I manage a small network of 5 Windows XP/Pro machines and 1 Windows Server 2003 machine. We sit behind a DSL router, and we have access to only one of the IP addresses that this router provides. Presently I am using a Linksys BEFSX41 router to provide DHCP and firewall for the network. However, the Linksys keeps hanging and doesn't terminate VPN connections, so I'm looking to upgrade: 1) to avoid the hanging behavior, 2) for intrusion detection, 3) for VPN termination, and 4) for a better firewall. Performance is not an issue, but ease of configuration is.
Should I choose a Cisco 1711 VPN/K9 firewall router or a Cisco PIX 501 firewall? What are the differences between these two? They both appear to give me a DHCP server with four ports, terminated VPN, and a firewall.
Thanks, Harold.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
There is a DSL router, but we only lease one of the IP addresses that it provides. So we can't really use any of its routing functionality, such as DHCP, VPN server, firewall configuration, etc. Right now, I'm just polling you guys to see if there is some large difference in functionality between routers & firewalls as it relates to my little LAN. For instance, what about network intrusion detection (NIDS)?
Harold
The 1711 is a router with a firewall added, where as the PIX is designed as a Firewall appliance. The PIX has the graphical PDM which makes it easy to set up; the 1711 is programmed through the command line interface. Up here in Vancouver, the 1711 is about 50% more expensive.
Cisco has them in different product categories so I can't do a side-to-side comparison with the two items directly; The PIX seems to be more targeted towards your situation. I called Cisco Partner Presales, and he agreed that the PIX seemed to be a no-brainer in your case.
One note is that, as a lower end PIX the 501 is only capable of 10 simultaneous VPN tunnels; the 1711 has no theoretical limit but for performance reasons it would handle about the same.
From the PIX 501 data sheet:
Intrusion protection
Provides protection from over 55 different types of popular network-based attacks ranging from malformed packet attacks to DoS attacks
Integrates with Cisco Network Intrusion Detection System (IDS) sensors for the ability to dynamically block/shun hostile network nodes via the firewall
Note that the Cisco NIDS Software is ~$4K.
Mind you, I'm perfectly happy looking at the event logs, which are filterable by severity.
If I have one complaint with Cisco - sometimes the extra padlock for the $800 door costs $4000
IE: for best WAP protection, the Cisco Aironet series integrates with Radius servers...but the only "supported" Radius servers are very expensive; there doesn't seem to be any documentation on getting them to work with say, the free Radius server on Window 200x.
Business Accounts
Answer for Membership
by: JFrederick29Posted on 2004-02-13 at 09:00:59ID: 10353927
Since you already have a router on your network, I would go with the PIX. The major difference is that the Cisco 1711 is designed to primarily be a router and the Cisco PIX's primary function is a firewall (not a router). So basically, let the router route and let the firewall be a firewall. As far as ease of configuration, if you are comfortable with Cisco IOS than you should be fine with the PIX. I'd suggest getting a Cisco Press book on the PIX to learn the best practices and to learn how to use it to its full potential.