Firewall For Colocated Box(es) - Help Please

I'm doing some research into co-location for some new servers I'm putting together and I'm getting very, very confused on the firewall / VPN side of things.  Basically the servers I have are these:

      2 x Web Server
      1 x Database Server

There may be one more in the future, but that's going to be about the limit.  As I see it, I'm going to have a port in the switch in the rack (Shared) for each one of these machines.  What I want to do is put a firewall in to protect all of these servers and also provide VPN access so I can get at the operating system for administration (The database server in particular).

So far I've been looking at the Cisco (http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/index.html) and Watchguard (http://www.watchguard.com/products/fireboxx.asp) lines of firewalls.  But I really have no idea where to start.  I assume that I would only be using one connection from the switch in the rack, and I need the firewall to act as a switch so that all of the servers can have a connection (I don't currently have a seperate switch).  I've been told my my colocation provider that it's going to need to be a rackmount model too.

Am I looking at the right products for this?  I don't want to spend a huge amount of money if possible (Coming out of my pocket!).  Oh, and any and all advice on VPNs and how they work is appreciated.  Assume no prior knowldege on my part!
LVL 2
PsychotextAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

cnewgaardCommented:
The PIX is probably out of the question for your setup since the only models that are rack mountable are the 515 and above.  You're looking a pretty serious amount of money and probably would be overkill for your situation.  I haven't worked with the WatchGuard line in particular so I can't speak to that product.  You could also look into the Sonicwall product.  Usually when the firewall gets to the level of being rack mountable you're in the mid to higher price range though.  VPN's are usually fairly simple to implement.  You could go one of two ways.  Either setting up one of your servers (Windows will do this I'm not sure if you're looking at Linux/Unix boxes) as a VPN server using RRAS or if your firewall has a VPN server bultin you can go with that.  I prefer the VPN on the fiewall simply because I don't like letting Microsoft handle security for me.  Once you get to the point of setting up the VPN you can come back here for help though so you won't be alone on the setup.  
0
grbladesCommented:
Hi Psychotext,
You could get one of the lower end PIX models. Although it does not come with rack mounts it is slimline and you can easily make a bracket to hold it in a rack or just buy a shelf to put it on.
0
PsychotextAuthor Commented:
Sorry, yes - Should have specified that the servers are Windows machines running Windows server 2003 (Web and Standard).  I will look at Sonicwall.

Any other information is appreciated.
0
Managing Security Policy in a Changing Environment

The enterprise network environment is evolving rapidly as companies extend their physical data centers to embrace cloud computing and software-defined networking. This new reality means that the challenge of managing the security policy is much more dynamic and complex.

PsychotextAuthor Commented:
Have looked at the Sonicwall products.  Would I be right in thinking that I'd need the Pro 3060 model as it's the lowest end product that supports 4 Lan (Configurable) ports : http://www.sonicwall.com/products/pro3060.html.  Have looked at the price and it seems to be in the same range as the Watchguard and PIX.  I'm not sure I've got the pricing for the PIX right though as I think I've only found prices on the base model.  Cisco product advisor tells me I should be looking at:

PIX-515E-FO-FE-BUN or PIX-515E-UR-FE-BUN

I'll check the pricing on those too (I get the feeling they'll be slightly out of my price range for the moment).
0
grbladesCommented:
What speed connection to the Internet does the co-lo facility have?
How many VPN connections do you need to handle?
0
PsychotextAuthor Commented:
500 mbit connection to the backbone (Made up of multiple redundant connections).
No more than three concurrent VPN users (It's only for administration).
0
PsychotextAuthor Commented:
Just for information, quick prices on the models I'm looking at are:

Cisco PIX-515E-FO-FE-BUN : GBP 1,500
Cisco PIX-515E-UR-FE-BUN : GBP 3,200 (Too expensive)
Watchguard Firebox X500 : GBP 1,100
Sonicwall Pro 3060 : GBP 1,500

I could probably find cheaper, but they are just as an example.  Does anyone know the difference between those two Cisco models?
0
grbladesCommented:
500 mbit is a seriously quick internet connection. What speed do you actually need the firewall to handle?
If you want the firewall to cope with that speed you will need a PIX 535 which will cost in the region of $20,000
0
grbladesCommented:
The PIX-515E-FO-FE-BUN is a failover unit and cannot be used by itself.
The Cisco PIX-515E-UR-FE-BUN is hte UnRestricted model which can take more than 3 interfaces and has higher VPN throughput. You might wish to consider the PIX-515E-R-BUN

These are the UK suppliers that I use. Their prices are a bit better for the PIX than yours.
http://www.s2s.ltd.uk/browse.cgi?database=cisco&get=Cisco+Secure+PIX+Firewall+Chassis
0
PsychotextAuthor Commented:
No, don't worry about that speed.  I don't imagine ever handling more than 20mbit at my servers.  I was simply giving you the information on the colocation service! :)

Thanks for the info on the Cisco failover model.  I imagine I would have been seriously annoyed had I gone out and bought that!  I'll have a look at the PIX-515E-R-BUN.
0
grbladesCommented:
In that case I would also consider the PIX-506E-BUN-K9
0
PsychotextAuthor Commented:
I might be missing something, but wouldn't I need a switch if I went with the PIX-506E-BUN-K9 or PIX-515E-R-BUN as they don't have enough connections built into the unit.  I'm trying to avoid that if possible as it'll cost me another bunch of cash to buy the switch and more again to get another 1U of rack space (Though it might actually cost less than buying a higher end model of firewall).
0
grbladesCommented:
You can buy a switch for less than £100 and the PIX is quite small. You will be able to mount the PIX at the front of the rack and the switch at the back so they both share 1U of space.
The 506 is not rack mounted but is 1U high and just a small square shape so you can either just sit it on top of a server infront of the switch or make a couple of brackets for it.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
PsychotextAuthor Commented:
Interesting video on the watchguard firewalls.  A bit PHB level, but interesting nonetheless.

http://216.211.129.9/watchguard/WatchGuard_Security_Challenge.wmv
http://216.211.129.9/watchguard/WatchGuard_Security_Challenge_lo.mov (Lo res)
0
PsychotextAuthor Commented:
Thanks for all the info.  I think I've got enough to be going on with for now.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Software Firewalls

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.