[164721] in North American Network Operators' Group
RE: which firewall product?
daemon@ATHENA.MIT.EDU (Warren Bailey)
Tue Jul 30 16:04:24 2013
From: Warren Bailey <wbailey@satelliteintelligencegroup.com>
To: William Herrin <bill@herrin.us>, "nanog@nanog.org" <nanog@nanog.org>
Date: Tue, 30 Jul 2013 20:03:52 +0000
In-Reply-To: <CAP-guGV66EJebHOhkOuxAo7OcYbSt_Asa_nQSCysBdBQiq2eBw@mail.gmail.com>
Reply-To: Warren Bailey <wbailey@satelliteintelligencegroup.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Look into pfsense. It's rock solid and bad based, and can be purchased as a=
n appliance. (both real and vm)
Sent from my Mobile Device.
-------- Original message --------
From: William Herrin <bill@herrin.us>
Date: 07/30/2013 1:02 PM (GMT-08:00)
To: nanog@nanog.org
Subject: which firewall product?
Hi folks,
I'm trying to identify a firewall appliance for one of my customers.
The wrinkle is: it has to be able to inspect packets inside an IPIP
tunnel and accept/reject based on IP address, TCP port number and
standard things like that. On the packet carried *inside* the IPIP
tunnel packet.
From what I can tell, the Cisco ASA can't do this.
Linux iptables can (with the u32 match module) but the customer wants
an appliance, not a server.
What appliances do you know of that can do this? Is there a different
Cisco box? A Juniper firewall? Anything else?
Thanks in advance,
Bill Herrin
--
William D. Herrin ................ herrin@dirtside.com bill@herrin.us
3005 Crane Dr. ...................... Web: <http://bill.herrin.us/>
Falls Church, VA 22042-3004
