On Monday 12 October 2009 01:00:29 am Gert Doering wrote: > So, if you put a fiewall in front of a well-maintained > server, all you add is "extra state table handling" with > all the problems it brings - state table overflow (=new > connections getting dropped), state getting > desynchronized with the server, firewall CPU exploding > long before the server is hitting any load boundaries, > and worst of all, weaknesses in the firewall products > that can be used to crash the firewall, DoSing the > server. > > The worst thing you can do is put a stateful firewall in > front of a busy DNS server - every single packet creating > new state will bring most hardware-based firewalls to > their knees, because "session churn" is usually handled > at much lower packet rate as "pure packet throughput for > existing state"...
Agree. Cheers, Mark.
signature.asc
Description: This is a digitally signed message part.
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
