Discussion
Quickie question to all those knowledgable CCNA/CCNP's out there.
We've just had two routers shipped to us with IOS 12.4 on them, but with the firewalling features disabled. Is it a license key, or an IOS reflash to get it to work again ? We specified the routers with firewalling features, yet they haven't come with any, and the reseller is saying they'll be able to let us know in two days!!
Unfortunatly I kind of need it going now...
Anyone able to give me any pointers ?
Matthew
We've just had two routers shipped to us with IOS 12.4 on them, but with the firewalling features disabled. Is it a license key, or an IOS reflash to get it to work again ? We specified the routers with firewalling features, yet they haven't come with any, and the reseller is saying they'll be able to let us know in two days!!
Unfortunatly I kind of need it going now...
Anyone able to give me any pointers ?
Matthew
I don't even appear to have access-list functionality... and my CCO login doesn't have access to IOS images for the 2811's :crying:
Edit: I'm brain dead today... it does have access-lists, but I can't type !
Now to get the HWIC interfaces working Though that probably requires an update too knowing my luck
After a bit more prodding, they've shipped me them with version 12.3(8)T8 and the manual with 12.4 written in it
>> Edited by dieselnut on Wednesday 7th December 13:47
Edit: I'm brain dead today... it does have access-lists, but I can't type !
Now to get the HWIC interfaces working
Though that probably requires an update too knowing my luck After a bit more prodding, they've shipped me them with version 12.3(8)T8 and the manual with 12.4 written in it
>> Edited by dieselnut on Wednesday 7th December 13:47
DN, I am sure you're aware, that whilst using the AL's for 'firewalling' is possible, its not reccomended due to the increased cpu / mem load it places on the router.
You're much better off getting a Pair of 515/525/535's in HA for firewalling, and only using the AL's for blackholeing nasty addresses during attacks.
J
You're much better off getting a Pair of 515/525/535's in HA for firewalling, and only using the AL's for blackholeing nasty addresses during attacks.
J
dieselnut said:
We've got PIX 515's in there to provide protection from the 'net at large. The ACL's/Firewall rules are just to stop inter-lan communication within the DMZ networks
Have a range of PiX products primarily, 506e HA, 525 HA and 535 HA for the Big Stuff, then moving onto Checkpoint for the REALLY big stuff.
J
Marshy said:
JB,
What's good these days in terms of appliance-type platforms for CheckPoint? I'm somewhat behind the curve. Nokia used to be quite nice IIRC, especially as the underlying platform knew how to speak dynamic routing protocols of various sorts. Have things moved on?
Cheers,
--Chris
IP380 is a decent Entry level device, the Nortel ASF's are ok too. All depends on your budget.
The Nokias are still hardware hardened, and being designed specifically to run FW1 they are much better devices, so my preferred choice.
J
Nokia's are OK, and better than they were, but the platform of choice for Checkpoint is Crossbeam - they're awesome.
However, I wouldn't say that Checkpoint is better than PIX. In fact I really rate PIX, and if you're already a Cisco person they're much easier to use (often less IP oriented firewall guys don't like them asthey want a pretty gui) - when you get into NAT etc PIX's are much easier, as you have to configure it all yourself, and understand what you're doing, whereas Checkpoint helps you - this may sound good, but there is much more scope for the checlpoint doing something slightly different from what you require. Also logging from a PIX is much better (syslog) - and the truth is from a performance point of view there's little between them. They co-exist quite nicely (along with Netscreen and various others, like Lucent) as many companies will require 2 flavours of firewall between the internet and them.
As far as your router... I wouldn't bother with firewall features, ACL's should be fine...
However, I wouldn't say that Checkpoint is better than PIX. In fact I really rate PIX, and if you're already a Cisco person they're much easier to use (often less IP oriented firewall guys don't like them asthey want a pretty gui) - when you get into NAT etc PIX's are much easier, as you have to configure it all yourself, and understand what you're doing, whereas Checkpoint helps you - this may sound good, but there is much more scope for the checlpoint doing something slightly different from what you require. Also logging from a PIX is much better (syslog) - and the truth is from a performance point of view there's little between them. They co-exist quite nicely (along with Netscreen and various others, like Lucent) as many companies will require 2 flavours of firewall between the internet and them.
As far as your router... I wouldn't bother with firewall features, ACL's should be fine...
