[Modus] Firewalls for ISPs

[Michael B. Smith]

Your likely least expensive solution is to purchase the firewall feature set for the Cisco IOS in your existing router. Depending on the age and specific model of your 2620, it may require memory upgrades to run FWFS.   The FWFS is a decent firewall.   Staying with a Cisco solution, I'd tend to want to purchase a separate device, a PIX firewall.   We are all Cisco. Our access-layer routers are Cisco 7200 series routers, behind them are a number of Cisco layer-3 switches (Catalyst 5000 and 3550 series) and then we have PIXen, plus some other 2600/3700 series routers.   We use the FWFS, the PIXen, and access control lists in the distribution layer routers and layer-3 switches for multiple layers of protection. VLANs are also a key component of our security model as well as a strong degree of physical separation from different pieces of our networks (customer, internal, external, office, DMZ).   This doesn't even touch the VPN issues, which are another added layer of complexity in our network.   But you should be able to retain a decent Cisco partner for a few days, work with him/her and come up with a plan that provides reasonable levels of security just with the 2620, FWFS, and VLAN capable switches. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of Admin Sent: Thursday, February 12, 2004 10:59 PM To: [EMAIL PROTECTED] Subject: [Modus] Firewalls for ISPs We are a small ISP and are concerned about the increase in security problems in Windows.  It seems every few days Microsoft releases security patches.  I have also seen on the Internet that source code for Windows 2000 and NT have leaked out on the Net.   We use all Windows servers connected to the net through a Cisco 2620.  My question is this.... What do the rest of you do for firewall protection? Am I going to have to invest is an expensive hardware firewall and hire on an employee (which I can't really afford) to do full-time security maintenance?     AK Internet Less expensive and more personal than Earthlink, AOL, and MSN 641 E. 10th Avenue Bowling Green, KY  42101 270-793-0647 voice 270-843-7532 fax [EMAIL PROTECTED]