[121096] in North American Network Operators' Group
Re: I don't need no stinking firewall!
daemon@ATHENA.MIT.EDU (Dobbins, Roland)
Sun Jan 10 05:54:21 2010
From: "Dobbins, Roland" <rdobbins@arbor.net>
To: NANOG list <nanog@nanog.org>
Date: Sun, 10 Jan 2010 10:45:47 +0000
In-Reply-To: <6eb799ab1001100048n69349777n4c95b506067aa753@mail.gmail.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Jan 10, 2010, at 3:48 PM, James Hess wrote:
> Firewalls do not need to build a state entry for
> partial TCP sessions, there are a few different things that can be
> done, such as the firewall answering on behalf of the server (using
> SYN cookies) and negotiating connection with the server after the
> final ACK.
The firewall capacity for doing this can be easily overwhelmed; and again, =
well-formed traffic can simply 'crowd out' good traffic. The other drawbac=
ks of the stateful firewall further outweigh even this negligible benefit.
Fronting one's Web server farms/load-balancers with a tier of transparent r=
everse-proxy caches is a better way to scale TCP connection capacity, as we=
ll as the myriad other benefits offered (described earlier in this thread).
-----------------------------------------------------------------------
Roland Dobbins <rdobbins@arbor.net> // <http://www.arbornetworks.com>
Injustice is relatively easy to bear; what stings is justice.
-- H.L. Mencken
