Re: FreeBSD router - large scale

2010-06-23 Thread Kevin Wilcox
On 28 May 2010 07:38, Bruce Cran br...@cran.org.uk wrote: This is possibly the wrong place to be saying this, but isn't OpenBSD usually recommended for routers? I believe the version of pf, for example, is normally kept more up-to-date than than in FreeBSD.  The major downside I know of is

Re: FreeBSD router - large scale

2010-06-23 Thread Kevin Wilcox
On 27 May 2010 12:12, Matthew Seaman m.sea...@infracaninophile.co.uk wrote: The hardest job I've had an OpenBSD firewall do is actually as a mid-level firewall between a DMZ full of web servers and a back-end database layer.  The thing to watch out for is running out of states in PF.  It's

Re: 'Serious' crypto? (was: FreeBSD router - large scale)

2010-05-28 Thread Peter Cornelius
Hi Chuck, Thanks for the response. Or is it still worthwhile to consider hardware accelerators such as the ones guys like soekris [1] and others offer? Does anyone have an idea how much such an accelerator may help on older vs. on newer hardware? Something like a 1GHz P3 or equivalent can

Re: FreeBSD router - large scale

2010-05-28 Thread Svein Skogen (Listmail Account)
On 27.05.2010 17:00, Kevin Wilcox wrote: Hello everyone. We're in the very early stages of considering [Free|Open]BSD on commodity hardware to handle NAT *and* firewall duties for (what I consider to be) a sizable deployment. Overall bandwidth is low, only a gigabit connection, but we

Re: FreeBSD router - large scale

2010-05-28 Thread Bruce Cran
On 28/05/2010 12:31, Svein Skogen (Listmail Account) wrote: On 27.05.2010 17:00, Kevin Wilcox wrote: Hello everyone. We're in the very early stages of considering [Free|Open]BSD on commodity hardware to handle NAT *and* firewall duties for (what I consider to be) a sizable deployment.

Re: FreeBSD router - large scale

2010-05-28 Thread Svein Skogen (Listmail Account)
On 28.05.2010 13:38, Bruce Cran wrote: *snip!* This is possibly the wrong place to be saying this, but isn't OpenBSD usually recommended for routers? I believe the version of pf, for example, is normally kept more up-to-date than than in FreeBSD. The major downside I know of is that it's

Re: FreeBSD router - large scale

2010-05-28 Thread Nikos Vassiliadis
Svein Skogen (Listmail Account) wrote: Actually, I'd find an answer from the FreeBSD Networking gurus useful as well. My trusted Cisco 3640 is getting old (had it's ten-years-of-service birthday a little while ago), so I guess I must be prepared to replace it with something new. Preferrably

FreeBSD router - large scale

2010-05-27 Thread Kevin Wilcox
Hello everyone. We're in the very early stages of considering [Free|Open]BSD on commodity hardware to handle NAT *and* firewall duties for (what I consider to be) a sizable deployment. Overall bandwidth is low, only a gigabit connection, but we handle approximately fifteen thousand devices. DHCP

Re: FreeBSD router - large scale

2010-05-27 Thread Matthew Seaman
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 27/05/2010 16:00:12, Kevin Wilcox wrote: Hello everyone. We're in the very early stages of considering [Free|Open]BSD on commodity hardware to handle NAT *and* firewall duties for (what I consider to be) a sizable deployment. Overall

'Serious' crypto? (was: FreeBSD router - large scale)

2010-05-27 Thread Peter Cornelius
Hi, NAT. Doing serious crypto slows things up somewhat. I've been pondering this since a while but thought that crypto engines on modern hardware would make 'extra' hardware accelerators obsolete? Or is it still worthwhile to consider hardware accelerators such as the ones guys like soekris

Re: 'Serious' crypto? (was: FreeBSD router - large scale)

2010-05-27 Thread Chuck Swiger
On May 27, 2010, at 1:49 PM, Peter Cornelius wrote: Hi, NAT. Doing serious crypto slows things up somewhat. I've been pondering this since a while but thought that crypto engines on modern hardware would make 'extra' hardware accelerators obsolete? It depends upon usage. Or is it