Home / server / Questions / 233574
Accepted
Jon Tackabury
Asked: 2011-02-10 13:54:55 +0800 CST

Firewall for servers at a colo?

  • 772

I'm moving a couple of servers to a colo and was wondering what you would recommend for a hardware firewall to sit in front of them? Is it fine to just get the cheapest Cisco/Fortigate/Juniper/whatever firewall? I don't need anything fancy, pretty much just port forwarding.

firewall colocation

4 Answers

  1. Here's an example for some criteria you'll want to consider when selecting a firewall in the scenario you described:

    1. Feature set - Make sure it'll perform your immediate and potential future purposes.
    2. Performance - Co-location generally provides good network connectivity and throughput. Make sure the device you pick will handle the anticipated loads you'll be capable of.
    3. Form factor - You're paying to put equipment here, the smaller the equipment, the more you can pack in.
    4. Management - Some devices offer features that make remote management easier, and give you tools in the event you find yourself unable to access it.

    I imagine the brand names you've mentioned would have models capable of what you're asking. Most likely it would come down to performance and management of the equipment.

    • 2
  2. Best Answer

    I would not get the cheapest firewall. You need to look at your requirements such as throughput, active connections, security, vpn requirements and more. If it needs to be cheap I would recommend setting up a separate linux box as the firewall using iptables. If there is budget for a firewall but you need something small consider the cisco asa 5505(smaller than 1U), or if you need something with more requirements consider the 5510 or 5520 which are rack mountable. The cisco firewalls have a gui interface and after initial setup can be relatively easy to manage.

    • 1

  3. You are probably looking at "wasting" at least 1U of rack space for this firewall.

    I would not buy a consumer-grade cheapie firewall.

    The Juniper Netscreen SSG5 would probably meet your needs, but it is a paperback size format and doesn't come with rack arms (that I recall). The first "rackable" SSG is the SSG140, but that's not quite so cheap -- definitely overkill for your application here.

    If you can figure out a way to mount it neatly, the SSG5 would almost certainly be sufficient.

    • 1

  4. Alternatively - get a Mikrotik RB1100 and see how far it lasts (50mbit for smallish packets was on the table by someone running game servers).

    It is CHEAP and has a TON of features in RouterOS. Uses very little power, too.

    Then later you can upgrade to something more powerfull if needed. Again, the RB1100 is CHEAP to start with.

    • 0