We wll definitely run separate pairs of switches. The only clean way to avoid the 4 x switch requirement is to use Routed Edge Resiliency, which doesn't seem ideal as it uses OSPF for failover.
State sync is a requirement so it looks like we will be going with a pair of SSG-550s. Hopefully all the firewall features from ScreenOS will one day be moved to mainstream JunOS. -----Original Message----- From: Amos Rosenboim [mailto:[EMAIL PROTECTED] Sent: Monday, 21 April 2008 7:16 AM To: Florian Weimer Cc: Campbell, Alex; juniper-nsp@puck.nether.net Subject: Re: [j-nsp] J-series stateful firewall / NAT architecture I Indeed mean using VLAN separation. Although this is considered not a good practice for this scenario, mainly because of VLAN hopping and other L2 attacks, considering that there are L3 devices connected to this switch from all directions it does not look as a too big of a risk. Of course the 4 switches option is preferred if the budget allows it. Amos On Apr 19, 2008, at 7:56 PM, Florian Weimer wrote: > * Amos Rosenboim: > >> >> Regarding the number of boxes, you can consolidate the 4 switches to >> just two by using vlans. > > Huh? You either lose redundancy, or you heavily rely on VLAN > separation on those switches. Neither seems to be a good idea. > > -- > Florian Weimer <[EMAIL PROTECTED]> > BFK edv-consulting GmbH http://www.bfk.de/ > Kriegsstraße 100 tel: +49-721-96201-1 > D-76133 Karlsruhe fax: +49-721-96201-99 ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ _______________________________________________ juniper-nsp mailing list juniper-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/juniper-nsp
