I believe lots of Screen-OS already has been mapped to JUNOS in new J-seris routers. I am not sure if the synchronization features are there yet.
http://www.juniper.net/training/technical_education/courses/EDU-JUN-OESJ.html Doug Marschke Principal Technologist Strategic Networks Training JNCIE-ER #3, JNCIE-M/T #41, JNCIS-FW, JNCI www.ietraining.net (415)902-5702 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Campbell, Alex Sent: Sunday, April 20, 2008 2:57 PM To: Amos Rosenboim; Florian Weimer Cc: [email protected] Subject: Re: [j-nsp] J-series stateful firewall / NAT architecture We wll definitely run separate pairs of switches. The only clean way to avoid the 4 x switch requirement is to use Routed Edge Resiliency, which doesn't seem ideal as it uses OSPF for failover. State sync is a requirement so it looks like we will be going with a pair of SSG-550s. Hopefully all the firewall features from ScreenOS will one day be moved to mainstream JunOS. -----Original Message----- From: Amos Rosenboim [mailto:[EMAIL PROTECTED] Sent: Monday, 21 April 2008 7:16 AM To: Florian Weimer Cc: Campbell, Alex; [email protected] Subject: Re: [j-nsp] J-series stateful firewall / NAT architecture I Indeed mean using VLAN separation. Although this is considered not a good practice for this scenario, mainly because of VLAN hopping and other L2 attacks, considering that there are L3 devices connected to this switch from all directions it does not look as a too big of a risk. Of course the 4 switches option is preferred if the budget allows it. Amos On Apr 19, 2008, at 7:56 PM, Florian Weimer wrote: > * Amos Rosenboim: > >> >> Regarding the number of boxes, you can consolidate the 4 switches to >> just two by using vlans. > > Huh? You either lose redundancy, or you heavily rely on VLAN > separation on those switches. Neither seems to be a good idea. > > -- > Florian Weimer <[EMAIL PROTECTED]> > BFK edv-consulting GmbH http://www.bfk.de/ > Kriegsstraße 100 tel: +49-721-96201-1 > D-76133 Karlsruhe fax: +49-721-96201-99 ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp _______________________________________________ juniper-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/juniper-nsp
