Re: [FW-1] IDS and Hot Standby

[Don <don@FW1-NOSPAMBLACKSUN.ORG>]

> Hi, does anyone have any recommendations for IDS and Hot Standby
> (failover) systems? I have a project to design which requires CheckPoint
> NG on IPSO (Nokia IP440) and would like to include the above. The
> firewall will be in place to protect a webserver running iis5.
Depending on what you want to accomplish with your IDS, there are two
excellent choices. For low cost and excellent performance, look into
snort.

For a highly scalable, high performance IDS with a large signature base,
take a look at Dragon IDS (Now being developed by Enterasys I believe).

Neither on should be run directly on your firewall, but preferably on high
performance box directly in front of or behind your firewall (depending on
your network security policy).

As for HA on the Nokia, I believe someone already suggested VRRP which
would be the best solution for the firewall.

-Don

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================