Kinda funny you state that Roland. I know of at least two very large carriers that uses Netscreens (and soon SRX's) for their DoS/DDoS mitigation.
State table exhaustion on the netscreen platform is something that is very easy to protect against with some protections and hasn't been a problem for years. If you can fill up a session table on a higher end SRX then I would be very very impressed. I would argue that firewalls place is in fact directly infront of servers and load balancers to protect them. On Mon, Jan 4, 2010 at 8:04 PM, Dobbins, Roland <rdobb...@arbor.net> wrote: > > On Jan 5, 2010, at 4:25 AM, Jeffrey Lyon wrote: > > > Use a robust firewall such as a Netscreen in front of your mitigation > > tool. > > Absolutely not - the firewall will fall over due to state-table exhaustion > before the mitigation system will. Firewalls (which have no place in front > of servers in the first place), load-balancers, and any other stateful > devices should be southbound of the mitigation system. > > ----------------------------------------------------------------------- > Roland Dobbins <rdobb...@arbor.net> // <http://www.arbornetworks.com> > > Injustice is relatively easy to bear; what stings is justice. > > -- H.L. Mencken > > > > >