Re: [FW-1] Using Cisco IOS firewall feature set

[Don <don@FW1-NOSPAMBLACKSUN.ORG>]

> I am looking at complimenting our FW-1's with switches installed with
> the Cisco IOS firewall feature set.
>
> I would like to implement this on 6500 switches also using layer 3
> switching so inspection can be done on switches and not on fw nic.
> We primarily would like to reduce unessesary internal to internal
> traffic.
>
> Does anyone used the IOS firewall in production and can give advice?
I have used both standard access lists and IOS Firewall in production. IOS
Firewall is a lot like PIX-lite. If you need a smaller firewall for a
limited set of reasons, then it may be perfect.

When I have CheckPoint in an environment, I tend to let the firewall act
like a firewall and I reserve access lists and IOS firewall for things
like anti-spoofing, blocking attacks on the router or switch directly, and
limited other uses.

It makes troubleshooting problems a lot easier when you do not need to
figure out what system is a causing a problem, your router, your switch or
your firewall.

> Are there any peformance comparisons?
It would not be fair to compare performance because the capabilities of
IOS Firewall and PIX or CheckPoint are very different.

-Don

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================