Le mercredi 11 mai 2011 à 16:49 +0000, Dobbins, Roland a écrit : > On May 11, 2011, at 10:03 PM, phocean wrote: > > > - DDoS : anyway, a firewall isn't more susceptible to DoS than the server > > it protects. If you look at the hardware performance of modern > > firewalls, if an attacker has the ability to DoS it, then only a > > considerable server farm that very few companies can afford will be able to > > sustain it. > > My operational experience, including that acquired during my tenure working > for the world's largest manufacturer of firewalls by units shipped, > contradicts this statement.
Can you develop? I still don't see how the hell the typical web server will handle as much traffic as one of these Checkpoint, Cisco or whatever monsters. > > > - stateless scales badly on large networks, because it requires much more > > complex and lengthy rules if you are serious with security. > > This is a) untrue and b) a near non-sequitur. In general state is much more > harmful on larger networks than on smaller ones; and there's no correlation > at all between the size of a network and the complexity of network access > policies. I was talking about complexity correlation between using stateful or stateless. Maybe it does not make any difference on a frontal firewall with a few servers behind. But on a large network with inter-vlan filtering, it matters a lot. Believe me, this one is based on my operational experience. > > > Another advantage of stateful is that there is a first sanity check of the > > sessions on a specialized hardware rather than on a generic TCP/IP > > stack of a bloated server OS. > > Marketing aside, those 'sanity checks' take place in software, not in > hardware; and they actually constitute a greatly broadened attack surface > (look at the multiple vulnerability notices/patch notices for any commercial > stateful firewall you can name, as well as for open-source stateful firewall > packages). I still trust more the network stack of a Linux/BSD/IOS dedicated box than the one of a Windows Server. And it means a crafted packet has to go through mixed devices. > > > For instance, the network stack of Windows is probably much more prone to > > bug/crash due to poor handling of crafted packets than a dedicated > > firewall (Checkpoint, Cisco, Fortinet...) may be. > > Sadly, this is also not borne out by experience. Quite the opposite, > actually. Well maybe. I have no certitude on this point, but if you have facts, it's welcome. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
