From: Dave Paris <dparis@w3...> - 2003-09-21 11:13:44
I'll address point #2 as I believe #1 is answered elsewhere in the
archives for this list and/or FAQ and/or documentation.
An OpenSSI cluster *could* be used for *some* HA/LB firewalling
applications but there are caveats.
a) The firewall must be of a bridge type. Since each node in the
OpenSSI cluster is dynamically addressed, there is no concept of
"inside" and "outside" interface. Only bridging firewall applications
require no addresses on either the "inside" or "outside" interface.
That being said, each node would need three NICs. Frankly, I'd find it
much easier to use Spanning Tree Protocol to balance than go through
the exercise of configuring a firewall farm as an OpenSSI cluster.
b) The firewall must not do stateful inspection. (iptables would be
'connection tracking') Because the load is spread to different nodes as
needed, there's no guarantee an existing connection would be known by
all nodes. For me, stateful firewalls are *keenly* important.
Additionally, as wonderful as all the free products in the world are,
there are times when a commercial product makes more sense. In this
case, the BigIP FireGuard 520 from F5 Networks. (
Don't get me wrong. I'm a huge fan and supporter of OpenSSI and OSS in
general. I use OpenSSI daily. I use firewalls built from Linux and
*BSD. I use Snort. I use Apache & MySQL. I contribute to Perl,
mod_ssl, and other projects. On the other hand, I also deploy some
commercial (and, in some folks opinion, quite pricey) devices like
TopLayer IDS Balancers ( http://www.toplayer.com ) and F5 FireGuard 520s to
tie the OSS stuff together. It's nearly impossible to beat well
designed, ASIC-based devices with software.
[never try to teach a pig to sing, you only end up frustrated and with
a very annoyed pig]
On Sunday, Sep 21, 2003, at 02:55 US/Eastern, Segree, Gareth wrote:
> 1.Can Apache or Sendmail be installed on a openSSI cluster and benefit
> from load balancing and HA
> 2. Can openSSI be installed as a HA/Loadbalancing firewall