[c-nsp] 6500 with IOS Firewall - Any experiences?

[Gustavo Novais]

Thanks Brian,

By any chance do you know if in case he'd choose the IOS firewall, there would be anything like SDM to manage it? I didn't find anything like it.

Anyway, you've convinced me. I'll suggest him to continue using its current pix525 cluster, although I still think he'd be better suited with a sup32 than with a sup720.

Do you know if the sup32-PISA brings any improvement on the IOS firewall area?
 
Thank you very much.

Gustavo Novais

 

-----Original Message-----
From: Brian Stiff (bstiff) [mailto:bstiff at cisco.com] 
Sent: terça-feira, 5 de Junho de 2007 20:52
To: Gustavo Novais
Cc: cisco-nsp at puck.nether.net
Subject: RE: [c-nsp] 6500 with IOS Firewall - Any experiences?

Hi Gustavo-

I'd thought this had come up on the list before, but I couldn't find it
in the archives.  

If you're really looking for performance, breadth of features, and
continued support, I'd really suggest that you steer your customer
toward an FWSM or PIX/ASA.  The IOS Firewall Feature set on the Cisco
IOS Software for the Catalyst platforms is based on *very* old code, and
includes none of the last 4-5 years' development efforts.

If your customer insists that they want to try IOS Firewall, be advised
that some people have had limited success, but more often than not, most
customers I've seen trying this have ended up spending the money on the
appropriate gear after seeing the performance impact and functional
shortfalls that the Supervisor's IOS Firewall offers.

Regards,
Brian

Brian Stiff
720.562.6462
IOS Firewall
Technical Marketing Eng.
Security Technology Group
http://www.cisco.com/go/iosfw

> Date: Mon, 4 Jun 2007 20:59:47 +0100
> From: "Gustavo Novais" <gustavo.novais at novabase.pt>
> Subject: [c-nsp] 6500 with IOS Firewall - Any experiences?
> To: <cisco-nsp at puck.nether.net>
> Message-ID:
> 	<D976F12A91106C4FA9BFF152C93B4652094B5560 at gemini.novabase.intra>
> Content-Type: text/plain;	charset="us-ascii"
> 
> Hi, 
> 
>  
> 
> I currently have a customer who is buying a 6500 with 
> redundant SUP720, but he doesn't want to use the SUP for L3 
> (only L2) because currently all of its L3 is done on a 
> PIX525, on which he has lots of rules, and is able to manage by ASDM.
> 
> He does not wish to buy a FWSM, so I told him that eventually 
> IOS firewall feature set would do the trick, with the CBAC 
> features, etc. 
> 
>  
> 
> What I'd like to know from the list experience is if indeed trading a
> PIX525 (with fastethernet interfaces) and ASDM for management 
> for a sup720 with IOS Firewall and ____________ (fill in the 
> blanks) for management, is worth it or not.
> 
>  
> 
> I've already alerted him to eventual scalability issues, but 
> his deployment is not that big, only around a dozen vlans, 
> and nothing much else.
> 
> Any suggestions are welcome... 
>  
> 
> I've checked if we could manage that type of features (namely 
> CBAC) with CiscoView, but didn't reach any conclusion...
> 
>  
> 
>  Thanks
> 
>  
> 
> Gustavo Novais
>