that requires using a Firewall-1 security server? If so, 
> make sure you measure that way. Checkpoint allows the use of "fastmode" for 
> TCP services; that's a static 'established' filter - make sure your 
> measurements aren't using that mode unless you're willing to take the risk.
>
> There are also bigger questions, like what form of user authentication 
> you're planning to use and whether the products support it, whether or not 
> you want to virus scan e-mail, etc. Define your entire requirements set, 
> don't try to concentrate on one facet of the two products.
>          -Rick


_______________________________________________
Firewall-wizards mailing list
Firewall-wizards () nfr net
http://www.nfr.net/mailman/listinfo/firewall-wizards