Actually I'm not sure I agree with PIX being better than CheckPoint: I "do" both CheckPoint and PIX/IOS, and I find that NAT on PIXs just gets on my nerves, especially the interaction with interface security levels. CheckPoints, these days, treat NAT as a completely generic operation regardless of traffic direction, and you can get 'em to jump through hoops that are a pain in the backside with PIX.
I used to think the same as you do w.r.t. command line vs. GUI, but I've mellowed over the years, and tend to think now that (with a few Caveats) GUIs win out as the information about exactly what you're doing with your security policy is much more clearly presented, especially when the ruleset starts to grow large. The folding rulebase editor, together with the comment field (!!) and section headings scores pretty well on behalf of CheckPoint as far as I'm concerned. Don't get me started on PDM (dunno if it's improved in 7.x, mind...)
Logging is an area where neither platform is 100% useful. CheckPoint gives you a decent way to view and search your logs, but (unless things have moved on) no way to easily forward them to a central log consolidation point aside from the management station. (OK, there's tail -f | logger on Unix platforms...). PIX syslogs them somewhere, but you're then into the realms of grepping logs to chase down activity. Plus, you have to heavily post-process the logs to get useful information out of them. Swings and roundabouts.
I used to think the same as you do w.r.t. command line vs. GUI, but I've mellowed over the years, and tend to think now that (with a few Caveats) GUIs win out as the information about exactly what you're doing with your security policy is much more clearly presented, especially when the ruleset starts to grow large. The folding rulebase editor, together with the comment field (!!) and section headings scores pretty well on behalf of CheckPoint as far as I'm concerned. Don't get me started on PDM (dunno if it's improved in 7.x, mind...)
Logging is an area where neither platform is 100% useful. CheckPoint gives you a decent way to view and search your logs, but (unless things have moved on) no way to easily forward them to a central log consolidation point aside from the management station. (OK, there's tail -f | logger on Unix platforms...). PIX syslogs them somewhere, but you're then into the realms of grepping logs to chase down activity. Plus, you have to heavily post-process the logs to get useful information out of them. Swings and roundabouts.
I'm just rather dissatisfied with our current ISP, their 'maintainance' windows are proving rather irksome. They gave us a months notice that they would be doing some out of hours work (out of hours to them is really peak time for us 
) which would put us out of commission for 8 hours. We informed our clients/remote workers that they would be unable to connect blah blah blah. We then get notification from said ISP 1 day before D-Day to say "Due to unforseen circumstances...." they're moving the window.
We actually have more burst capacity specced for our connection than they seem to have into the PoP our line terminates in
So all in all, when our contract is up, we'll be looking to shift our line. (And put in a redundant failover link). Current specs are 32Mbit bandwidth bursting to 100Mbit.
I'm not all that up on DSL technology, but we're out of coverage for ADSL if that helps ?
DN
) which would put us out of commission for 8 hours. We informed our clients/remote workers that they would be unable to connect blah blah blah. We then get notification from said ISP 1 day before D-Day to say "Due to unforseen circumstances...." they're moving the window. We actually have more burst capacity specced for our connection than they seem to have into the PoP our line terminates in
So all in all, when our contract is up, we'll be looking to shift our line. (And put in a redundant failover link). Current specs are 32Mbit bandwidth bursting to 100Mbit.
I'm not all that up on DSL technology, but we're out of coverage for ADSL if that helps ?
DN
32mbit is possible with LLU bonding (hell, even an LLU dsl link on its own is 22mbit max these days!) but obviously upstream is going to be less.
3-4 lines bonded would see 100mbit / 3mbit (theoretical max!) but only useful if you're in an LLU Enabled Exchange Area.
As you arent :| then Leased Line is the only real option (assuming you cant get Cable and Bond / Multihome on that) but the SLAs are nonexistant.
Alas for some circumstances, Leased Lines are neccesary.
Out of interest, NDA/Privacy permitting, would you NEED 32mbit if the application (assumption) was hosting Offsite.. whats the bulk of the B/W ?
J
3-4 lines bonded would see 100mbit / 3mbit (theoretical max!) but only useful if you're in an LLU Enabled Exchange Area.
As you arent :| then Leased Line is the only real option (assuming you cant get Cable and Bond / Multihome on that) but the SLAs are nonexistant.
Alas for some circumstances, Leased Lines are neccesary.
Out of interest, NDA/Privacy permitting, would you NEED 32mbit if the application (assumption) was hosting Offsite.. whats the bulk of the B/W ?
J
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff