RSS
|
|||||||||||||||||||||||||||||||
  RADWARE FireProof Balances Firewall Loads With Minimal Complexity April 5, 1999
In contrast, RADWARE's FireProof, a dynamic load-balancing system, directs traffic through the firewalls behind it and is designed to immediately detect a firewall failure. With FireProof, client configuration is identical across the network, and the entire solution is represented as a single firewall to your internal network. The addition of a second FireProof unit to your network provides complete redundancy, creating an extremely reliable multiple firewall configuration. FireProof works with any firewall, so you can keep existing equipment in place. We tested FireProof in our University of Wisconsin-Madison Real World Labs® in conjunction with a pair of NetScreen Technologies NetScreen-100 firewalls. But before we began testing, we explored alternative methods for setting up a redundant configuration with multiple firewalls: It's not an easy task (see "FireProof Redundant Configuration" and "Alternate Redundant Configuration," Below). Our tests showed that FireProof is a worthwhile investment for multiple firewall installations. This completely fault-tolerant solution eases management and redundancy woes associated with complex router and network configurations. We found FireProof most well-suited for multiple firewall installations requiring fault tolerance without extensive tinkering or proprietary protocols. The extra load-balancing box that offers added redundancy is worth the $6,500-per-box price. We set up a trusted network behind a single FireProof unit and two NetScreen-100 firewalls. After configuring the firewalls with IP addresses and default security policies, we were able to insert FireProof into the network as its new default gateway. We then directed our clients to route traffic to FireProof's IP interface and configured FireProof with the firewall IP information and weighting metrics. A one-time configuration of the hosts on the trusted network also was necessary to configure the new network's default gateway. This can be avoided by changing the IP address on the router and assigning the existing default route's IP address to FireProof. FireProof's primary value lies in its menu of management options along with its load-balancing capabilities. During our tests, we were able to add the second firewall without interrupting any traffic. Once a firewall is marked as "shutdown," FireProof stops sending traffic to it, letting you gracefully remove firewalls for service without causing any problems with client traffic.
FireProof supports multiple load-balancing algorithms, including round robin (cyclic), least traffic and least users. We especially liked its support for configurable SNMP queries: It can query for private SNMP parameters from software and hardware firewalls and public SNMP parameters from Microsoft Windows NT-based firewalls, such as FireWall-1. Two separate weight schemes can be modified to suit your needs for both public and private parameters. Gauging individual firewall loads based on these parameters is more valuable than evaluating ping response times. We managed FireProof with RADWARE's Config Master software, an easy-to-use and easy-to-navigate SNMP-based management tool. Using Config Master's real-time performance monitors, we determined the amount of forwarded traffic and number of dropped frames. Additionally, we verified client IP session information from within Config Master. However, we would have preferred a cross-platform management tool or a Web-based interface. (RADWARE says it's working on a Java/ Web-based management tool.) To test the performance and reliability of FireProof, we ran traffic-generating benchmarks and found FireProof's performance suitable for the needs of most access links with a sustained throughput of approximately 80 Mbps to 83 Mbps. We reached approximately 104 Mbps with only one firewall between the trusted and untrusted segments. While we were testing FireProof Model C (based in the I960C Intel processor), RADWARE began shipping Model H (which is based on the I960H processor). This new model is said to be close to wire speed. We recommend FireProof for network installations with a need for highly redundant firewall configurations with slower access links. Performance will be an issue for gigabit and some Fast Ethernet networks. Send your comments on this article to Gregory Yerxa at gyerxa@nwc.com.
|
|||||||||||||||||||||||||||||||
Here
Here
our customizable newsletter, sends you security alerts, product updates and software patches on the products you use. Sign up now at 
Click to view the Report card on RADWARE FireProofPage 1 | 2 | 3 | Next Page |
