If you NAT a lot, PIX can't handle the load. It also isn't flexible
enough.
Huh? .. the FWSM (which is PIX and you can have 4 of them in a chassis)
can handle 100 intefaces, 5gpbs, 100k CPS, and 1M concurrent per blade.
http://www.cisco.com/en/US/products/hw/modules/ps2706/ps4452/
Show me an OpenBSD system that can handle 400 interfaces, 20gbps, and 4M
connections (and can do HSRP, etc).
(I'm not trying to start an open-source "holy war" on a newsgrop .. I
use pf too, where I need the granularity -- just not on the whole network).
~Mike.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
