Great Circle Associates Firewalls
(January 1996)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: Linux as a firewall
From: Darryl Wagoner <darryl @ sai . com>
Date: Sun, 14 Jan 1996 09:59:09 -0500 (EST)
To: Todd Hooper <todd @ momentum . com . au>
Cc: Firewalls @ GreatCircle . COM, dana @ nav . cc . tx . us
In-reply-to: <v02130508ad1e8294470a @ [203 . 2 . 238 . 138]>

Greetings, 

I don't normally get into these discussing, but there is enough flaws
in logic that I must reply.

On Sun, 14 Jan 1996, Todd Hooper wrote:

> Dana writes:
> 
> >I've noticed that a lot of people say they use Linux as part of their
> >Internet firewall.  But now I've had a company tell me that Linux isn't a
> >true multi-tasking operating system, so it shouldn't be used as a
> >firewall.  What's the true story here?

The person that told you that Linux isn't a multi-tasking OS doesn't have
a clue.  It is a very good multi-tasking and multi-users system.

> They are:
> 
> 1. Support infrastructure for non-commercial operating systems
> 
> Is there commercial technical support available? Does it fit in
> with your existing support arrangements for mission critical
> systems?
> 
> In my locality, the answer to this question is no. Relying on
> non-commercial and Internet based support is highy questionable,
> especially if the failure of the system means you may not have any
> access to the main support channel.

Not every living or visiting Australia, I can't say too much about
the support.  But it seems unlikely that the OS would be have a
failure that wouldn't allow you access to the net.  As far as hard
wear failure in many cases a hot spare is a affordable as a maintain
contract when you add in down time.

> 2. Ability of Intel vendors to provide hardware maintenance and spares
> 
> If your Intel based host melts down into a pile of ash, can your
> Intel vendor provide a decent level of hardware maintenance?
> Can they provide a replacement machine with an identical
> configuration? Given the pace at which Intel motherboard
> technology advances, most designs are usually obsolete within
> 6 months. Don't forget all of the supporting storage, video
> and networking cards as well which your system requires
> to function.

Obsolete doesn't mean that you can't get them.  The may be more
of a problem with COT OS than Linux.  Linux support for new hardware
is very good as well, because of the large group of programmers working
on it. 
 
> If you can't get an identical replacement system, how is that
> going to affect your ability to rebuild the system from backups?
> Is your Unix implementation such that a backup from the original
> host with hardware configuration X will be useless when you
> move to the replacement host with hardware configuration Y? I
> am not an expert in this area but I am led to believe that it can
> be problematic to recover from this type of situation without
> reworking some of the installation to accommodate the hardware
> changes.

This isn't as big of a problem as it sounds.  Let look at the list
of possible crash and burn parts:

	* Mother board - This is really the big concern
	as they charge quickly and OS can be thrown by the
	changes.  But if you don't try to stay on the bleeding
	edge then Linux will support just about any mother board
	you throw at it.

	* Memory  - Never heard of Linux having problems with
	memory

	* Disk controller - Not a big risk, but buy a spare

	* Vidio - the all support CGA mode which for a firewall
	is all you need.

	* Ethernet - very standard and very cheap buy a spare

If it is mission critical then I would have a hot spare.  This 
would mean no downtime and you can take your time in solving your
first FW problem.  

Software support is another issue.  Take any vendor you wish to name
and you are looking at 3-6 weeks min. for a show stopper problem in their
OS to be fixed.  I have had problems fixed on Linux within hours of
reporting it.  If your problem is only effecting you or they don't
consider it a show stopper (which in most cases they don't) then it
will be fixed in the next release.  

With Linux you always have the option to fix it in house.


--
Darryl Wagoner		darryl @
 sai .
 com   http://www.sai.com/
Office: 603.672.0736   		Fax: 603-672-4846
Web Pages for hire.   Check out NH & MA Movies http://www.sai.com/movies



References:
Indexed By Date Previous: Re: Relijon, Firewalls, Filosofi
From: Sick Puppy <sikpuppy @ maestro . com>
Next: RE: Linux as a firewall
From: Chris Woods <cjwoods @ wire . paladin . com>
Indexed By Thread Previous: Re: Linux as a firewall
From: todd @ momentum . com . au (Todd Hooper)
Next: Re: Linux as a firewall
From: Rabid Wombat <wombat @ mcfeely . bsfs . org>

Google
 
Search Internet Search www.greatcircle.com