• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Home data center..firewall needed

T

trinimoses

n00b
Joined
Jun 30, 2010
Messages
17
Good day all,

I am looking at setting up a small data center with a dell vstart 50 ..and a few qnap boxes.

I will be doing some email services and some level of offsite backup and probably host a few sites.

Was wondering what would the a good firewall appliance to invest in.. looking to start off with a 10mb internet pipe and grow as need.


any pointers will be nice.
 
If you are looking for something easy to configure I would take a look at Astaro.
 
Cisco ASA 5505/10 Security Plus ANYDAY of the week. Even better I would get an ISR-G2 router, i.e. 1921, 1941, 2901, 2921. Probably dont need to get into the 3000 series or even higher in the 2900 series.

ASA 5505 can support hundreds of hosts with 512mb ram. Can do 20 VLANs. 802.1q trunking IPSEC / SSL VPN tunnels on a hardware level. 5510 can run circles around the 5505 and do a lot more.

I own one and can personally vouch for both. The ISR-G2 series can do all of the above a shit ton more.

You do not want to have a UTM running for a data center. A UTM is not meant for data center level networking between servers. It is meant for an office of people surfing facebook amazon and google.

To other poster recommending an ISR. I would agree that an ISR would be even better than an ASA. Once again I own both. The firewall on Cisco IOS Zone Firewall is far easier to use, just as secure in almost any real life scenario, FIPS certified, and is very very fast indeed. In addition you get IPS (Intrusion Prevention System) which is included in the licensing structure of the 1921 - 2901 models. This is an additional feature on the ASAs that you have to pay for unless you get security plus and/or an AIP module to plug in the back. There seems to be a big misnomer that Cisco ISR routers are using only ACL or some kind of stripped down firewall as was the case in the old days. However the ISRs of today use a complete full power stateless firewall.

The real benefit in using an ISR (Integrated Services Router) is UTM services, advanced hardware accelerated firewall, Encryption (VPN), the ability to add modules to your router, i.e. I have an 8 port EHWIC Gigabit Switch Layer2 in mine as we speak, and the ability to use real routing protocols over different mediums i.e. MPLS, Metro, Fiber mediums, Copper Ethernet, Serial, T1-Twhatever, Docsis 2 and 3 cable modems, 3g/4g, wifi, etc.... cant do this with an ASA, Astaro, pfsense, you name it. If you choose to NOT use a router you are strictly limited to ethernet only. The ASA is also limted to Static routing, RIP1-2, OSPF, Limited EIGRP, no BGP, no MPLS, etc... Cant use fiber modules, and are more expensive. The ASA was actually intended to be used as a firewall behind a l3 router. Although the ASA can route only over ethernet, it was never actually intended to be a true edge router.

From the sound of your description I would recommend you look at either an ASA 5510 - Great Solution. Make sure you get Security Plus. Can get on ebay for great prices used. Or get an ISR-G2 2901/2921 if budget allows Security Services enabled versions. Part number would be 2901/SEC-K9. This would be the completely optimal solution as an edge router. For layer 3 intervlan routing the 2921 will be much faster than the 2901 and will blow away the 1921. I recommend a good layer 3 switch to tie all of it together. If server throughput is going to be limited to 1gbps and small buffers are okay I would recommend a 3750G- 24 or 48 port used off of fleabay with IP-base licensing. Use it as your gateway behind your router or ASA and it will blow the doors off ANYTHING in l3 intervlan routing.

Good luck in your decision.

**Edit... Apparently the Astaro/Sophos can do advanced routing protocols however I am not sure how it supports different serialized mediums etc... I am not a Sophos geek. I stand a little self corrected.
 
Last edited:
This is a home Datacenter, not a mission critical enterprise environment. Refurb an old computer or server and throw pfSense on it.

You'll save a few hundred dollars at least. Take this money and buy more UPS power or some other redundancy.

I run a small DC at my house, 200mbit worth of fiber, IPS, failover, redundancy, etc... All running 25 servers and a sustained 25-53mbps 24/7. pfSense is perfect.
 
Last edited:
Brak710 said:
This is a home Datacenter, not a mission critical enterprise environment. Refurb an old computer or server and throw pfSense on it.

You'll save a few hundred dollars at least. Take this money and buy more UPS power or some other redundancy.

I run a small DC at my house, 200mbit worth of fiber, IPS, failover, redundancy, etc... All running 25 servers and a sustained 25-53mbps 24/7. pfSense is perfect.
Click to expand...

Right... I always go way overboard because that is the consultant in my blood. Too many people get just enough, and then a few months later its not enough, so they get just enough more, and then again its not enough, and then on and on.

Not everyone considers a home data center, not mission critical. It all depends on what the end user defines. If I were running a mission critical anything it certainly wouldnt be with pfsense or some home PC hardware powered opensourced firewall product. I am well aware of it's merits. I am not bashing pfsense. I certainly am not arguing with you either.

I just believe that any datacenter is still a datacenter whether in home or a dedicated building. Its all about how you regard it.

I or anyone could certainly run a full colo out of their basement if they wanted too. There is no law that prevents someone from installing a 100meg fiber ethernet circuit in their house if they had the money and business to back it. Nor is there any thing stating that you couldnt obtain an ASN and Border route from your home as well.
 
I would personally build a pfsense box, heck think they can do redundancy/fail over. Build two, and build them with redundant boxes (redundant PSU, raid). I'm pretty sure pfsense supports multiple lPs... something to look into first though, I imagine you don't want everything behind a NAT and a single IP.

I wish I had the bandwidth to run a home data center, I totally would do it. I like the idea of getting lot of people to pay for my heating bill and make profit on top of it. :p

Actually, does pfsense support ipv6 at all? I don't think it does though I have not tried 2.0 yet. That's another thing to consider for future proofing sake.
 
Red Squirrel said:
I would personally build a pfsense box, heck think they can do redundancy/fail over. Build two, and build them with redundant boxes (redundant PSU, raid). I'm pretty sure pfsense supports multiple lPs... something to look into first though, I imagine you don't want everything behind a NAT and a single IP.

I wish I had the bandwidth to run a home data center, I totally would do it. I like the idea of getting lot of people to pay for my heating bill and make profit on top of it. :p

Actually, does pfsense support ipv6 at all? I don't think it does though I have not tried 2.0 yet. That's another thing to consider for future proofing sake.
Click to expand...

current release supports IPv6 fyi
 
Thanks for the feedback guys.. I have looked at pfsense, but i am looking for something that can handle the growth that we might get... started looking at the cisco boxes and the astra stuff.
 
Another vote for the 5505/5510 that everybody is raving about here. I've got 3x 5505's and 1x 5510, no tat home though. :)
 
If you're on a tight budget and have some extra hardware, I'd run pfSense. I had a pretty robust pfSense setup with 4 redundant nodes.
 
I use a Sonicwall TZ210 works great 2 webservers vpn 3 vlans etc etc working like a charm.

Soon to grab a NSA2400, but these are all still UTM's..
 
i also looked at some of the sonicwall offerings... since dell bought them out i was going to ask the sales rep to send me quote one of their firewall appliances..
 
The ASA 5510 is good, stay away from the 5505....it's too limiting.

The Juniper SSG140 is the crossover from the ASA 5510.. I think it is better at routing than the 5510, but they are comparable.
 
I have used SSG5/20 and SSG140 - and while ScreenOS isn't the most intuitive thing in the world the first time you use it, i find them to perform well and be straightforward to manage.

FWIW, I have an SSG5 at home.
 
You must log in or register to reply here.
Back
Top