Re: [FW-1] Runnins FW-1 SP5 on a Sun Ultra 5 Sparc.

[Patrick Glynn <ptglynn@FW1-NOSPAMHOTMAIL.COM>]

Howdy,

We use the U5 extensively in our infrastructure (>100 worldwide) and have
developed a configuration in house that works with minimal fuss and muss. We
discovered that a cold standby introduced too many variables into the
equation (keeping patches current, putkeys, etc.). And we weren't always
sure it would come up and play nice. What we ended up doing is setting up a
warm-standby configuration wherein we have a unique (to each box) control
link on the internal network for pushing policy and management purposes in
addition to the "production" interfaces on the FW. We set up the routing on
the U5 so that the management traffic (logging, rule pushes, SSH) goes out
the dedicated management interface whilst all other traffic goes through the
production interface. It takes a little more time to configure, but the
standby firewall can be kept patched up easier, have the latest policy
(since it is pushed to both) and fail over can be achieved by doing the
appropriate [no] shut on the switches. Our SLA is 4 hours, but that includes
the time to find the local router guys and get them on site in non-24hr
shops.

hth,
PTG



_________________________________________________________________
Tired of spam? Get advanced junk mail protection with MSN 8.
http://join.msn.com/?page=features/junkmail

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================