?
Solved

Firewall For Colocated Box(es) - Help Please

Posted on 2004-11-20
15
Medium Priority
?
215 Views
Last Modified: 2013-11-16
I'm doing some research into co-location for some new servers I'm putting together and I'm getting very, very confused on the firewall / VPN side of things.  Basically the servers I have are these:

      2 x Web Server
      1 x Database Server

There may be one more in the future, but that's going to be about the limit.  As I see it, I'm going to have a port in the switch in the rack (Shared) for each one of these machines.  What I want to do is put a firewall in to protect all of these servers and also provide VPN access so I can get at the operating system for administration (The database server in particular).

So far I've been looking at the Cisco (http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/index.html) and Watchguard (http://www.watchguard.com/products/fireboxx.asp) lines of firewalls.  But I really have no idea where to start.  I assume that I would only be using one connection from the switch in the rack, and I need the firewall to act as a switch so that all of the servers can have a connection (I don't currently have a seperate switch).  I've been told my my colocation provider that it's going to need to be a rackmount model too.

Am I looking at the right products for this?  I don't want to spend a huge amount of money if possible (Coming out of my pocket!).  Oh, and any and all advice on VPNs and how they work is appreciated.  Assume no prior knowldege on my part!
0
Comment
Question by:Psychotext
  • 8
  • 6
15 Comments
 
LVL 3

Assisted Solution

by:cnewgaard
cnewgaard earned 400 total points
ID: 12636944
The PIX is probably out of the question for your setup since the only models that are rack mountable are the 515 and above.  You're looking a pretty serious amount of money and probably would be overkill for your situation.  I haven't worked with the WatchGuard line in particular so I can't speak to that product.  You could also look into the Sonicwall product.  Usually when the firewall gets to the level of being rack mountable you're in the mid to higher price range though.  VPN's are usually fairly simple to implement.  You could go one of two ways.  Either setting up one of your servers (Windows will do this I'm not sure if you're looking at Linux/Unix boxes) as a VPN server using RRAS or if your firewall has a VPN server bultin you can go with that.  I prefer the VPN on the fiewall simply because I don't like letting Microsoft handle security for me.  Once you get to the point of setting up the VPN you can come back here for help though so you won't be alone on the setup.  
0
 
LVL 36

Expert Comment

by:grblades
ID: 12637939
Hi Psychotext,
You could get one of the lower end PIX models. Although it does not come with rack mounts it is slimline and you can easily make a bracket to hold it in a rack or just buy a shelf to put it on.
0
 
LVL 2

Author Comment

by:Psychotext
ID: 12638136
Sorry, yes - Should have specified that the servers are Windows machines running Windows server 2003 (Web and Standard).  I will look at Sonicwall.

Any other information is appreciated.
0
When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

 
LVL 2

Author Comment

by:Psychotext
ID: 12638235
Have looked at the Sonicwall products.  Would I be right in thinking that I'd need the Pro 3060 model as it's the lowest end product that supports 4 Lan (Configurable) ports : http://www.sonicwall.com/products/pro3060.html.  Have looked at the price and it seems to be in the same range as the Watchguard and PIX.  I'm not sure I've got the pricing for the PIX right though as I think I've only found prices on the base model.  Cisco product advisor tells me I should be looking at:

PIX-515E-FO-FE-BUN or PIX-515E-UR-FE-BUN

I'll check the pricing on those too (I get the feeling they'll be slightly out of my price range for the moment).
0
 
LVL 36

Expert Comment

by:grblades
ID: 12638309
What speed connection to the Internet does the co-lo facility have?
How many VPN connections do you need to handle?
0
 
LVL 2

Author Comment

by:Psychotext
ID: 12638484
500 mbit connection to the backbone (Made up of multiple redundant connections).
No more than three concurrent VPN users (It's only for administration).
0
 
LVL 2

Author Comment

by:Psychotext
ID: 12638551
Just for information, quick prices on the models I'm looking at are:

