network testing

Quote:

---

Originally posted here by incideagent
I thought u are supposed to put a firewall in front of a network....

---

Firewalls are always behind the router, they can be other places on your network as well, but for this discussion, its going behind the router. In a home user situation with cable, a firewall will work, but then you wouldn't need a router. I believe the sonic wall can do something like that.

****** ********** *********** ****************
* CM *------ ** Router **-------** Firewall ** ----** Hub or Switch **-----LAN
****** ********** *********** ****************
|
DMZ (optional)

that should be the best solution for you IMO. Let your firewall do your NAT and DHCP (if it can)

Quote:

---

Originally posted here by tekno



Firewalls are always behind the router, they can be other places on your network as well, but for this discussion, its going behind the router. In a home user situation with cable, a firewall will work, but then you wouldn't need a router. I believe the sonic wall can do something like that.

****** ********** *********** ****************
* CM *------ ** Router **-------** Firewall ** ----** Hub or Switch **-----LAN
****** ********** *********** ****************
|
DMZ (optional)

that should be the best solution for you IMO. Let your firewall do your NAT and DHCP (if it can)

---

If you want to get that ticky, you can get firewalls with WAN cards, so they technically are in front of the network...right?

/nebulus

Quote:

---

Originally posted here by tekno
In a home user situation with cable, a firewall will work, but then you wouldn't need a router.

---

Im going to have to disagree. A router technically isn't a firewall, so you really cant say it wouldnt be of use, because they're two completely different things.

The obvious benefits of having a router is the NAT functionality and an implemented DHCP server. IMHO routers are excellent devices, get one if you can.

Good luck

I never said a router wouldn't be of use. I said you wouldn't need one.

What I meant by that statement was if you use a firewall like the Sonicwall SOHO3 or whatever then you wouldn't need the router. Not that a router isn't important, it's just that it would work without the router just the same.

I definately agree that they are two different things, but sometimes these little soho firewall boxes tend to have the characteristics of both if you really think about it. This box for example will handle NAT (router and firewall duties), PPPoE (router duties), and DHCP (router and firewall duties). Now something like this might not be in a home users price range, but other, smaller firewalls have the same features.

I'm rambling.....my point is that a home user with cable could possibly use a firewall and not a router. A Router in your network is definately a GOOD thing to have. Obvisously it necessary in larger networks, but we're talking Home Users.

I hope that my last post wasn't taken in a negative manner, because it wasn't meant that way. I was just making a statement and I'm sorry if there was any sort of negative spin on it or whatever.

Anyways...it's 4am, I can't sleep....im building a Solaris 7 box cause my install CD for 8 is fsck'd and im too lazy to fill out the registration form again for Sun so I can download 9...maybe its time for bed.......


and Neb....yeah, sure you can get WAN cards for firewalls, but why would you want to give up the horsepower that the firewall could use for stateful inspection or parsing ACLs and the such on routing packets between networks.

My philosphy is to let the router route and the firewall protect.

alright..im going to bed now.

laters.

Quote:

---

Originally posted here by tekno
I never said a router wouldn't be of use. I said you wouldn't need one.

What I meant by that statement was if you use a firewall like the Sonicwall SOHO3 or whatever then you wouldn't need the router. Not that a router isn't important, it's just that it would work without the router just the same.

I definately agree that they are two different things, but sometimes these little soho firewall boxes tend to have the characteristics of both if you really think about it. This box for example will handle NAT (router and firewall duties), PPPoE (router duties), and DHCP (router and firewall duties). Now something like this might not be in a home users price range, but other, smaller firewalls have the same features.

I'm rambling.....my point is that a home user with cable could possibly use a firewall and not a router. A Router in your network is definately a GOOD thing to have. Obvisously it necessary in larger networks, but we're talking Home Users.

I hope that my last post wasn't taken in a negative manner, because it wasn't meant that way. I was just making a statement and I'm sorry if there was any sort of negative spin on it or whatever.

Anyways...it's 4am, I can't sleep....im building a Solaris 7 box cause my install CD for 8 is fsck'd and im too lazy to fill out the registration form again for Sun so I can download 9...maybe its time for bed.......


and Neb....yeah, sure you can get WAN cards for firewalls, but why would you want to give up the horsepower that the firewall could use for stateful inspection or parsing ACLs and the such on routing packets between networks.

My philosphy is to let the router route and the firewall protect.

alright..im going to bed now.

laters.

---

Well, for example, say you have something like a Nokia 350 with Firewall-1. They are capable of running OSPF, BGP, etc. Say for example you have a multiple gateway network where you want full redundancy (i.e, say you have a place with a primary network connection, but they have a secondary connection at another location for failover (physically seperate locations, so not really feasible to run VRRP or HSRP or clustering between them), with both locations connected into a network that has multiple gateways to the internet). In the event of a circuit failure at one of the locations, traffic may not fail over properly. You could do it by tunneling the routing traffic through the firewall, but that would require two local routers, one on each side and at both locations. Or you could run the routing daemon on the firewall itself, and save the cost of two routers. Say you have multiple T1's at each location (no > 9Mbs bandwidth) and each Nokia has a theoretical throughput of 8Gb/s, do you really think it will make any difference whatsoever on load? :)

Of course I realize that is a theoretical setup, and one you may not want to run something in that configuration, the point was only that it IS possible to do so, and do so without having any serious effect on your performance.

/nebulus

Quote:

---

Originally posted here by nebulus200


Well, for example, say you have something like a Nokia 350 with Firewall-1. They are capable of running OSPF, BGP, etc. Say for example you have a multiple gateway network where you want full redundancy (i.e, say you have a place with a primary network connection, but they have a secondary connection at another location for failover (physically seperate locations, so not really feasible to run VRRP or HSRP or clustering between them), with both locations connected into a network that has multiple gateways to the internet). In the event of a circuit failure at one of the locations, traffic may not fail over properly. You could do it by tunneling the routing traffic through the firewall, but that would require two local routers, one on each side and at both locations. Or you could run the routing daemon on the firewall itself, and save the cost of two routers. Say you have multiple T1's at each location (no > 9Mbs bandwidth) and each Nokia has a theoretical throughput of 8Gb/s, do you really think it will make any difference whatsoever on load? :)

---

In a situation like that, I agree....it wouldn't really matter then, but what if you wanted features that a router provides that those firewalls don't?

Quote:

---

Of course I realize that is a theoretical setup, and one you may not want to run something in that configuration, the point was only that it IS possible to do so, and do so without having any serious effect on your performance.

---

I think we're both are at the same conclusion, but it's been expressed differently.