I think the original point was how best to do firewall as a service not necessarily DDOS attacks. My point was that I've seen this done incorrectly a few times in the past. Mostly issues with design and not the box itself. Also, I seems better to use a virtual appliance and a server platform than an hardware appliance with limited virtual instances.
2011/7/8 Ziv Leyes <[email protected]> > Radware's DefensePro comes in mind when talking about hardware performance > during DDOS, you could put the device in the middle of the network, and use > some redirector such as CID or Alteon to separate customers that pay for the > service and customers that don't and pass only the traffic of the ones you > want through the device. > We did a pilot with this setup and it worked great, I didn't see any DDoS > that could possibly tickle the device's resources... > > Ziv > > -----Original Message----- > From: [email protected] [mailto: > [email protected]] On Behalf Of Stefan Fouant > Sent: Friday, July 08, 2011 1:51 PM > To: Keegan Holley > Cc: [email protected]; [email protected] > Subject: Re: [c-nsp] [j-nsp] Firewalls "as-a-service" in an MPLS > infrastructure... > > On 7/8/2011 12:28 AM, Keegan Holley wrote: > > Could be interesting. I've rarely seen firewall as a service done right > > though. It's hard to keep, cpu, memory usage, DDOS attacks, > > misconfiguration, etc. of one customers from affecting the other > customers > > that share hardware. That being said there are better platforms to run > the > > firewall instances on that are available now, checkpoint VSX comes to > mind. > > Years ago when I had to develop a Network Based Firewall solution for a > particular ISP in order to comply with the Federal Government's NetworX > bid, we chose Juniper's NS-5400 for precisely this reason. In ScreenOS > you have the concept of resource profiles with which you can limit the > amount of CPU, Sessions, Policies, MIPs and DIPs (used for NAT), and > other user defined objects such as address book entries, etc. that each > VSYS can avail. > > These are essential elements of any multi-tenant firewall solution and > evaluated platforms should likewise have similar offerings to contain > resource usage for individual customers. > > Stefan Fouant > JNCIE-ER #70, JNCIE-M #513, JNCI > Technical Trainer, Juniper Networks > http://www.shortestpathfirst.net > http://www.twitter.com/sfouant > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > > > > > ************************************************************************************ > This footnote confirms that this email message has been scanned by > PineApp Mail-SeCure for the presence of malicious code, vandals & computer > viruses. > > ************************************************************************************ > > > > > The information contained in this e-mail message and its attachments is > confidential information intended only for the use of the individual or > entity named above. If the reader of this message is not the intended > recipient, you are hereby notified that any dissemination, distribution or > copying of this communication is strictly prohibited. If you have received > this communication in error, please notify us immediately by replying to the > sender, and then delete the message from your computer. Thank you! > > ******** This mail was sent via Mail-SeCure System.******** > > > > > > > ************************************************************************************ > This footnote confirms that this email message has been scanned by > PineApp Mail-SeCure for the presence of malicious code, vandals & computer > viruses. > > ************************************************************************************ > > > > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
