On Sat, 8 Apr 2006, Jan Tietze wrote:

> On Fri, 7 Apr 2006 16:06:42 -0400, "Paul Melson" wrote:
>> Sounds like a big firewall. I'm curious, though, as to why load-balancing
>> is a requirement. My experience has been that an appropriately-sized
>> single
>> firewall as part of a fail-over pair is more reliable and performs better
>> than a comparable load-balanced firewall.

> I'd say that's really implementation specific. I can see why this would be the case, but that really depends on the actual solution.

unless you have a seperate device doing the load balancing you end up with
the situation where the traffic arrives at firewall A that firewall B has
the state info for (since there isn't any firewall I am aware of that will
let you sync full state info in real time for any traffic loads high
enough to actually need load balancing). When this situation takes place
firewall A now needs to notice that the traffic should be on firewall B
and forward the traffic to that box.

since a single firewall can saturate a gig ethernet line nowdays (even
"slow" application proxy firewalls can do this easily per vendor specs,
which indicates that they probably are close enough to doing so in real
life that this is an issue), if you really need load balancing where do
you get the bandwidth to do this?

David Lang

>> The only other firewall vendor I can think of that does (or at least
>> claims
>> to do) load-balancing is Symantec Enterprise Firewall. However, you may
>> also want to look at third-party load-balancing solutions like Radware
>> FireProof or Foundry ServerIron.

> StoneSoft StoneGate has really neat clustering with dynamic re-distribution of load etc. They also used to do deliver load balancing solutions for Checkpoint for a long time.
> -- Jan
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards@honor.icsalabs.com
> http://honor.icsalabs.com/mailman/li...rewall-wizards

There are two ways of constructing a software design. One way is to make it so simple that there are obviously no deficiencies. And the other way is to make it so complicated that there are no obvious deficiencies.
-- C.A.R. Hoare

firewall-wizards mailing list