Stefano rote:
>We are asked to warrant a >99,5% uptime for a firewall system in a financial
>organization. We're trying to figure out what's the best way to manage such
>a problem (a fault-tolerant hardware solution? A multiple firewall solution?
>other tricky configurations?).
>Has anybody out there already experienced and solved such a problem?
Yes, but the answer can be expensive. One machine cannor guarentee this
kind of uptime though RAID disks can help. Two machines can if all other
systems are also redundant (remember my story about the dump truck snapping
a power pole that landed on the backup generator building ?). Three are
better.
At the moment I do not know of any firewall using Tandem fail-operational
computers, so the first question is "will the site be manned at all times the
net is needed ?". If so you could use a manual switchover to a hot spare.
-All sessions in progress will experience interruptions but the net will
only be down for as long as it takes to switch the net.
I have been looking into multiple firewall machines from a performance
standpoint (one for WWW, another for FTP, a third for other TCP) running
in parallel with the capabilitiy to reconfigure on failure but do not
know of anything commercial as yet.
>From my flight control days, I know that it takes three (minimum) to vote
intelligently to decide on "soft" failures though two can handle
catastrophic. Dunno if anyone is working fail-op though most promise
fail-safe.
99.5% means about 3.5 hours downtime per month, not terribly hard to meet
with a manual system and people on site. Depends on your needs.
Warmly,
Padgett
|
|