Cisco PIX-515E-FO-FE-BUN : GBP 1,500
Cisco PIX-515E-UR-FE-BUN : GBP 3,200 (Too expensive)
Watchguard Firebox X500 : GBP 1,100
Sonicwall Pro 3060 : GBP 1,500

I could probably find cheaper, but they are just as an example.  Does anyone know the difference between those two Cisco models?
0
 
LVL 36

Expert Comment

by:grblades
ID: 12638573
500 mbit is a seriously quick internet connection. What speed do you actually need the firewall to handle?
If you want the firewall to cope with that speed you will need a PIX 535 which will cost in the region of $20,000
0
 
LVL 36

Expert Comment

by:grblades
ID: 12638596
The PIX-515E-FO-FE-BUN is a failover unit and cannot be used by itself.
The Cisco PIX-515E-UR-FE-BUN is hte UnRestricted model which can take more than 3 interfaces and has higher VPN throughput. You might wish to consider the PIX-515E-R-BUN

These are the UK suppliers that I use. Their prices are a bit better for the PIX than yours.
http://www.s2s.ltd.uk/browse.cgi?database=cisco&get=Cisco+Secure+PIX+Firewall+Chassis
0
 
LVL 2

Author Comment

by:Psychotext
ID: 12638666
No, don't worry about that speed.  I don't imagine ever handling more than 20mbit at my servers.  I was simply giving you the information on the colocation service! :)

Thanks for the info on the Cisco failover model.  I imagine I would have been seriously annoyed had I gone out and bought that!  I'll have a look at the PIX-515E-R-BUN.
0
 
LVL 36

Expert Comment

by:grblades
ID: 12638690
In that case I would also consider the PIX-506E-BUN-K9
0
 
LVL 2

Author Comment

by:Psychotext
ID: 12638708
I might be missing something, but wouldn't I need a switch if I went with the PIX-506E-BUN-K9 or PIX-515E-R-BUN as they don't have enough connections built into the unit.  I'm trying to avoid that if possible as it'll cost me another bunch of cash to buy the switch and more again to get another 1U of rack space (Though it might actually cost less than buying a higher end model of firewall).
0
 
LVL 36

Accepted Solution

by:
grblades earned 1600 total points
ID: 12638734
You can buy a switch for less than £100 and the PIX is quite small. You will be able to mount the PIX at the front of the rack and the switch at the back so they both share 1U of space.
The 506 is not rack mounted but is 1U high and just a small square shape so you can either just sit it on top of a server infront of the switch or make a couple of brackets for it.
0
 
LVL 2

Author Comment

by:Psychotext
ID: 12638749
Interesting video on the watchguard firewalls.  A bit PHB level, but interesting nonetheless.

http://216.211.129.9/watchguard/WatchGuard_Security_Challenge.wmv
http://216.211.129.9/watchguard/WatchGuard_Security_Challenge_lo.mov (Lo res)
0
 
LVL 2

Author Comment

by:Psychotext
ID: 12640387
Thanks for all the info.  I think I've got enough to be going on with for now.
0

Featured Post

Automating Your MSP Business

The road to profitability.
Delivering superior services is key to ensuring customer satisfaction and the consequent long-term relationships that enable MSPs to lock in predictable, recurring revenue. What's the best way to deliver superior service? One word: automation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Wikipedia defines 'Script Kiddies' in this informal way: "In hacker culture, a script kiddie, occasionally script bunny, skiddie, script kitty, script-running juvenile (SRJ), or similar, is a derogatory term used to describe those who use scripts or…
Do you have a windows based Checkpoint SmartCenter for centralized Checkpoint management?  Have you ever backed up the firewall policy residing on the SmartCenter?  If you have then you know the hassles of connecting to the server, doing an upgrade_…
this video summaries big data hadoop online training demo (http://onlineitguru.com/big-data-hadoop-online-training-placement.html) , and covers basics in big data hadoop .
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…
Suggested Courses

864 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question